Direct payments privacy notice

This privacy notice explains how Portsmouth City Council uses personal information when we provide and manage Direct Payments, including prepaid card and managed account arrangements. It should be read alongside the council’s general privacy notice and the Adult Social Care privacy notice.

This notice covers

• people who receive a Direct Payment;
• people who help manage a Direct Payment (for example, a nominated person, a Lasting Power of Attorney (LPA) or a Court-appointed Deputy); and
• where relevant, information about personal assistants (PAs) or employees paid from Direct Payments (for example, where a payroll company is used).

Portsmouth City Council is the data controller for the personal information described in this notice.

Data Protection Officer (DPO)

The Data Protection Officer for Portsmouth City Council is Helen Magri:

• Email: DataProtection@portsmouthcc.gov.uk
• Telephone: 023 9282 2251

Adult Social Care information governance contact

For advice and guidance on Information Governance issues in Adult Social Care, contact the Business and Information Team Manager on 023 9268 8373.

We use personal information to operate Direct Payments safely and lawfully, including to:

• make funds available to meet assessed eligible support needs via a Direct Payment (where appropriate);
• give information and advice about your Direct Payment;
• monitor Direct Payments, prepaid card and managed accounts as set out in the Direct Payment Agreement;
• set up and manage prepaid card and managed account arrangements (where appropriate);
• liaise with and instruct relevant third‑party providers needed to deliver Direct Payments (for example, prepaid card / managed account providers and payroll companies);
• support/ensure (where appropriate) that employer responsibilities are being carried out when Direct Payments are used to employ staff; and
• prevent and detect fraud where necessary, in line with the administration of public funds.

UK GDPR requires us to tell you the lawful basis we rely on. The Direct Payments service is delivered to meet statutory responsibilities under legislation including the Care Act 2014 and the Care and Support (Direct Payments) Regulations 2014.

For this service, the lawful bases will normally include:

• Public task – processing is necessary to perform a task in the public interest or in the exercise of official authority; and/or
• Legal obligation – processing is necessary to comply with a legal obligation.

Special category (health and social care) information

Direct Payments are part of Adult Social Care, so we may process information relating to health and care needs and support plans. Where we do, we rely on the UK GDPR condition for health or social care purposes (for example, to arrange and manage care and support).

When we use consent

We do not generally rely on consent to deliver statutory Adult Social Care services. We may use consent only where you have a real choice – for example, if you ask us to share information with a friend or family member about your Direct Payments.

The type and amount of information we hold depends on how your Direct Payment is managed. The information we may hold includes:

• copies of transactions on your prepaid card or managed account;
• where a payroll company is used, details of payments made to employees and their details (for example, name, address, bank account);
• information about people you nominate to support you to manage your Direct Payment (for example, name, address and relationship to you), including where an LPA/Deputy represents you; and
• where necessary, information from your Support Plan and Financial Assessment used as part of Direct Payment processes.

We may obtain information:

• directly from you (or your representative);
• from people you nominate to help manage your Direct Payment (including an LPA/Deputy);
• from Direct Payments providers involved in operating the account (for example, prepaid card and managed account providers); and
• where relevant, from payroll arrangements used to pay employees funded by Direct Payments.

Adult Social Care and Finance information is held on SystmOne (the same system used by GP practices in Portsmouth). The Direct Payments page explains that this enables routine sharing of relevant information efficiently while maintaining data security.

Some Adult Social Care financial information is held separately on ContrOcc, and the page states the same information governance standards apply

We share information only when it is lawful and necessary, and we prioritise privacy. Depending on your Direct Payment arrangements, we may share relevant information with:

• prepaid card and managed account providers;
• payroll companies (where used);
• other third‑party providers required for delivery of Direct Payments and accounts (the page gives examples such as employer liability insurance companies and bank details for Personal Assistants where appropriate); and
• organisations we must share with under law, including where:
  • there is a concern that you or someone else (including a child) is at risk of serious harm;
  • we are instructed to do so by a court;
  • it is part of the investigation of a serious crime; or
  • it is necessary to prevent or detect fraud relating to the administration of public funds.

Sharing with friends and family

We will not share information with your friends or family about your Direct Payments or prepaid accounts unless you instruct us to do so.

We do not routinely transfer your personal information outside the UK. If a transfer is ever required for this service, we will ensure appropriate safeguards are in place and update this notice.

Adult Social Care retains information for no longer than necessary for the purpose it was collected. Records are confidentially destroyed in line with the council’s retention schedule and the Records Management Code of Practice for Health and Social Care (2016). The Direct Payments page also links to the corporate retention schedule.

Under UK GDPR you have rights over your personal information. These include the right to:

• be informed about how we use your information;
• access your information (subject access);
• rectify inaccurate information;
• erase information in certain circumstances;
• restrict processing in certain circumstances;
• object to processing in certain circumstances (particularly where we rely on public task); and
• data portability in limited circumstances.

Some rights are not absolute and may apply differently where we are delivering statutory services, but we will always consider requests in line with the law.

To make a request, contact the DPO using the details in this notice.

If you have concerns about how we are using your information, please contact the DPO first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.

To set up and manage a Direct Payment (including prepaid card or managed account arrangements), we need certain information. If you do not provide required information, we may not be able to administer your Direct Payment or meet our monitoring and legal obligations for public funds.

We do not use automated decision‑making (without human involvement) for Direct Payments.

The Council has a duty to protect the public funds it administers. The Direct Payments page refers to the Council’s National Fraud Initiative information for more detail.

We keep privacy notices under review and will update this page when necessary (for example, if processes, systems or suppliers change).

Last updated: June 2025

Adult Social Care Information Governance

• Email: foi.socialcare@portsmouthcc.gov.uk

Data Protection Officer for Portsmouth City Council

• Email: DataProtection@portsmouthcc.gov.uk
• Telephone: 023 9282 2251