This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver our housing service to our residents, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- names and contact details
- addresses
- date of birth
- employment history
- family and relationships
- case history
- financial details
- identification documents
- nationality
- photographs or video recordings
- video and CCTV recordings of public areas
- video and CCTV recordings of private or staff only areas
We will also collect the following categories of special category information:
- medical information (including dietary requirements, allergies and health conditions)
- racial or ethnic origin
- religious or philosophical beliefs
- sex life information
Criminal conviction and offence history data may include:
- criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
- safeguarding checks
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Service
Breathing Spaces housing
Purpose
For the Breathing Spaces scheme, the council is working in conjunction with Wakefield council's breathing space service to help homeowners who are struggling with their mortgage repayments. Breathing space offers an interest-free secured loan that provides help to pay your mortgage. You will have to repay the loan at the end of three years.
Lawful basis
UK GDPR Article 6 (1) (c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6 (1) (e) – processing is necessary for the performance of a task in the public interest.
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (b) - processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.
Service
Home energy upgrades
Purpose
The housing service is a function of North Yorkshire Council within the community development directorate and its functions include the delivery of home energy upgrades for local residents.
Lawful basis
UK GDPR Article 6 (1)(e) – processing is necessary for the performance of a task carried out in the public interest.
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (g) – processing is necessary for reasons of substantial public interest with processing meeting schedule 1, part 2 of the data protection act 2018 as below:
- (16) support for individuals with a particular disability or medical condition
Service
Home improvements
Purpose
The council delivers home improvements/adaptations to individuals eligible for assistance using funding from the disabled facilities grant (DFG).
Lawful basis
UK GDPR Article 6 (1)(e) – processing is necessary for the performance of a task carried out in the public interest.
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (g) – processing is necessary for reasons of substantial public interest with processing meeting schedule 1, part 2 of the data protection act 2018 as below:
- (16) support for individuals with a particular disability or medical condition
Service
Housing accommodation management
Purpose
The housing service is responsible for the management of rental accommodation (including social housing) and the administration of lettings for current tenants across the district. This also includes the licensing of traveller pitches.
This service involves the allocation of council accommodation, including assessment of applications via the North Yorkshire home choice, sub-regional choice-based lettings system; the monitoring and recovery of rents due in relation to housing accommodation and garage accommodation, together with charges applied for supported housing.
A tenancy relations service is also provided in relation to tenancy related issues and breaches of accommodation. A repairs and maintenance service is also provided to all council tenants with an in-house repairs team providing the reactive repair service, supported by external contractors in relation to specialist roles for instance, Asbestos removal. In accordance with prevailing legislation, we provide Fire Safety Assessments which includes inspections of communal areas and actions undertaken where necessary.
Lawful basis
UK GDPR Article 6 (1) (b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
UK GDPR Article 6 (1) (c) – processing is necessary for compliance with a legal obligation to which the controller is subject.UK GDPR Article 6 (1) (e) – processing is necessary for the performance of a task in the public interest.
When processing criminal conviction data, processing meets schedule 1, part 2 of the data protection act 2018 as below:
- (10) Preventing or detecting unlawful acts
- (18) Safeguarding of children and individuals at risk
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (g) – processing is necessary for reasons of substantial public interest with processing meeting schedule 1, part 2 of the data protection act 2018 as below:
- (6) statutory and government purposes
- (16) support for individuals with a particular disability or medical condition
- (18) safeguarding of children and individuals at risk
Service
Housing need surveys
Purpose
North Yorkshire Council is responsible for assessing housing needs and planning housing developments to meet demand. These surveys allow us to gather information to help assess housing needs within the area.
Lawful basis
UK GDPR Article 6(1)(e) - Processing is necessary for the performance of a task carried out in the public interest.
Service
Housing options
Purpose
The council is responsible for the following functions:
- to prevent homelessness, to reduce the number of homeless presentations and identify alternative housing options for clients approaching the local authority as being made homeless
- to fulfil statutory responsibilities in relation to homelessness and to provide a comprehensive housing advice service
Lawful basis
UK GDPR Article 6 (1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6 (1) (e) processing is necessary for the performance of a task in the public interest.
When processing criminal conviction information, to satisfy Article 10 of the UK GDPR, processing will meet schedule 1 of the data protection act 2018 as below:
- (6) statutory and government purposes
- (10) preventing or detecting unlawful acts
- (18) safeguarding of children and individuals at risk
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (g) – processing is necessary for reasons of substantial public interest with processing meeting schedule 1, part 2 of the data protection act 2018 as below:
- (6) statutory and government purposes
- (16) support for individuals with a particular disability or medical condition
- (18) safeguarding of children and individuals at risk
Service
Lifeline services
Purpose
The lifeline service is a product provided and administered by the council which provides 24-hour local emergency support service. The call alarm (unit and wearable pendant) makes it easier to live independently in your own home and offers peace of mind that help is on hand when needed.
Lawful basis
UK GDPR Article 6 (1) (b) - processing is necessary for the performance of a contract to which the data subject is party.
UK GDPR Article 6 (1) (d)- processing is necessary in order to protect the vital interests of the data subject or of another natural person.
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (b) - processing is necessary for the purposes of the provision of health or social care with processing meeting schedule 1, part 1 of the data protection act 2018 as below:
- (2) Health or social care purposes
Service
Self build custom build register
Purpose
The self-build and custom housebuilding act 2015 places a duty on councils to keep a register of individuals and community groups locally, who want to acquire land for self-build homes. This enables the council to gather the self and custom build data to understand the demand in the Hambleton district and ensure that provision is made for plots to be approved in the right areas to meet the demand.
Lawful basis
UK GDPR Article 6 (1)(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
UK GDPR Article 6 (1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6 (1)(e) - processing is necessary for the performance of a task carried out in the public interest.
Service
Young peoples accommodation
Lawful basis
UK GDPR Article 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6 (1)(d) - processing is necessary in order to protect the vital interests of the data subject or of another natural person.
UK GDPR Article 6 (1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
When processing criminal conviction information, to satisfy article 10 of the UK GDPR, processing will meet schedule 1 of the data protection act 2018 as below:
- (6) Statutory and government purposes
- (10) Preventing or detecting unlawful acts
- (18) Safeguarding of children and individuals at risk
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (g) – processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (6) Statutory and government purposes
- (8) Equality of opportunity or treatment
- (10) Preventing or detecting unlawful acts
- (18) Safeguarding of children and individuals at risk
Service
Private Housing Standards
Purpose
The enforcement of housing standards and civil penalties.
Lawful basis
UK GDPR Article 6 (1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Housing standards enforcement is a statutory local authority function.
To enforce housing standards councils must:
- inspect properties
- identify offences
- issue improvement notices, prohibition orders, civil penalties
- gather evidence from landlords and tenants
- pursue proceedings through tribunals or courts
Processing personal data for enforcing Civil Penalties under the Housing and Planning Act 2016, Protection from Eviction Act 1977, Housing Act 1988, Housing Act 2004 and the Renters Rights Act 2025.
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (g) – processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (6) Statutory and government purposes
- (10) Preventing or detecting unlawful acts
- (18) Safeguarding of children and individuals at risk
The purpose is to assess vulnerability, risk, or habitability, support safeguarding concerns, identify risk of harm in poor housing conditions, liaise with support agencies when enforcement affects vulnerable tenants
Criminal conviction information will only be processed if it is provided as part of our investigations, or it is already in the public domain.
- (6) Statutory and government purposes
- (10) Preventing or detecting unlawful acts
- (18) Safeguarding of children and individuals at risk.
Service
Homes for Ukraine sponsorship scheme
Purpose
We will receive, from the Ministry of Housing, Communities and Local Government (MHCLG) details of North Yorkshire residents and organisations who have applied to become a sponsor through the Homes for Ukraine scheme and details of the individuals and/or families they intend to host. The data received will be used to conduct suitability checks and facilitate payments associated with the scheme.
Lawful basis
UK GDPR Article 6(1)(e) – the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- Immigration and Asylum Act 1999
- Nationality Immigration and Asylum Act 2002
DPA 2018, part 2, chapter 2, section 8 (d) - the exercise of a function of the crown, a minister of the crown or a government department.
Should special category data processing occur, the legal basis that we will use to process this data is:
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
For the processing of this special category data and of criminal offence data, the processing meets Schedule 1, Part 1 of the Data Protection Act 2018 as below:
- (6) Statutory etcetera and government purposes
- (18) Safeguarding of children and of individuals at risk
Service
Refugee resettlement
Lawful basis
The council and its resettlement partners are relying on their legal powers and official authority to process your personal data and your special category data.
The legislation, policies and guidance that relates to these services include, but is not limited to:
- The Homeless Reduction Act 2018
- Localism Act 2011
- Housing Grants, Construction and Regeneration Act 1996
- Regulatory Reform (housing assistance) (England and Wales) Order 2002
- The Housing Renewal Grants (England) Regulations 2009
- Housing Act 1985
- Regulatory Reform (Fire Safety) Order 2005
- Fire Safety (England) Regulations 2022
- Regulator of Social Housing – Consumer Standards
- Housing Act 1996
- Eviction Act 1977
- The Homelessness (Suitability of Accommodation) (England) Order 2012
- Local Government Act
- Housing Act 1988 as amended by the Homelessness Act 2002
- Protection from Eviction Act 1977
- The Children’s Act 1989
- Tenant Fees Act 2019
- Housing Health and Safety Rating System
- Self Build and Custom Housebuilding Act 2015
- Housing and Planning Act 2016
- Housing Act 1988
- Housing Act 2004
- Renters Rights Act 2025.
Who do we obtain your information from?
In the course of delivering the Housing service, we may obtain information from:
- other councils
- The Customer, Revenue and Benefits service within North Yorkshire Council
- the relevant social care teams within North Yorkshire Council
- Yorkshire Housing
- letting agents advertising and or managing properties on our behalf
- referrals from current housing providers for move on accommodation
- Department for Work and Pensions
- specialist support agencies
- Police
- Youth Justice
- medical professionals
- NHS (hospitals, urgent treatment centres or GPs)
- Secretary of State for Defence in relation to members of the regular armed forces
- landlords
- employers
- Department of Work and Pensions
- Citizens Advice Bureau (CAB)
- Fire service
- Home Office
- homelessness charities
- Job Centres in England
- HM Forces Service
- Young Offender Institutions
- specialist support organisations
- legal representatives such as solicitors
- home from hospital service – Carers resource
- care agencies
- North Yorkshire Clinical Commissioning Groups
- school admissions
- Ministry of Housing, Communities and Local Government (MHCLG)
Who do we share this information with?
We may share your information with:
- other councils
- management and delivery contractors and sub-contractors
- Department for Energy Security and Net Zero and any other relevant government departments
- landlords
- Department for Works and Pensions
- HM Revenues and Customs
- National Audit Office
- Cabinet Office
- Police
- contractors
- your chosen agent / surveyor and / or contractor / sub-contractors
- social services / occupational therapy
- housing associations / providers
- judicial agencies for instance, courts
- health authority
- Veritau, for example, in the prevention of fraud and auditing service provision
- North Yorkshire Fire and Rescue services
- Specialist Support Services
- Young Peoples Partnership
- Probation Service
- NHS
- Refuge and Domestic Violence services
- homelessness charities
- the Refugee Council
- Home Office UK
How long do we keep your information for?
Breathing Spaces
| Data held | Retention period |
|---|---|
| Personal information | 12 years. The retention period starts 1 month after full loan repayment |
Home energy
| Data held | Retention period |
|---|---|
| Application information | 10 years |
| Records of work completion | 10 years |
Home improvements
| Data held | Retention period |
|---|---|
| Records of work completion | 10 years |
| Successful application | 6 years after final repayment has been made |
| Unsuccessful applications | Retained for the remainder of the year in which it was made, plus 1 year (2 years maximum) |
Housing accommodation management
| Data held | Retention period |
|---|---|
| Tenancy information | Lifetime of tenancy and then a further 6 years |
| Financial records | Lifetime of tenancy and then archived on IT system indefinitely |
| Repairs information | Lifetime of tenancy, then archived indefinitely to record repairs and maintenance completed on the property |
| North Yorkshire Home Choice applications | Lifetime of application, held to allow re‑application using existing references. If no application is made within seven years, data is anonymised and documents are automatically removed |
Housing need surveys
| Data held | Retention period |
|---|---|
| Completed housing need survey | 3 years |
Housing options
| Data held | Retention period |
|---|---|
| Housing triage data | 6 years |
| Housing assessment data | 6 years |
| Affordable housing applications and bond/rent in advance applications | 6 years |
| MARAC and MAPPA minutes and agendas | 6 years |
| Lettings scheme data | 6 years |
| Scanned ID documents | 6 years |
| Data reports | 6 years |
Lifeline services
| Data held | Retention period |
|---|---|
| Individual support plans including contact information, support requirements, care assessment and financial information | Held for the life of the contract and then for 6 years upon termination of the contract |
Self build custom build register
| Data held | Retention period |
|---|---|
| Details held on the SBCB register | 5 years |
Young peoples accommodation
| Data held | Retention period |
|---|---|
| Residents property files | 6 years |
| Risk assessments | 6 years |
| Support files | 6 years |
| Client contact notes | 6 years |
Private housing standards
| Data held | Retention period |
|---|---|
| All information relating to the enforcement of housing standards and civil penalties | 6 years |
Homes for Ukraine sponsorship scheme
| Data held | Retention period |
|---|---|
| All personal information relating to sponsors and applicants | Your personal information will be securely deleted within two years after the Homes for Ukraine sponsorship scheme ends, unless the Ministry of Housing, Communities and Local Government and/or the Home Office decides it can be deleted earlier. |
Refugee resettlement
| Data held | Retention period |
|---|---|
| Personal data | 6 years following completion of your resettlement |
Other relevant transparency information
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.