As your employer, the Authority needs to keep and process information about you for employment purposes. We will keep and use it to enable us to run the Service and manage our relationship with you effectively, lawfully and appropriately; during the recruitment process, whilst you are working for us, at termination of employment and after you have left. This includes using information to enable us to comply with the employment contracts and associated Schemes of Conditions of Service and negotiated terms, to comply with legal and regulatory requirements and pursue the legitimate interests of the Service.

We will disclose your information to third parties if we are legally obliged to do so, we need to comply with our contractual duties to you or where that third party is providing a service on our behalf e.g. payroll system being provided by North Yorkshire County Council.

Where the Service engages third parties to process personal data on its behalf, the third party do so on the basis of written instructions, under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

Details of how long we will keep your personal information can be found in the Retention Schedule which can be viewed on the intranet homepage.

You have obligations under your employment contract and associated Scheme of Conditions of Service and negotiated terms to provide the Service with data. In particular, you are required to report absences from work and you may be required to provide information about work related matters, including disciplinary or other matters under the implied duty of good faith. You may also have to provide the Service with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights. Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the organisation to enter into a contract of employment with you. Failing to provide information will hinder our ability to administer the rights and obligations arising as a result of the employment relationship effectively.

Your Rights

In certain circumstances the General Data Protection Regulations provide you with various rights regarding your personal information, such as the right to;

  • Request sight of the information that we are holding on you
  • Request the rectification of any inaccurate personal data
  • Request erasure of personal data
  • Request restriction of processing
  • Object to the processing of your data
  • Data portability
  • Lodge a complaint with the Information Commissioner’s Office
  • Request to withdraw consent where the processing is based on consent

Find out more about your rights 

The following pages provide information on the personal data held by Service functions/sections and why they require it.

If you have any concerns or would like to discuss how we use your information, please contact CAO Service Information team or the Data Protection Office via:

Data Protection Officer

Veritau Ltd

County Hall


North Yorkshire, DL7 8AL


Telephone:         01609 533219

You can also contact the Information Commissioner’s Office for further guidance or to lodge a complaint by visiting their web site at, telephoning 0303 123 1113 or writing to:

Information Commissioner’s Office

Wycliffe House

Water Lane


Cheshire, SK9 5AF

Security and emails

For network and information security purposes ITSS have the ability to audit employee’s activity and transactions through some of the ICT infrastructure.

Data outside the EEA

Although North Yorkshire Fire & Rescue Service have opted for a UK based email service, technical support may be provided by countries outside of the EEA and therefore in extreme circumstances, email data may be transferred accordingly. Such data transfers are protected by European Commission (EC) Model clauses, meeting both the EC and Information Commissioner’s Office requirements for providing adequate safeguards for the protection of individual’s personal data.

This does not apply to emails sent through CJSM or Egress

What personal data is held and why?

Professional Standards (HR/ Training and Development) information

  • Recruitment info (incl. tests), name, address, telephone numbers, date of birth, gender, marital status, emergency contacts including GP, nationality, right to work in UK, criminal record, equality monitoring form (ethnic origin, sexual orientation, religion, belief, gender, health), references , driving licence, ID photo
  • Contractual information as above and also T&Cs, including salaries and benefits, employment history and working hours, leave and time off work (and reasons for time off), drill nights attended, outside employment, exit interview, maternity/paternity leave
  • Discipline and Grievance record (including correspondence, documentation and any warnings issued to you)
  • Qualifications, training, performance, progression documents (NVQ), skills, assessment reports, PDPRs, PDPs, CPD applications (with previous employers and the Service)
  • Details of trade union membership (for membership deductions from salary)

The majority of processing of your information is necessary for the performance of a contract. Information is collected to help us manage your employment and make sure both parties uphold their roles as stated in that contract and associated Schemes of Conditions of Service and negotiated terms. There are also circumstances where the processing is necessary to comply with employment law legislation and meet our regulatory responsibilities as a Fire and Rescue Service. The Service has a legitimate interest in; processing witness statements you have given during discipline and grievance cases to handle cases in line with the Scheme of Conditions of Service and hold emergency contacts details to have the ability to contact them in the event of an emergency. The provision and processing of equality monitoring information, which identifies you, is based on consent and can be withdrawn at any time.

Payroll and Finance information

  • Bank, PAYE details and National Insurance Number
  • Home Address
  • Salary information including entitlement to benefits or deductions and statutory pay e.g. sickness or maternity, requests for overtime, expenses, subsistence, mileage etc.

We collect this information at the point of you entering into your employment contract. This allows us to pay you in accordance with your T&Cs within the contract and to meet employment and financial legal obligations.

Pension’s information

  • Home address, contact details, date of birth, gender
  • Bank details, PAYE information, National Insurance Number
  • Marital Status, dependents and spouse
  • Health Information where ill health retirement may apply

We have a legal obligation to collect this information to meet the requirements of pension’s legislation including The Public Service Pension (Record Keeping and Miscellaneous amendments) Regulations 2014, the Pensions Act 2008 and the Occupational Pensions Schemes (Disclosure of Information) Regulations 1996.

Occupational Health and Fitness information

  • Medical and health records, including disability information for which the Service needs to make reasonable adjustments, referrals
  • Firefighter exercise programme
  • Absence review records, sickness & absence records/reports
  • Health surveillance records to comply with health and safety law
  • Individual risk assessments
  • Physical Activity Readiness Questionnaire (PARQ)

There are circumstances where we will collect medical and health information to confirm that our employees are fit and have the ability to undertake their role and meet contractual requirements; this could include a referral to the Service Medical Advisor. It also enables us to meet employment law obligations, such as establish whether any reasonable adjustments can be made.

Control, Stations, Response and Resilience and Prevention and Protection information

  • Mobilising information (riders)
  • Incident data, notebooks and debriefs
  • Fire investigation reports
  • DBS checks and security vetting
  • Thermal imaging camera footage
  • Mobile phone numbers for Snowball lists, OSR and business continuity

Under the Fire and Rescue Service Act 2004, we have a legal requirement to obtain information to enable us to respond and manage incidents. We also have a power to follow up incidents, which requires information such as witness statements for fire investigation purposes.

For safeguarding reasons, certain individuals may have to be DBS checked or security vetted, depending on their role within the Service and legislative requirements. Providing your mobile number for Snowball lists is for contractual reasons and for us to meet our obligations to provide a response to incidents or is based on consent for business continuity; in this instance consent can be withdrawn at any time.

Health and Safety information

  • Accident records (including witness statements)
  • Personal emergency evacuation details
  • Violence to staff form
  • Individual risk assessments
  • Information to respond and defend against legal claims

We have a legal duty under health and safety legislation to protect our employees and the public. We do this by undertaking risk assessments and collecting information from certain incidents to make sure the correct procedures are in place to safeguard our employees and the public we serve.

Technical Services information

  • IT audit logs showing your activity and transactions within the IT systems
  • Information provided when reporting IT faults such as name and employee number
  • CCTV footage
  • Uniform measurements
  • Vehicle accident form details such as name, employee number, details of incident, injuries, witness statements, driving history
  • Details for estates forms including name, location and employee number
  • Food allergies or intolerances or other dietary requirements for catering purposes

We have a legitimate interest to process personal data to ensure networking, building and information security and to resolve IT faults. For the purpose of meeting the Fire Service’s legal and regulatory responsibilities, we collect data to allow us to provide you with the correct uniform, catering for courses and to administer insurance claims and investigate accidents.