Procurement Services
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Identity and contact details of the data controller
- Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
- Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Reasons for processing your personal data
Lancashire County Council’s Procurement Service is responsible for acquiring goods, works, and services to support the delivery of council functions and public services. This includes managing tendering processes, evaluating supplier bids, awarding contracts, and overseeing supplier performance and compliance.
To carry out these responsibilities, the Procurement Service may collect and process personal data relating to individuals acting on behalf of suppliers, contractors, and service providers.
This processing is necessary to ensure transparency, legal compliance, and effective contract management under the Public Contracts Regulations 2015, UK GDPR, and the Data Protection Act 2018.
Personal data may be processed for the following purposes:
- Managing procurement exercises and supplier onboarding
- Conducting due diligence checks (e.g. financial standing, insurance, DBS status)
- Evaluating tenders and awarding contracts
- Administering contract performance and compliance
- Facilitating payments and financial reconciliation
- Responding to legal, audit, and regulatory obligations
- Supporting workforce transition under TUPE, where applicable
Legal basis for processing personal data
The legal basis for processing your personal data, in accordance with Article 6 UK GDPR is:
(a) Consent: you have given clear consent for us to process your personal data for a specific purpose.
In some cases, we may ask for your permission to use your personal data.
Example: If you sign up to receive updates about future tender opportunities.
We only collect and use personal data that is necessary for our procurement activities, and we handle it securely and responsibly.
(b) Contract: the processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering a contract.
We may need to process personal data to enter or manage a contract.
Example: Working with a sole trader or small business where personal details are part of the agreement.
(c) Legal Obligation: the processing is necessary for us to comply with the law. We will cite the applicable legislation if we need to rely on this basis for processing.
We must process certain personal data because the law requires us to do so.
Example: Keeping records of contracts and publishing tender information to meet legal and audit requirements.
(e) Public Task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We will cite the applicable task/function and its' basis in law if we wish to rely on this basis for processing.
We process personal data to carry out official duties that serve the public interest.
Example: Running fair and transparent procurement processes to ensure public money is spent responsibly.
Legal basis for processing special categories of personal data
The legal basis for processing special categories of personal data relating to you, in accordance with Article 9 UK GDPR is:
(b) Processing is necessary for the purposes of carrying out our obligations or exercising our specific rights or your rights in the field of employment and social security and social protection law
We process special category data where it is necessary to meet obligations in employment law or social protection law.
Example: Sharing health information to support reasonable adjustments during a procurement process involving staff transfers.
(f) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
We may process special category data where it is necessary for the establishment, exercise, or defence of legal claims.
Example: Responding to legal challenges or disputes related to procurement decisions.
(g) Processing is necessary for reasons of substantial public interest.
We process special category data where it is necessary for reasons of substantial public interest, based on UK law.
Example: Carrying out due diligence checks to ensure suppliers meet legal and ethical standards.
Legal basis for processing criminal offence data
Our service will process criminal offence data where we have a legitimate requirement to do so. Where we process such data, we will rely on the following legal basis to do so:
Data Protection Act (2018) Schedule 1, Part 2 – Substantial Public Interest
Processing is necessary for reasons of substantial public interest, such as:
- Preventing fraud
- Ensuring public procurement integrity
- Protecting public funds
Data Protection Act (2018) Schedule 1, Part 1 – Employment, Social Security and Social Protection Law
Where criminal offence data is processed in relation to employment checks or workforce transfers under TUPE.
All processing is carried out in accordance with the council’s policies on data protection and information governance, and only by authorised staff.
Information we process about you
Lancashire County Council’s Procurement Service may collect and process the following types of personal data as part of its procurement activities:
Standard personal data
- Contact details – such as name, job title, email address, telephone number
- Employment information – including CVs, qualifications, references, and professional memberships
- Business details – such as company registration, VAT number, and business address
- Financial information – including bank account details, insurance certificates, and payment records
- Contractual data – including tender submissions, service delivery records, and performance reports
Special category data
- Health information – where necessary to make reasonable adjustments or support workforce transfers under TUPE
- Criminal conviction data – where required for legal compliance or due diligence checks (e.g. DBS status)
Other data
- Workforce data – such as age, salary, pension details, and employment terms (typically in TUPE scenarios)
- Digital identifiers – such as IP addresses or system access logs, where relevant to procurement platforms or communications
We only collect personal data that is necessary for our procurement functions and handle it securely and lawfully in line with the UK GDPR and the Data Protection Act 2018.
Recipients of the personal data that we process about you
To deliver procurement services effectively and lawfully, Lancashire County Council may share personal data with the following types of recipients:
Internal recipients
- Other departments within Lancashire County Council (e.g. Legal, Finance, Information Governance)
- Contract management and commissioning teams
External recipients
- Suppliers and contractors – where necessary for contract delivery or TUPE workforce transfers
- Auditors and regulatory bodies – such as the Information Commissioner’s Office (ICO), external auditors, or government departments
- Legal advisors – for the purpose of managing disputes, claims, or legal compliance
- Law enforcement agencies – where required for the prevention or detection of crime
- Disclosure and Barring Service (DBS) – for background checks where applicable
- Partner organisations – such as NHS bodies, district councils, or voluntary sector partners involved in service delivery
Service providers
- Organisations contracted by the council to deliver services or support procurement processes (e.g. e-Tendering platforms, document scanning providers)
Any transfers to another country
- No
Retention periods
Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.
| File type | Description | Security | Retention period |
|---|---|---|---|
| Tender submissions | Supplier bids and supporting documents submitted during procurement exercises | Stored securely on council systems | Evaluation criteria - 6 years after contract has expired; 12 years if contract under seal Pre-tender advice/expressions of interest - 2 years after contract let or not proceeded with Successful tender documents and quotations - 6 years after contract expiry date Successful tender documents and quotations for contracts under seal - 12 years after contract expiry date. Unsuccessful tender documents and quotations – 3 years after contract awarded. (Closure of file at contract award date) |
| Contract documents | Signed contracts, variations, and related correspondence | Restricted access; encrypted storage | 6 years from contract end date or 12 years from end of contract if under seal |
| Supplier due diligence records | Financial checks, insurance, DBS status, references | Confidential; access limited to procurement staff | 6 years from contract end date Or 6 months after decision date for DBS |
| TUPE workforce data | Employee details transferred under TUPE regulations | Restricted access; stored securely | 6 years from contract end date |
| Payment and invoice records | Supplier bank details, payment history, and reconciliation data | Financial systems with access controls | 6 years from transaction date |
| Procurement decision records | Evaluation scores, award decisions, and approval documentation | Internal systems with audit trails | 6 years from contract end date |
| Complaints and disputes | Records of procurement-related complaints or legal disputes | Legal and governance systems | 6 years from resolution or closure or 12 years if under seal |
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
- to be informed via Privacy Notices such as this.
- to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
- of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
- of rectification, we must correct inaccurate or incomplete data within one month.
- to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
- to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
- to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
- to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
- in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
Further information
If you would like more information about this specific service, then please contact contracts.corporate@lancashire.gov.uk.
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).