Employee- Privacy notice
Published: 30 March 2026
Review date: 30 March 2028
Policy owner: Data Protection Officer
This privacy notice has been written to inform individuals about how and why the Policing, Fire and Crime Directorate (PFC), part of the York and North Yorkshire Combined Authority (YNYCA), processes employee personal data.
This privacy notice should be read in conjunction with the General Privacy Notice.
On this page
Who are we?
The Mayor of York and North Yorkshire is a data controller as defined by the UK GDPR. This means that we determine the purposes for which your personal data is processed and the manner of the processing. We will only collect and use your personal data in ways that are compliant with data protection legislation.
The role of the DPO is to monitor our compliance with the UK GDPR and the Data Protection Act 2018 and advise on data protection issues. If you would like to discuss this privacy notice or our use of your data, please contact:
Head of Compliance/DPO
York and North Yorkshire
Combined Authority County Hall
Northallerton
DL7 8AL
What personal information do we collect?
The personal data we collect about you could include:
- Name, Address and any other contact details such as email address and telephone numbers
- Health and Disability
- Annual leave and sick leave details
- Performance details
- Emergency contact details
- Banking information
- National Insurance and tax information
- Pension details
Why do we collect your personal information?
We process your information for the purposes outlined below:
- To maintain employee records throughout your employment (eg training records).
- To be able to contact you throughout your employment.
- To record and monitor leave and absence taken during your employment.
- To monitor your work performance and conduct (eg disciplinary procedures).
- To manage payroll.
- To meet our health and safety obligations (eg Occupational health to assess working capacity).
- To process a termination of your contract where necessary.
- To contact you following termination of your contract, if expressly required (eg to obtain your consent to share reference details with another organisation if a request is made in your name; to resolve any ongoing investigations related to your employment; to rectify any salary overpayments which may have occurred during your employment with the organisation).
- If you are employed as a driver your licence will need to be routinely checked to ensure legal obligations in relation to fleet management are met.
- To protect and maintain the health, safety and welfare of employees and others in the workplace.
- To monitor and inform our policies on equality and diversity
Who do we obtain your information from?
We normally receive this information directly from you. However, we may also receive some information from the following third parties:
- HMRC
- Department of Work and Pension, if applicable
- Pension Funds
- Any salary sacrifice arrangement you sign up to
- Your trade union, if applicable
- Disclosure and Barring service in order to conduct criminal record checks, if applicable
- Occupational Health Providers
We may share your information with the following organisations:
- North Yorkshire Council who provide payroll services
- HMRC
- Department of Work and Pension, if applicable.
- Pension Funds
- Any salary sacrifice arrangement you sign up to.
- Your trade union, if applicable
- · Disclosure and Barring service in order to conduct criminal record checks, if applicable
- Occupational Health Providers
- Examining bodies and training providers if applicable.
- Professional bodies relevant to the role in which you are employed eg Chartered Institutes etc
- Prospective future employers, landlords, letting agents, or mortgage brokers where you have asked them to contact the organisation to seek a reference
We may also share information with other third parties where there is a lawful basis to do so. For example, we sometimes share information with the police for the purposes of crime detection or prevention or may share information with third-party organisations contracted to conduct employee surveys
How long do we keep your personal data for?
We will retain your information in accordance with our Records Management Policy and Retention Schedule . The retention period for most of the information we process about you is determined by statutory obligations. Any personal information which we are not required by law to retain will only be kept for as long as is reasonably necessary to fulfil its purpose.
Employee records may will be kept in line with dates of employment and then usually for 7 years after the termination of contract.
What is our lawful basis for processing your information?
Under the UK GDPR, it is essential to have a lawful basis when processing personal information. We normally rely on the following lawful bases:
Article 6(1)(b) – performance of a contract
Articl 6(1)(c) – Legal Obligation
In connection with certain job roles, the organisation may need to collect criminal information. For the processing of personal data relating to criminal convictions and offences, processing meets Schedule 1, Part 1 of the Data Protection Act 2018 as below:
(1) Employment, social security, and social protection
Some of the information we collect about you is classed as special category data under the UK GDPR. The additional conditions that allow for processing this data are:
UK GDPR Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by law meeting Schedule 1, Part 1 of the Data Protection Act 2018 as below:
(1) Employment, social security, and social protection
(2) Health and Social Care purposes
UK GDPR Article 9 (2)(g) – processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
(8) Equality of opportunity or treatment
(10) – preventing or detecting unlawful acts
(18) – safeguarding of children and vulnerable people
The legislations, policies and guidance that relate to this service includes, but is not limited to:
Employment Rights Act 1996 as amended
Health and Safety at Work Act 1974
Heath Act 2006
The Equality Act
Changes to this notice
We reserve the right to change this privacy notice at any time.
This privacy notice was last reviewed 30 March 2026.