Direct Payments privacy notice

Last updated: April 2026

What this notice is about 

A Direct Payment is money that you (as a service user or carer) can receive to arrange your own care and support, instead of the council doing this for you. Many people use Direct Payments to hire their own personal assistants or support workers.  

People who want to work as personal assistants or support workers can give their details to the council so we can consider them for these roles.  

This privacy notice applies to people who receive Direct Payments , their representatives or helpers (for example a family member or person with Power of Attorney) and personal assistants or other workers paid from Direct Payments.   

You should also read our Adult Social Care privacy notice and our main privacy notice, which gives more details about your rights and how to contact us.  

What information we collect, hold and use 

We may collect: 

• your full name 
• your contact details including full address, email and telephone number 
• your date of birth 
• identification numbers, such as your NHS number or national insurance number 
• information about your family and living arrangements, such as who you live with  
• information about your lifestyle and social circumstances, for example your employment status 
• information about your health and social care support, including case records 
• financial information, such as copies of transactions on your prepaid card or details of payments made to employees such as a personal assistant 
• information about your representative or personal assistant (if relevant).

For personal assistants we may collect:  

• National Insurance number 
• proof of right to work in the UK 
• copy of your bank statement 
• qualifications, training, work experience 
• references and employment history. 

Special category data

We may ask you for special category data, where required and appropriate. This may include: 

• racial or ethnic origin 
• disability, physical and mental health details 
• religious beliefs 
• sexual orientation. 

We only collect this type of information when it is to provide care or protect your safety. 

Criminal offence data

In some cases, we may process information about criminal convictions or offences (for example, if a background check is required for someone involved in your Direct Payment). We only use this information where it is necessary and where the law allows us to do so, with extra safeguards in place. 

Where we get your information from 

We get information from:   

• you give it to us directly 
• from someone acting on your behalf for instance a solicitor, family member or someone with legal Power of Attorney 
• from Direct Payment providers involved in operating your account 
• from payroll services that help pay your personal assistant. 

How we use this information 

We use this information to: 

• make and monitor Direct Payments and manage your Direct Payment account 
• set up and manage prepaid cards 
• audit Direct Payment accounts 
• liaise with and instruct relevant third‑party providers needed to deliver Direct Payments 
• assist with managing employment tasks, including requests for Enhanced DBS and Barred list checks for personal assistants employed through a Direct Payment 
• prevent and detect crime and fraud.

Our legal reasons for processing (using) your data 

Under UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Data Use and Access Act 2025 (DUAA 2025) we use your data because: 

• it’s our legal obligation (the law says we must)
• we are doing something in the public interest or as part of our official duties (public task)
• to fulfill a contract which you have requested to enter into 

For special category (sensitive) data, such as information about your health, ethnicity, or Special Educational Need (SEND) status, we rely on:

Provision of health or social care (UK GDPR Article 9(2)(h)): Using your sensitive information is necessary for us to provide you with health or social care services and manage those services properly. 

Substantial public interest (UK GDPR Article 9(2)(g)): Sometimes, using your sensitive information is necessary for reasons of substantial public interest – for example, to protect adults at risk of harm, or to prevent fraud. (The Data Protection Act 2018 allows certain data uses for these specific public interest purposes.) 

Explicit consent (UK GDPR Article 9(2)(a)): If none of the above conditions apply, we would ask for your explicit consent to use your sensitive personal data. This is unlikely for Direct Payments, and we would explain why we need the information so you can decide. You can withdraw your consent at any time. 

If we need to use information about criminal convictions or offences, we will do so in line with Article 10 of the UK GDPR and only where the law permits it – for example, for the prevention of fraud or safeguarding purposes, under specific provisions of the Data Protection Act 2018. 

Other laws that apply to our services

We follow these laws: 

• Care Act 2014 
• Care and Support (Direct Payments) Regulations 2014. 

Who we share your information with 

We may share your information with: 

• NHS partners such as GPs and hospitals 
• care providers, including residental care and home care agencies 
• other council departments 
• carers and guardians or other people you have officially nominated or authorised to help with your care 
• health and welfare organisations including voluntary and charitable organisations 
• government organisations such as HMRC 
• law enforcement and safeguarding agencies – for example, the police, or sometimes prisons or probation services 
• Regulators and authorities – for instance, agencies that regulate health or social care services, pension regulators, or auditors who may review how public funds are used 
• Disclosure and Barring Service (DBS) 
• legal representatives and courts 
• third party service providers that support the Direct Payment program, like payroll providers (who handle paying wages to your personal assistant), liability insurance providers or Direct Payment support services that assist users of the scheme. 

How we store your data 

We keep your information safe in our secure case management systems. We have strict access controls, so only staff who need to see your information can see it. We protect our systems to prevent unauthorised access, loss or damage to your data. 

We only keep personal data for as long as needed. How long we keep your data depends on the type of information and legal requirements.  To find out how long we keep your data check our main privacy notice and retention schedule. 

Your individual rights 

You have rights over your personal data. For more details see our main privacy notice and the page about your individual rights.  

Complaints 

If you are unhappy with how we use your data please see the council’s main privacy notice to find out how to contact our Data Protection Officer and make a complaint.