GDPR Data processing modelRegister of Vulnerable Persons for Use in Civil Contingency and Emergency Response Planning

Organisation: PublicSector: Local authorities

To maintain an up-to-date register of individuals identified as vulnerable—such as elderly persons or individuals with physical or mental disabilities—who may require specific assistance or priority support in the event of an emergency or civil contingency (e.g. natural disaster, health crisis, extreme weather, or evacuation procedures). This processing enables local authorities to: - Identify and locate at-risk individuals; - Coordinate timely support or rescue operations; - Communicate emergency instructions or welfare checks; - Collaborate with health and social care agencies during incidents; - Fulfil statutory duties under public safety and emergency planning laws.

Purposes (1)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Warning and protecting vulnerable people when an emergency occurs or is likely in the local area

Organisation of periodic contacts with registered persons to give them advice and assistance under the local authority's emergency plans and its arrangements to warn and inform the public (Civil Contingencies Act 2004, s.2).

Public interest

UK GDPR Art. 6(1)(e): Category 1 responders must assess risk, maintain emergency plans and maintain arrangements to warn, inform and advise the public (Civil Contingencies Act 2004, s.2). Health data: Art. 9(2)(g) with DPA 2018 Schedule 1, Part 2, para 6 (statutory purposes) or para 18 (safeguarding of individuals at risk). See the Cabinet Office guidance 'Identifying People Who Are Vulnerable in a Crisis'.

Data categories (1)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Vulnerable Persons Emergency Support Register

Data details

Living conditions and possible social difficultiesrequired

Personal health informationrequiredsensitive data

Date of birth

required

Name and surnamerequired

Data conservation rules

Active base:

For as long as the person remains registered and vulnerable. The local authority should review the register at least once a year by contacting registered persons (or their carers) to confirm their details and that they still wish to be included; entries are deleted when the person asks, moves away, dies or is no longer vulnerable. No statutory period: the controller sets the review cycle in its emergency plan.

Destruction

Data subject (6)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Carers of vulnerable individuals
Isolated or socially vulnerable persons
Persons receiving adult social care
Medically vulnerable individuals
Disabled persons
Elderly individuals

Created at:07/08/2023

Updated on:10/05/2026

Nb using:9