Disclosure Log
Data protection services (FOI/5741)
Message from Nottinghamshire County Council - 25 April 2025
Dear *****
Freedom of Information Request – Ref: FOI/00005741
Thank you for your email of 23 April 2025 where you requested information about our data protection services.
The information you requested is:
Under the Freedom of Information Act 2000, please provide the following information about your procurement of any
(i) external Data Protection Officer (DPO),
(ii) Data protection GDPR compliance services for the period FY2022-23 to FY2024-25:
1. Current DPO arrangements
1.1 Is the organisation’s DPO and other staff that work on data protection
compliance:
(a) An internal employee
(b) A DPO provided by an external service provider
(c) Hybrid (internal staff with external service provider support)
The DPO and other staff in the Information Governance team are internal employees. There is also an agency worker engaged on a short-term basis.
1.2 Where services are provided by external providers, please share the following information:
(a) The Company name(s)
(b) Annual spend by your organisation (FY2022/2023 through to
FY2024/2025)
(c) The highest day rate paid
(d) Contract dates (start/end/renewal terms)
(e) A brief description of the project or services provided (for instance, project title or internal reference)
(f) Services covered (e.g., audits, breach management, SAR management, delivery of DPIAs)
- Please indicate what deliverables were produced
- Procurement method (e.g., open competition, framework agreement, direct
award) and name of the procurement framework, if applicable.
Not applicable. Nottinghamshire County Council has no services related to the DPO and data protection compliance that are delivered by external providers.
2. Consultancy Spend
2.1 What is the organisation’s, total annual expenditure on data protection/GDPR consultancy services
£0.
2.2 For SoW/projects which have a spend of more than £5k), please share the following information:
- Supplier company name
- The scope of the Project (e.g., "ICO investigation support", DPIA support, Internal Audit recommendation support)
- Spend
- Procurement method
Not applicable.
3. Data Protection Compliance staffing
3.1 The Number of in-house data protection staff in the organisation
(FTE)
There are 6 FTE staff in the Information Governance team.
3.2 Are there any vacant roles (Yes/No)
Yes.
3.3 Where there any ICO investigations, audits, or enforcement actions for the period from FY2022/2023 to FY 2024/2025
Yes.
4. Future Plans
4.1 Is your organisation planning to put out to tender for any DPO/GDPR services in the current financial year
No.
4.2 If yes please provide the following:
Expected timeline
Budget range
Key service requirements
Procurement method
Not applicable.
Most of the information that we provide in response to freedom of information requests will be subject to copyright protection. In most cases the copyright will be owned by Nottinghamshire County Council. The copyright in other information may be owned by another person or organisation, and this will be indicated on the information itself.
You are free to use any information supplied to you for non-commercial research or private study purposes. The information may also be used for any other purpose allowed by a limitation or exception in copyright law, such as news reporting. However, any other type of re-use, for example by publishing the information in analogue form, including on the internet, will require permission of the copyright owner.
For information where the copyright is owned by Nottinghamshire County Council details of the conditions on re-use can be found on our website at https://www.nottinghamshire.gov.uk/global-content/copyright.
Your privacy: we use your personal information such as name and address so that we can comply with our legal obligations to respond to FOI requests. For further details about the use of information about you, please see the information handling privacy notice on our website at https://www.nottinghamshire.gov.uk/media/4323566/informationgovernanceandinformationrightsprivacynotice.pdf.
If you are dissatisfied with the handling of your request, you have the right to ask for an internal review. Internal review requests should be submitted within 40 working days of the date of receipt of the response to your original request and should be addressed to: Complaints and Information – Team Manager, Nottinghamshire County Council, County Hall, Loughborough Road, West Bridgford, NOTTINGHAM, NG2 7QP or [email protected].
Please remember to quote the reference number above in any future communications.
If you are not content with the outcome of the internal review, you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, WILMSLOW, SK9 5AF or https://ico.org.uk/make-a-complaint/foi-and-eir-complaints/.
Yours sincerely
Colin Sawers (He/Him)
Information Case Officer | Customers, Complaints and Information
Chief Executive"s Department | Nottinghamshire County Council
County Hall | Loughborough Road | West Bridgford | NOTTINGHAM | NG2 7QP
Tel: (0115) 977 3714