Lancashire County Council Fostering Service

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Reasons for processing your personal data

The fostering services function within Lancashire County Council is responsible for the recruitment, assessment, approval, training, and ongoing support of foster carers who provide care for children and young people who are unable to live with their birth families.

This function operates under statutory duties set out in the Children Act 1989, the Fostering Services (England) Regulations 2011, and associated guidance and standards.

Key responsibilities include:

Recruitment and Assessment: Identifying individuals and families suitable to become foster carers, conducting thorough assessments, and ensuring they meet legal and regulatory requirements.
Placement and Matching: Arranging appropriate foster placements that meet the individual needs of children and young people, considering factors such as ethnicity, religion, language, and disability.
Support and Supervision: Providing foster carers with training, supervision, financial support, and access to resources to ensure high-quality care is maintained.
Safeguarding and Welfare: Promoting the safety, health, and well-being of children in foster care, including monitoring placements, managing risks, and responding to concerns or allegations.
Care Planning and Review: Working with other professionals to develop and review care plans for looked-after children, ensuring their voices are heard and their rights upheld.
Compliance and Quality Assurance: Ensuring the fostering service complies with legal obligations, national minimum standards, and internal policies, including maintaining a Statement of Purpose and conducting regular service reviews.

Personal data is processed as part of these activities to fulfil legal obligations, safeguard children, and deliver effective fostering services. This includes information about foster carers, children and young people, and relevant family members or professionals involved in the care process

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:

(c) Legal Obligation: the processing is necessary for us to comply with the law. We will cite the applicable legislation if we need to rely on this basis for processing.

Processing is necessary for the council to comply with legal obligations under legislation such as the Children Act 1989, the Fostering Services (England) Regulations 2011, and other statutory frameworks governing the care and protection of children.

(e) Public Task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We will cite the applicable task/function and its' basis in law if we wish to rely on this basis for processing.

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the council. This includes duties related to safeguarding children, assessing and approving foster carers, and managing placements.

Legal basis for processing special categories of personal data

The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR is:

(g) Processing is necessary for reasons of substantial public interest.

Processing is necessary for reasons of substantial public interest, on the basis of UK law. This is supported by Schedule 1 of the Data Protection Act 2018, which includes conditions such as safeguarding children and individuals at risk.

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

Legal basis for processing criminal offence data

Our service will process criminal offence data where we have a legitimate requirement to do so. Where we process such data, we will rely on the following legal basis to do so:

The council relies on the following legal bases:

Schedule 1, Part 2, Paragraph 6 of the Data Protection Act 2018 – Statutory and Government Purposes
Processing is necessary for the exercise of a function conferred by an enactment or rule of law, including statutory duties under the Children Act 1989 and the Fostering Services (England) Regulations 2011.
Schedule 1, Part 3 – Safeguarding of Children and Individuals at Risk
Processing is necessary to protect children and vulnerable individuals from neglect or physical, mental, or emotional harm.

Information we process about you

To deliver fostering services, the council processes a range of personal data relating to prospective and approved foster carers, children and young people in care, birth families, and professionals involved in the care process. The categories of data include:

General Personal Data

Full name
Date of birth
Gender
Contact details (address, phone number, email)
Language and communication preferences
Employment history
Education and qualifications
Family network and relationship information
Financial information (e.g. fostering allowances, income details)
Records of contact and correspondence with the council

Special Category Data

Ethnicity and cultural background
Religious or philosophical beliefs
Health and medical information (including physical and mental health)
Disability status
Sexual orientation (where relevant to care planning or safeguarding)

Criminal Offence Data

Criminal convictions and cautions
Outcomes of Disclosure and Barring Service (DBS) checks
Allegations or safeguarding concerns

Other Relevant Data

References (personal and employment)
Information from previous fostering agencies or local authorities
Information from schools, health professionals, and other agencies
Assessment and approval documentation for fostering suitability
Placement matching information
Records of training, supervision, and support provided

This data is collected directly from individuals, as well as from third parties such as other local authorities, health and education providers, previous employers, and regulatory bodies.

Recipients of the personal data that we process about you

To deliver fostering services effectively and meet legal obligations, the council may share personal data with a range of authorised recipients. These include:

Internal Council Departments

Children’s social care teams
Legal services
Finance teams (for fostering payments)
Education and health liaison officers

External Organisations and Partners

Other local authorities – for placement coordination, safeguarding, or continuity of care
Fostering agencies – including voluntary and independent fostering providers
Health services – such as GPs, mental health professionals, and NHS trusts
Education providers – schools, colleges, and educational psychologists
Police and safeguarding partners – for child protection and criminal checks
Disclosure and Barring Service (DBS) – for criminal record checks
Judiciary and legal representatives – in relation to care proceedings or legal assessments
Regulatory bodies – such as Ofsted, during inspections or audits
Previous employers and referees – for suitability assessments
National agencies – involved in foster placement matching or safeguarding coordination

Data Processors

Third-party organisations contracted by the council to support the fostering service (e.g. IT service providers, training providers, or placement matching platforms)

All data sharing is conducted in accordance with UK GDPR and the Data Protection Act 2018, ensuring that only the minimum necessary information is shared, and that appropriate safeguards are in place.

Any transfers to another country

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type	Description	Security	Retention period
Foster Carer Application Records	Includes application forms, assessment reports, references, and approval decisions	Stored securely in restricted-access case management systems	Retained for 10 years from the date fostering ceases For those not approved - Date of last contact with foster carers +3 years Prospective Foster Carers - Enquiry Only (Withdrawal of application prior to approval) – 3 years from date of closure
Child Placement Records	Information about children placed with foster carers, including care plans and reviews	Encrypted and access-controlled systems; limited to authorised personnel	Retained for 75 years from the child’s date of birth or: 15 From date of death if child dies before reaching age 18 (whichever is earlier)
DBS and Criminal Records Checks	Disclosure and Barring Service results and related suitability assessments	Stored securely with restricted access; not shared beyond safeguarding teams	Retained for up to 6 months after the decision is made
Health and Medical Information	Health assessments of foster carers and children, including mental health data	Stored securely with additional safeguards for special category data	Retained for as long as necessary for care and legal purposes If related to mental health (Records of those Children who have been detained under Section 2 or 3 of the Mental Health Act 1983): 20 years if no further treatment is received or: 8 years following the death of the patient.
Training and Supervision Records	Records of foster carer training, support sessions, and supervision notes	Stored in secure digital systems with audit trails	Retained for 10 years from the date fostering ceases
Financial Records	Payments to foster carers, allowances, and expenses	Stored in financial systems with encryption and access controls	Retained for 6 years from the end of the financial year in line with financial regulations
Complaints and Allegations Records	Investigations into complaints or safeguarding concerns	Stored securely with restricted access and documented handling procedures	Retained for 75 years or longer if required by law
Correspondence and Contact Logs	Emails, letters, and notes of meetings or phone calls	Stored in secure case management systems	Retained for 10 years from the date fostering ceases

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).