Our roles under UK GDPR
Under the UK General Data Protection Regulation and the Data Protection Act 2018, your council is the Data Controller — you decide what data is collected and why. Paper Monkey Limited, the company behind CouncilPapers, acts as your Data Processor — we process data only on your instructions, to provide the services you've subscribed to.
This means we never use your council's data for our own purposes, we never sell it, and we act only within the boundaries you set.
What we commit to
A summary of our key obligations as your data processor.
🇬🇧 Hosted in the UK
All personal data processed through CouncilPapers is stored on servers located within the United Kingdom. We do not transfer your data outside the UK without your prior written consent.
🔒 Security measures
We implement appropriate technical and organisational security measures, including encryption in transit and at rest, role-based access controls, regular backups, and staff training. We can provide further detail of these measures on request.
👥 Sub-processors
We use a small number of carefully selected sub-processors — for hosting and transactional email — who are contractually bound to the same data protection standards. We can provide the current list of our sub-processors on request, and we will give you advance notice of any changes.
📅 Data retention
We hold your data for the duration of your subscription. When your subscription ends, we will return or securely delete all personal data within 30 days at your election. You can also request deletion of specific records at any time during the subscription.
📌 Breach notification
In the event of a personal data breach, we will notify your council without undue delay, and in most cases within 48 hours with full details of what happened, what data was affected, and the steps taken to address it — giving you everything you need to meet your ICO reporting obligations.
👤 Data subject rights
If a member of the public or a councillor exercises their rights under UK GDPR — such as a request for access or erasure — we will promptly notify you and provide the technical assistance you need to respond within statutory timeframes.
What personal data we process
We only process data that you provide through the CouncilPapers platform in the course of your normal meeting administration. This typically includes:
| Category | Examples |
|---|---|
| Councillor and staff details | Names, email addresses, roles, committee memberships |
| Members of the public | Names or addresses referenced in agenda or minute items |
| Agenda and minute content | Any personal data contained within documents uploaded or created in the platform |
| Planning and correspondence | Names of applicants or objectors included in planning agenda items |
As Data Controller, your council is responsible for ensuring that any personal data entered into CouncilPapers has a lawful basis for processing under UK GDPR.
Need more help? Contact us
Built by a councillor, for council clerks
Save hours of paperwork per meeting
Write agendas and minutes once and publish them straight to your council's website. Councillors get them in the Councillor App. No re-typing, no uploading files one by one. See the features
Records you can stand behind
Agendas and minutes are version-tracked and searchable, with public and confidential versions kept apart. That helps you stay audit-ready, though the council remains responsible for its own compliance. Overview for clerks
Open, accessible council papers
Published papers are designed to meet WCAG 2.2 AA, the standard the Public Sector Bodies Accessibility Regulations 2018 require. Your council's data is stored in the UK (AWS London). Accessibility statement
Councillors get agendas, papers and past minutes in one secure app, not a pile of email attachments. Overview for councillors
Read our story