Flood risk management privacy notice

What our service does

Oxfordshire County Council (OCC) is the Lead Local Flood Authority (LLFA) for the county. This means that our Flood Risk Management Team are responsible for coordinating the management of flood risk from surface water, groundwater and ordinary watercourses. 

In carrying out our role we have a number of key responsibilities, these include:

• Developing, maintaining and putting in place a Local Flood Risk Management Strategy for Oxfordshire which will include risks from surface water run-off, groundwater and ordinary watercourses. 
• Establishing local management and governance arrangements with other key stakeholders to ensure delivery of effective joined up management of flood risk.
• Being a statutory consultee on all major planning applications with surface water drainage implications.
• Establishing and maintaining a register of flood risk management assets with a record of each structure, together with details of ownership and state of repair and where appropriate the designation of such structures or features, which may affect a flood risk.
• Investigating flooding incidents, to the extent we consider necessary, in order to understand their cause and ensure that appropriate agencies play their role in the effective management of flooding incidents and recovery.

Some projects the LLFA undertake may require us to undertake a public consultation. Where the LLFA engages in public consultation or direct enquiry, the data subject may participate voluntarily. 

Who is the Data Controller 

Oxfordshire County Council is the Data Controller for the data we collect about you as an individual.

You may contact our Data Protection Officer as follows:

Information Services
Oxfordshire County Council
County Hall
New Road
Oxford
OX1 1ND

Online contact form

What information do we collect

Oxfordshire County Council will collect personal data about you when processing reported flood incident data.

This information will include:

• Name
• Address 
• Telephone number
• Email address
• Cause of flooding 
• Impact of flooding 
• Previous flood events 
• Photos of flood events

Why do we process personal data

We process your data under Article 6 of the UK-GDPR, adhering to the principles outlined in Article 5, which include lawful, fair, and transparent processing, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

The lawful basis for processing your data in accordance with legislation is it is a legal requirement under the Flood and Water Management Act 2010 to investigate flooding incidents, to the extent we consider necessary, in order to understand their cause and ensure that appropriate agencies play their role in the effective management of flooding incidents and recovery. 

Consent

Where we undertake public consultations, we process your personal data on the basis of your explicit consent. This means that you have given clear permission for us to process your data for one or more specific purposes. You have the right to withdraw your consent at any time, and we will stop processing your data unless we have another lawful basis to do so.

Legal obligations

We process your personal data to comply with our legal obligations. This means that we are required by law to process certain data. For example, we may need to process your data to comply with tax laws, employment laws, or other regulatory requirements.

Public task

We process your personal data to perform a task carried out in the public interest. This includes processing necessary for us to carry out our functions as a public authority. For example, we may process your data to provide public services or to carry out our statutory duties.

Who we share your personal data with

We may share relevant personal data with various entities to fulfil our obligations and provide services effectively. We will not share your personal data unless it is legally necessary or is essential to carry out our stated purposes. 

This information may be shared with Risk Management Authorities and consultants working on our behalf under Section 13 and 14 of the Flood and Water Management Act 2010 in order to exercise flood and coastal erosion risk management functions. 

We share your personal data with:

• The Environment Agency 
• District Councils 
• Parish Councils 
• Town Councils 
• Thames Water 
• Consultants working on our behalf 
• Oxfordshire County Council departments that support investigating and responding to flooding events, such as OCC Highways. 

How do we protect your personal data 

We prioritise the security of your personal data. We employ a range of technical measures such as encryption and access controls to safeguard your data from unauthorised access. Additionally, our organisational measures include regular training for all employees to ensure they understand their responsibilities in protecting your data. Our physical security measures, such as secure facilities and secure disposal methods, further ensure that your data is always protected.

Where we use any AI based tools to help with admin functions they do not make decisions and do not process your data in a way not compatible with legislation.

How long do we keep your data for

Information provided to us to deliver our statutory flood risk management duties will be retained in line with our legal obligation as Lead Local Flood Authority.

Your rights 

Under data legislation (The UK General Data Protection Regulation, Data Protection Act 2018 and the Data Use and Access Act (DUAA 2025) you have certain data subject rights to:

• be informed via Privacy Notices such as this.
• withdraw your consent if we are relying on your consent to process your data.
• access the personal information the council holds about you, by making a data subject request to the council, with valid identification and where necessary authority for children or other persons.
• rectification, to correct inaccurate or incomplete data.
• erasure, to delete your personal data unless there is a legal obligation to process your personal information.
• restrict processing, to reduce the information processed about you or prevent certain processing in future.
• data portability, to have your personal data in a structured, commonly used, machine-readable form when asked.
• object, to your personal data being used for profiling, direct marketing or research purposes, or any automated decision-making or profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

For more information about your rights and about how we process information, please see our corporate privacy notice.

You can also complete the online complaints form on our website.

You also have the right to appeal to the Information Commissioner’s Office which is the UK regulatory authority for data protection issues:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

www.ico.org.uk