GDPR and personal data at a parish council

Most data protection guidance is written for organisations much larger than a parish or town council, and the part it gets wrong is the point on which everything else turns: whether the council counts as a public authority. A parish or town council is a public authority for freedom of information, but not for the UK GDPR, and that difference is worth a material amount of both money and effort.

England; general guidance rather than legal advice.

"Public authority" means three different things to a parish council

Three tests, three different answers, and no single one of them is "the" answer. The second is the one almost everyone gets wrong.

Why a parish council is not a public authority under the UK GDPR

The UK GDPR does not define "public authority" itself. The Data Protection Act 2018 does so, and it is exhaustive:

"For the purposes of the UK GDPR, the following (and only the following) are 'public authorities' and 'public bodies' - (a) a public authority as defined by the Freedom of Information Act 2000 ..."

• DPA 2018, s.7(1)

That would sweep a parish or town council in, because it is a FOIA public authority. But the next subsection takes it straight back out:

"The references in subsection (1)(a) and (b) to public authorities and Scottish public authorities as defined by the Freedom of Information Act 2000 ... do not include any of the following that fall within those definitions - (a) a parish council in England; (b) a community council in Wales; ... (d) a parish meeting constituted under section 13 of the Local Government Act 1972 ..."

• DPA 2018, s.7(3)

Parish councils, community councils, parish meetings and charter trustees are named individually. This is not an oversight or a concession anyone has to argue for - it is on the face of the Act.

A parish or town council is still a controller, with every ordinary duty that follows. What it is not is a public authority for the two provisions below.

What follows: no mandatory data protection officer

The duty to appoint a DPO is triggered by three things:

"The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts and tribunals acting in their judicial capacity; (b) the core activities ... require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities ... consist of processing on a large scale of special categories of data ..."

• UK GDPR, Article 37(1)

Case (a) is the one that catches district and county councils. It does not catch a parish or town council, because s.7(3) excludes it from the definition of a public authority for UK GDPR purposes. Cases (b) and (c) both turn on processing "on a large scale" as a core activity, which is not a description of a parish council.

So there is no statutory duty on a parish council in England to appoint a DPO.

It is worth knowing exactly how the ICO stands on this, because clerks are often told otherwise. The ICO's own guidance on data protection officers does not mention parish councils at all. What it does is point to the provision above: "Section 7 of the Data Protection Act 2018 defines what a 'public authority' and a 'public body' are for the purposes of the UK GDPR." That is the section which excludes a parish council. So the ICO has not published a statement on the point either way - it defers to the definition, and the definition leaves the parish council out. The sector's guidance and the assurances given when the 2018 Act went through Parliament both read the same way.

One caveat that comes with that freedom, and the ICO does press it: not needing a DPO is not the same as not needing anyone. A parish or town council still has to have enough people and enough resource to meet its obligations as a controller.

A council may appoint a DPO voluntarily, and many do. Where it does, the protections and duties in Articles 38 and 39 apply to that appointment - a voluntary DPO is not a lighter arrangement that happens to share the name. Where what is actually wanted is simply someone to keep an eye on data protection, it is better to give them a job title that is not "Data Protection Officer".

What follows: legitimate interests is open to the council

This is the more valuable consequence, and the less well known.

Article 6(1) lists the lawful bases, and then closes with a restriction:

"[Points (ea) and (f)] of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks."

• UK GDPR, Article 6(1)

Point (f) is legitimate interests. For a district council it is simply unavailable for anything done in performance of its tasks - which is why principal-authority guidance recommends public task under Article 6(1)(e) for almost everything. That restriction does not reach a parish or town council.

A parish council therefore has the full range of lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. In practice:

• Public task, Article 6(1)(e), remains the natural basis for anything the council does because a statute says so - publishing notices and minutes, running the burial ground, responding to planning consultations. Note that Article 6(3) requires the basis for a public-task purpose to be laid down in domestic law, so the council should be able to point to the provision.
• Legitimate interests, Article 6(1)(f), is genuinely available for the things no statute compels - a newsletter mailing list, CCTV on the pavilion, photographs at a community event, chasing an allotment debt. It is not an unconditional basis: the council still has to identify the interest, show the processing is necessary for it, and balance it against the individual's rights.
• Recognised legitimate interests, Article 6(1)(ea), is new. Annex 1 to the UK GDPR was inserted on 5 February 2026 by the Data (Use and Access) Act 2025, and it lists purposes where the balancing exercise is taken as already done: disclosing data to another body that needs it for its own public-task processing, emergencies, crime, safeguarding vulnerable individuals, and national or public security. The first of those covers a common parish situation - the district council or the police asks the parish council for something and it has to decide whether to hand it over.

If a council's privacy notice says it relies on public task for everything because it is a public authority, the notice was probably written from principal-authority guidance and is worth revisiting.

Special category data needs two things, not one

Article 9(1) prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health, sex life and sexual orientation - unless a condition in Article 9(2) applies.

The difficulty is that an Article 9 condition is not a substitute for a lawful basis. As it now stands, Article 9(2) is engaged only where "the processing is based on Article 6(1) and one of the following applies". Both are needed: a lawful basis under Article 6, and a condition under Article 9 (with, for most conditions, a further condition in Schedule 1 to the DPA 2018).

For a parish council this comes up mostly in employment - sickness absence, occupational health, adjustments for a disabled employee - and occasionally in a planning or grant matter where someone volunteers information about their health. Treat that material as a separate category: not on the agenda in substance, not in the open minute, and not circulated more widely than it needs to be. Our guide to exempt business and confidential items covers the meeting mechanics.

Personal data in agendas, minutes and papers

This is where a parish council's data protection risk actually arises, and it is covered in detail elsewhere on this site rather than repeated here:

• what to record and what to leave out - how to write parish council minutes and the minutes template;
• who is entitled to see minutes, and what to redact before publishing - who can see parish council minutes;
• how to take business in private properly - exempt business and confidential items.

The one point worth making here is the framing. Publishing minutes is processing, and it needs a lawful basis like anything else. For the statutory minute book and the notices a council is required to publish, that basis is public task. For everything a council chooses to publish - photographs, a newsletter, names of people who spoke at public participation - it is not, and the council should be able to say what it is.

Subject access is not a freedom of information request

Both arrive as "please send me the information you hold", and clerks routinely handle them under the wrong regime.

FOIA settles it in one line:

"Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject."

• FOIA 2000, s.40(1)

So a request for someone's own personal data is absolutely exempt from FOIA, precisely so that it is dealt with as a subject access request under the UK GDPR instead. It falls under a different regime, with a different time limit, different exemptions, and no fee in the ordinary case.

Where the request is for information about someone else, s.40(2) is the relevant exemption and it is the one that drives redaction of published minutes. That is dealt with in who can see parish council minutes.

A practical consequence: a resident who asks "what do you hold about me and my planning objection?" has made a subject access request even if they have written the words "Freedom of Information" at the top. Answer it as one.

The ICO fee: a public authority after all

The fee regulations use their own definition, and it is the FOIA one - so here a parish or town council is a public authority. What that changes is how its tier is worked out:

• Ordinarily a controller's tier depends on turnover or staff numbers.
• But regulation 3(3) of the Data Protection (Charges and Information) Regulations 2018 provides that the turnover-based thresholds "are to be disregarded in relation to a public authority".

So a parish council's tier is set by staff numbers alone. A council with ten or fewer members of staff sits in the lowest tier however large its precept is - which for a large town council with a small establishment is a meaningful difference. There is a discount for paying by direct debit. Check the current amounts with the ICO rather than relying on a figure quoted anywhere else, including here.

What this guide does not cover

Deliberately, because each is a subject in itself and the ICO is the better source: data subjects' rights and how to answer a subject access request in practice; retention schedules; data sharing agreements; international transfers; the breach reporting duty and its 72-hour clock; and the position of individual councillors, who may be separate controllers when acting as elected representatives rather than as the council.

The ICO has two short fact sheets written specifically for parish councils, both worth ten minutes: the use of personal email addresses and devices and data sharing in local councils - six steps to take. Councillors using personal email for council business is the single most common way a small council comes to grief, and neither of those topics is covered above.

Three things to take from this page: a parish or town council has no mandatory DPO; legitimate interests is open to it in a way it is not open to a district council; and a request for someone's own data is never an FOI request.

Last reviewed 30 September 2026. General guidance for councils in England, not legal advice.