862

Contact:	 Ciaran Ward
Phone:	 01483 444072
Email:	 ciaran.ward@guildford.gov.uk	

2 May 2018

Re: General Data Protection Regulation – Appointment of Data Protection Officer (DPO)

Dear Parish Councillors

Following your expression of interest in Guildford Borough Council (GBC) providing an officer from the Legal Services team under a service level agreement to act as DPO for participating parishes, on a full cost recovery basis, I would like to confirm the provisional appointment of Ciaran Ward, the council’s Information Rights Officer to this role.

The role of the DPO will be to coordinate support and advice around data protection matters, to assist the participating parish councils in the transition to the new GDPR regime, and to provide on-going single point of contact advice.

The DPO will meet with participating parish councils to discuss themes, concerns, and to describe the proposed work programme. 

The DPO will prepare, for review:
-	Data Protection Officer – service level agreement
-	Data Protection Officer – suggested appointment report
-	Transition work programme, and ongoing support arrangements

The DPO will meet with the participating parish councils monthly to establish any data-related issues, to ensure GDPR compliance and if necessary offer advice and guidance. A telephone and email “hotline” will be available, and the DPO will coordinate support and advice around data and Information matters. Depending on preferences, diary commitments, and by agreement, meetings may be run as workshops with various PC clerks, or conference calls (whether individual, or among groups).

Initial meetings will review existing personal data (in both paper and electronic form) held by PCs, deciding on legal basis for processing (eg public task, consent, contractual obligation, etc), assisting with decisions on which data is no longer required, or has no legitimate legal basis under GDPR and subsequently to arrange for data to be securely disposed of.

Some PCs may be more advanced than others in this regard, so priorities can be identified early on.
Other areas of guidance may include:
•	Writing privacy statements
•	Retention/disposal schedules
•	Data sharing protocols (eg with third parties)
•	Update of existing data-related policies
•	Carrying out data audit
•	Training for new parish councillors
•	Advice on handling data breaches
•	Mailing lists (if applicable) – consent to receive mailings to be confirmed 

Once we have assisted you through the transition period, we would look to offer you an annual subscription fee, based on a basic level of support, the transition work and the single monthly meetings with two hours of advice (either by email, in person, or by phone).

As we do not fully know what support you would need for the transition period, we would look to assist you with a mix of support from GBC, and where necessary, external support – the cost of which we would pass on to you, but which we would seek to ensure is good value for money, and affordable.
 
Anything above that will be charged on an hourly basis at a rate of £60.00.

Please write in response to the email address above to confirm that you are happy to proceed on this basis, and to advise on convenient dates for us to set up an initial meeting. 

Yours sincerely

Ciaran Ward
Information Rights Officer

Guildford Borough Council
  Millmead House, Millmead, Guildford, Surrey GU2 4BB