Sign In

My Neighbourhood

Use your postcode to find local councillors, facilities, school catchment areas and more.

Find facilities in my area

Cardiff Council

LDR Looked After Children


​​​Our commitment to privacy​​​​

Your privacy is important to us and we want you to let us know if we are not protecting your privacy to the best of our ability. Please also let us know if you have any other comment or complaint about the way we use personal data. 

What does ‘personal data’ mean?​​​

Personal data includes basic details about you, including your name and address. It also includes a range of other data about your physical or mental health, or data about your involvement with health and social care services. 

We have made a number of changes to the way that data is shared between us as this page explains.

Who are we?​​​​​

We are the Cardiff and Vale University Health Board (“the NHS”) and Cardiff Council (“the Council”). We protect your personal data as individual organisations. We follow all the laws that are made to protect personal data. 

What are looked after children and what data about them needs to be shared?​​​​

Some children are unable to remain at home with their families. These children are often looked after in arrangements made by the local Council. They may live with foster parents or in a residential care home or other place where they can be looked after away from their family.

These children are referred to as Looked After Children (LAC). There is a wide range of laws and rules which councils must follow when working with LAC. The NHS must also follow many of those laws and rules when working with LAC. A number of these rules relate to sharing data between the Council and the NHS. 

By law, the Council has to tell the NHS that a child has become looked after, and the NHS has to report back with a Health Assessment of that child. All this must happen within 20 working days of a child coming into care. 

We will continue to share personal data while a child is in care to make sure they are provided with health and social care that meets their needs. We also use personal data to help us prepare them to leave care as adults. 

Some LAC come from families where abuse or neglect might have happened. There will be times when sensitive data has to be shared between the Council and the NHS about people other than the child. 

When we share data like this, the law expects us to protect your privacy. This means that we must have a set of arrangements in place that helps us keep the data safe, to make sure it is used correctly and to explain to you how all this will be done. We have written this document to explain these things. 

A Local Data Resource (LDR) has also been set up to help us pool data together from different sources. Some of the personal data related to LAC will also be added to the LDR. 

Our Obligation to Take Proper Care of Your Data​​​

The UK GDPR​​​​​​​​​​​External link opens in a new window​ and DPA​​​​​​​​​​Link opens in a new window are laws which explain how we must protect your privacy. We have to make sure we explain as well as we can what they mean and how we are applying them. 

DPR Requirement​ Our Approa​​ch
Act within the law

We will only use personal data for our lawful purposes.

To allow the general sharing of LAC data under UK GDPR​​​​​​​​​​​External link opens in a new window, we are using the provisions known as 'public task', Article 6 (1) (e)​​​​​​​​​​​External link opens in a new window which means we are carrying out our duties set out in law.  

To allow sharing of more sensitive data, Article 9 (2) (h)​​​​​​​​​​​External link opens in a new window of the UK GDPR tells us we can share personal data if it is needed to provide health care or social care to an individual or for the management of health or social care systems and services.

Act fairly & reasonably

We share personal data while a child is in care to make sure they are provided with health and social care that meets their needs.

We will also let you know if anything important changes in the way we look after personal data.

Act openly (Transparency)Please contact us if you have any further questions about how we handle personal data.
Keep data to a minimumWe will only share data that is permitted by the law. We will not share excessive data about individuals.
Keep data accurateWe have made arrangements to make sure we keep shared LAC data up to date.
Keep data only as long as needed Personal data about LAC will be kept for 75 years in line with relevant guidance.
Keep data securely

In order to ensure the integrity and confidentiality of personal data we have in place a series of rules about how we use and hold personal data.

This includes practical rules about:-

  • Emails and attachments
  • Electronic security of personal data.
  • Access controls to prevent unauthorised people accessing data.

All data is stored within the UK and is never held outside the UK. 


We have a strong commitment to data confidentiality and respect for privacy rights in the work we do.

We will review all our privacy arrangements on an annual basis.

What data is being shared?​​​​​

The data that is being shared is as follows:-
  • Personal data relating to individual LAC, such as name, gender and ethnicity
  • Data about where they live (their placement) while they are being looked after, 
  • Contact details about important people relating to the individual LAC, including relatives as well as health and social care professionals
  • Data about preparations for independence for a child and any health care and / or social care arrangements intended to support them to independence. 
  • Details about individual LAC mental, emotional and physical health, and impacts of these on child development. 
  • Details of anyone who is treating them e.g. optician, speech & language therapist, paediatrician.
  • Details of allergies, medications and vaccination history
  • Details of health surveillance and prevention measures e.g. dental care, advice about substance misuse
  • Additional data may be needed for some children, such as arrangements to protect a child or relevant data about the health of their parents
  • Ongoing changes to these data items for the purposes of review. 

When is data shared?​​​​

Data is shared when: 

  • A child comes into care (becomes LAC)
  • ​When a LAC changes placement 
  • When a LAC placement is due to be reviewed (usually every 6 months)
  • When a LAC is preparing to leave care (at age 16) 

Data about changes to key contact individuals (e.g. social worker) may be updated more frequently than the timeframes noted above. 

Who will see my data?​​​​​​​

Anyone who has access to your personal data will do so only when:-
  • They need to see that data to do their job
  • They must follow any relevant laws and rules of their profession which protect data from being seen by anyone who does not have the right to see it
  • They can lose their jobs and careers if they misuse the data

We will also use the data for management or administrative tasks which are allowed by GDPR. Data used in this way would not normally contain any personal data. 

How is data shared?​​​​

We share personal data in a number of ways because we use different data systems. Each method of sharing is fully secure, including encrypted secure connections between systems during data exchange. 

How will data be protected?​​​

Once shared, the data is then stored securely in our own electronic systems. The data does not leave the UK at any stage. 

What are my rights over the personal data you hold about me?​​​​

The GDPR gives a series of rights to citizens in regard to their personal data. These rights are slightly changed because our work with LAC is a ‘public task’. 
Your rights over this personal data have changed in the following ways:-

GDPR C​itizen ​Right Applies? Notes
The right to access data
YesPeople have a right to see personal data but we can only provide data to an individual entitled to see it. While we will certainly seek to maximise the amount of material we can share with you, this will be done within the relevant law.
The right to erasure NoThis right does not apply to data shared as a 'public task'. 
The right to correct inaccuraciesYes

Each request will be considered individually. The law allows us to refuse if it would be against the law or would harm the service.

Only factual mistakes can be corrected. Changes to professional opinions are only allowed if the opinions are based on inaccurate facts. 

The right to restrict processingYesEach request will be considered individually.  The law allows us to refuse if it would be against the law or would harm the service.
The right to object to processingYes

We do not use any automated decision making processes.

Each request will be considered individually. The law allows us to refuse if it would be against the law or would harm the service.

The right to data portability NoThis right does not apply to public task data. However, where exercising rights to access data, we can provide data to you in an electronic format.
The right to be informed about the regulatorYesSee below.

How do I ask a question about my rights over my data or complain about how my rights have been handled?​​

Please contact us if you wish to apply any of the rights set out above or if you wish to discuss any issues relating to personal data used to support our work with LAC. 
You may contact us using the following details:-

CAV​​​ Cardiff Council​​

Data Protection Officer
Cardiff and Vale University Health Board
Information Governance Department
Woodland  House
Maes-y-Coed Road
CF14 4TT

Data Protection Officer
County Hall
Room 357
Atlantic Wharf
Cardiff Bay
CF10 4UW

We will respond to your request within a month to explain what we intend to do.

How do I contact the regulator?​

If you remain unhappy with the way we have processed your personal data, you may also wish to contact the national regulator.
You can also find out more about your personal data rights by going to the Information Commissioner's Office (ICO) website​​​​​​​​​​​External link opens in a new window.​

For further independent advice about data protection, and your personal data rights, you can contact:- 
Information Commissioner's Office - Wales
2nd Floor
Churchill House
Churchill Way
CF10 2HH

Tel: 02920 678400   
Fax: 02920 678399 

© 2022 Cardiff Council