PN028 - Substance Misuse Privacy Notice

The wording in this document reflects the requirements of the General Data Protection Regulation (GDPR) effective from the 25th May 2018.

TCBC Service Area: PSSU
Work area: Substance Misuse
Contact Details: Lisa Meredith
Privacy Notice Name: Substance Misuse Case Management System and Database

Data Controller: Torfaen County Borough Council, c/o Civic Centre, Pontypool, NP4 6YB

If you wish to raise a concern about the handling of your personal data, please contact the Data Protection Officer on 01495 762200 or email

Have we sourced your personal data, directly from you?

Yes - but in some circumstances we will have obtained information from a referral source.

What information do substance misuse services collect about you?

The substance misuse service collects and processes a range of information about you. This includes personal information including your name, gender, ethnicity, address, and date of birth as well as information about your treatment. Additional information such as nationality, religion, marital status, sexuality and family / cohabitants details may also be collected if disclosed or provided by other external sources.

The substance misuse service may collect this information in a variety of ways

  • From a referral form
  • From you during the course of treatment
  • Via third party communications

The substance misuse service will store your data

  • In secure paper filing systems
  • In a case management system

Why does the substance misuse service process your personal data?

Necessary to fulfil the tasks in the public interest or exercise of authority vested in the Council

To be able to provide safe and appropriate treatment for you – and for concerned others. If there is a belief that you or someone else is at risk (safeguarding issues) then your information may be used to help protect you or another person.

Special categories of personal data

  • Health
  • Race
  • Ethnic Origin
  • Religion
  • Sex Life
  • Sexual Orientation

We can process this category of data because

Processing is necessary to fulfil the obligations of the controller and the data subject allowing us to process your information for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

Specifically, we use the information to be able to provide you with safe and appropriate drug and alcohol treatment (including talking to your GP when required) – and for concerned others. It enables a record to be held for contractual purposes on what treatment has been provided and to understand the service requirements. Information will be provided to other services to ensure that integrated care is provided and to cooperate with other agencies with your consent where they can help you further. In rare circumstances (where you, or others might be at risk of harm, in situations such as a risk of terrorism or other serious crimes) information might be provided without your consent. Information will also be used to keep individuals who we work with safe.

Who has access to your data?

The substance misuse service shares your data with third parties because we are required to by Welsh Government for public health purposes (but your data is anonymised). Data is also shared between different service providers based on being able to provide you with the most appropriate services and ensure every client is safeguarded. It allows us to comply with our legal obligations under s5 of the Crime and Disorder Act 1998 to provide substance misuse services. It also enables us to make sure integrated services are provided between the substance misuse service and other public services to enable us to perform our public duties.

Is the Data transferred out of the EEA?


How does the Council protect data?

The Council has internal policies in place to ensure the security of the data it processes is not lost, accidentally destroyed, misused or disclosed. Furthermore data is not accessed by employees except in the performance of their duties.

Where the Council engages third parties to process personal data on its behalf, they do so on the basis of written instructions. These third parties are also under a duty of confidentiality and are obliged to implement appropriate measures to ensure the security of data.

How long does the Council keep your data?

The Council will hold your personal data only for the period that is necessary and will follow organisational and Local Authority standards in this area. We will keep your information in line with our Local Authority retention schedules. Because of the nature of treatment and to safeguard individuals, your data will be held for 50 years from the end of your last treatment episode.

Are we making automated decisions/profiling with your data?


Your rights

You have a number of rights you can exercise:

  • access and obtain a copy of your data on request
  • require the Council to change incorrect or incomplete data
  • under certain circumstances you can require the Council to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
  • to know the period of time that the data will be stored for
  • the right to data portability
  • the right to withdraw your consent at any time
  • the right to lodge a complaint with a supervisory authority (Information Commissioners Office)
  • the consequences of if you fail to provide data to the Council
  • the existence of and automated decision-making, including profiling and the consequences of this for you.

If you would like to exercise any of these rights, please contact Mark Sharwood -

Last Modified: 17/07/2023 Back to top