Privacy notice for the Wales Safeguarding Repository.
Contents
About the Single Unified Safeguarding Review
The Welsh Government has led a project to create a Single Unified Safeguarding Review (SUSR) in Wales.
The SUSR will provide a unified process for Safeguarding Boards when undertaking:
- domestic homicide reviews
- adult practice reviews
- children practice reviews
- mental health homicide reviews
- offensive weapons homicide reviews
Wales Safeguarding Repository
Cardiff University has developed the Wales Safeguarding Repository (WSR) and continues to be engaged in its ongoing development, delivery and hosting together with the Welsh Government.
All completed SUSR reports will be retained in the WSR.
The findings from SUSR reports will be used to inform learning across Wales through the production of thematic reports.
Permitted users will be given access to the WSR to support safeguarding practice and learning for professionals, including:
- police officers
- social workers
- those working in health and social care
The WSR may also be used for academic research.
Personal data and safeguarding reports
SUSR reports will be prepared in a way that removes personal identifiers and/or uses pseudonymisation to reduce the likelihood that individuals can be identified from a report retained in the WSR.
Despite these safeguards, there is a possibility that individuals referred to in SUSR reports may still be identified by reasonably available means, such as internet searches. This may be more likely where the incident that triggered the review is widely known or has been reported in the media.
For this reason, SUSR reports are treated as if they contain personal data.
The personal data of the reviewers who prepare SUSR reports, and the personal data of individuals who access the WSR, will also be processed.
Data controller
Under UK data protection law, the Welsh Government will be the controller of the personal data processed by the WSR.
This privacy notice contains important information about the WSR, including:
- how and why personal data is collected
- how personal data is stored, used and shared
- your rights in relation to your personal data
Key terms
| Term | Description |
|---|---|
| Permitted Users | Individuals who have registered with the SUSR Co-ordination Hub, have been provided with a username and password, and have agreed to the Terms of Use for the WSR. |
| SUSR Co-ordination Hub | The body providing a central co-ordination function for SUSRs, issuing usernames and passwords to access the WSR, and arranging activities such as training and the sharing of information and updates. |
| SUSR Reports | Reports produced through the SUSR process in relation to domestic homicide reviews, adult practice reviews, children practice reviews and mental health homicide reviews. |
The WSR and the processing of personal data
Personal data contained in SUSR reports
SUSR reports will include information about the incident that is the subject of the review, together with geographical information, dates and other information individuals have given which relates to the incident or its background.
This information, together with other relevant information used by someone else (for example, information obtained through an internet search), could mean that individuals can be identified.
The SUSR report will be provided to the SUSR Co-ordination Hub by the relevant Safeguarding Board.
The Safeguarding Board will be responsible for the accuracy of the information included in the SUSR report.
Individuals whose information is contained within SUSR reports
How Welsh Government uses your personal data
Under UK data protection law, the Welsh Government can only use your personal data if it has a lawful basis for doing so.
The processing involved in the operation of the WSR is as follows:
- the SUSR report will be uploaded to the WSR together with corresponding metadata, including the title, year of publication, year of incident, report type and relevant collections
- the SUSR report will be annotated with key themes, which are added to the metadata through an automatic process that does not rely on user input
- the SUSR report will then be stored on the file server and a reference to where the file is stored will be added to the metadata
- permitted users will be able to access the WSR through a web-based portal
- permitted users will be able to use the search function of the WSR to search data stored in the WSR database
- the search function will reference the relevant SUSR report and provide a file reference which can be used to download the file or upload the SUSR report into the document viewer
Lawful basis for processing
The Welsh Government will rely on the fact that processing is necessary to perform a task in the public interest and the exercise of official authority as its lawful basis for processing any personal data contained in SUSR reports.
This lawful basis covers public functions and powers that are set out in law.
The Welsh Government will rely on section 60 of the Government of Wales Act 2006, which allows the Welsh Government to do anything considered appropriate to promote the social well-being of Wales.
Taking responsibility for operating the WSR is considered to promote the social well-being of Wales.
Special category data
Special category data is personal data that needs more protection because it is sensitive and includes:
- personal data revealing racial or ethnic origin
- personal data revealing political opinions
- personal data revealing religious or philosophical beliefs
- personal data revealing trade union membership
- genetic data
- biometric data (where used for identification purposes)
- data concerning health
- data concerning a person's sex life
- data concerning a person's sexual orientation
In order to lawfully process special category data, a condition for processing that data must be identified as well as a lawful basis.
The Welsh Government's condition for processing special category data contained in SUSR reports is that processing is necessary for reasons of substantial public interest. Those interests are the Welsh Government's statutory obligation to promote the social well-being of Wales.
Criminal offence data
Personal data relating to criminal convictions and offences is also given additional protection.
Criminal offence data covers a wide range of information, including:
- criminal activity
- allegations
- investigations
- proceedings
It may also include information relating to unproven allegations, conditions or restrictions placed on an individual as part of the criminal justice process, or civil measures which may lead to a criminal penalty if not adhered to.
In order to lawfully process criminal offence data, the Welsh Government must identify a condition for processing criminal offence data as well as a lawful basis.
The Welsh Government's condition for processing criminal offence data contained in SUSR reports is that processing is necessary for reasons of substantial public interest. Those interests are the Welsh Government's statutory obligation to promote the social well-being of Wales.
Sharing personal data
The SUSR reports will be provided to Cardiff University to be processed and uploaded to the WSR.
The Welsh Government has entered into a Data Processing Agreement with Cardiff University which requires Cardiff University to ensure the security of information uploaded to the WSR.
Cardiff University is not permitted to use personal data for its own purposes and is only permitted to process personal data for the purposes specified in this privacy notice and in accordance with Welsh Government instructions.
Permitted users will be given access to the WSR.
There may be occasions where, due to additional information that a permitted user has or can access, individuals may be identifiable from information contained in a SUSR report.
Permitted users are bound by the Terms of Use for the WSR, which prevent them from:
- using material and data in the WSR for any purpose other than improving safeguarding practice and learning for professionals such as police officers, social workers and those working in health and social care, and/or academic research
- seeking to reverse engineer the identity of persons referred to in the WSR
How long your personal information will be kept
SUSR Reports will be kept in the WSR indefinitely for the purposes of improving safeguarding practice and learning of professionals such as police officers, social workers and those working in health and social care and/or academic research.
Where your personal information is held
Generally, your personal information is stored on Cardiff University’s secure, cloud-based systems (Microsoft).
These systems are located within the UK or in countries and territories considered to have adequate privacy and information security arrangements, such as the European Economic Area (EEA).
There may be occasions when information needs to be stored outside these locations. Where this happens, transfer risk assessments will be undertaken where required to ensure appropriate safeguards are in place to protect your privacy rights.
This may include imposing contractual obligations on recipients of personal information where no other relevant safeguards exist. Technical measures, such as encryption, will also be considered.
Access to personal data
The Welsh Government has ensured that Cardiff University is under an obligation to implement appropriate security measures to prevent personal data from being accidentally lost, used or accessed unlawfully.
Access to personal information is limited to permitted users.
Those processing personal information will do so only in an authorised manner, in accordance with the Terms of Use for the WSR, and are subject to a duty of confidentiality.
Data security breaches
Procedures are in place to deal with any suspected data security breach.
The Welsh Government will notify you and any applicable regulator of a suspected data security breach where it is legally required to do so.
Permitted users
Personal data collected
To provide you with a username and password to access the WSR, and to monitor your use of the WSR, the following personal data will be collected and processed by the SUSR Co-ordination Hub and the WSR:
- name
- email address
- address of the organisation you work for
- usage data (for example, when the WSR is accessed and the type of data accessed)
How Welsh Government uses your personal data
The Welsh Government will only use your personal data for the purposes for which it was collected.
This includes:
- registering you as a permitted user
- managing your registration
- tracking your use of the WSR to ensure compliance with the Terms of Use
- improving the WSR
Lawful basis for processing
Under UK data protection law, the Welsh Government can only use your personal data where there is a lawful basis for doing so.
For registering and managing permitted users, the Welsh Government relies on the fact that processing is necessary to perform a task in the public interest and the exercise of official authority.
This lawful basis covers public functions and powers that are set out in law.
The Welsh Government relies on section 60 of the Government of Wales Act 2006, which allows the Welsh Government to do anything considered appropriate to promote the social well-being of Wales.
Taking responsibility for operating the WSR is considered to promote the social well-being of Wales.
For monitoring use of the WSR and improving the WSR, the Welsh Government relies on the fact that it is performing a task in the public interest to:
- ensure data contained within the WSR is used appropriately
- maintain the security of data held within the WSR
- improve the operation and functionality of the WSR
Sharing your personal data
The Welsh Government will not share your personal data with any third party other than Cardiff University, as set out in the data sharing section of this privacy notice.
How long your personal data will be kept
Your personal data will be retained for as long as you remain registered as a permitted user of the WSR.
Where your personal information is held
Your personal data will be held in the UK by the Welsh Government.
It will not be transferred by the Welsh Government outside the UK or European Economic Area (EEA).
The Welsh Government has appropriate security measures in place to prevent personal data from being accidentally lost, used or accessed unlawfully.
Access to personal information is limited to those who have a genuine business need to access it.
Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
The Welsh Government also has procedures in place to deal with any suspected data security breach.
Where legally required, the Welsh Government will notify you and any applicable regulator of a suspected data security breach.
Your rights
Under data protection law, you have a number of rights which you can exercise free of charge.
Some of these rights only apply in certain circumstances and not all of them will be relevant in relation to our use of your personal data.
| Right | Description |
|---|---|
| Access | The right to be provided with a copy of your personal data (the right of access). |
| Rectification | The right to require any mistakes in your personal data to be corrected. |
| To be forgotten | The right, in certain circumstances, to require that your personal data is deleted. |
| Restriction of processing | The right, in certain circumstances, to require use of your personal data to be restricted (for example, if you contest the accuracy of the data). |
| Data portability | The right, in certain circumstances, to receive your personal data in a structured, commonly used and machine-readable format and/or transmit that data to a third party. |
| To object | The right to object to your personal data being processed for direct marketing (including profiling) and the right, in certain circumstances, to object to the continued processing of your personal data on the basis of legitimate interests. |
| Not to be subject to automated individual decision making | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. |
For further information on each of these rights, including the circumstances in which they apply, please contact us or see the guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.
Exercising your rights
If you would like to exercise any of your rights, the easiest way to tell us is by emailing:
You can also call or write to our Data Protection Officers (see How to contact us below).
Please note that the Welsh Government may ask you to:
- provide enough information to identify you
- provide proof of your identity and address (for example, a copy of your driving licence or passport)
- tell us which right you want to exercise and the information to which your request relates
Making a complaint
The Welsh Government is committed to handling your personal data safely, securely and only for as long as we need.
If you have any concerns about how we use your personal data, we encourage you to raise them with the relevant team in the first instance.
You can also contact the Data Protection Officer by emailing DataProtectionOfficer@gov.wales or writing to the DPO at:
Welsh Government
Cathays Park
Cardiff
CF10 3NQ
If you wish to make a formal complaint about how the Welsh Government has processed your personal data, you can complain about Welsh Government
We will acknowledge your complaint and respond within an appropriate timescale, in line with data protection legislation and our complaints process.
Changes to this privacy notice
This privacy notice was first published on 1 September 2024.
The Welsh Government will make updated versions of this privacy notice available on the WSR website.
How to contact us
Please contact us or our Data Protection Officer by post, email or telephone if you have any questions about this privacy notice or the personal data the Welsh Government holds about you.
Data Protection Officer
Helen Morris
Welsh Government
Cathays Park
Cardiff
CF10 3NQ