IT Policy

Millom Town Council

Policies

Information Technology (IT) Policy

Adopted: 27th May 2026 Review Date: May 2027

1. Introduction

Millom Town Council (“the Council”) recognises the importance of effective and secure information technology (IT) and email in supporting its business, operations and communications. This policy sets out the standards and responsibilities that apply to the use of IT resources and email by councillors, employees, volunteers and contractors acting on the Council’s behalf.

This policy is adopted to give effect to the requirement, set out in paragraph 1.54 of the Smaller Authorities Proper Practices Panel’s Practitioners’ Guide and tested under Assertion 10 of the Annual Governance Statement, that all smaller authorities (excluding parish meetings) maintain an IT policy explaining how everyone conducts authority business in a secure and lawful way when using IT equipment and software, whether owned by the authority or personal.

This policy should be read alongside the Council’s Artificial Intelligence (AI) Use Policy, which sets out additional rules specific to the use of AI tools.

2. Purpose

The purpose of this policy is to ensure that all IT systems, devices and data used by, or on behalf of, Millom Town Council are used securely, lawfully and responsibly, that the Council meets its statutory governance and data protection obligations, and that the Council’s information and digital assets are protected.

3. Scope

This policy applies to:

• Council-owned computers, laptops, mobile phones and tablets;
• Personal devices used for Council business (Bring Your Own Device, or BYOD);
• Email accounts, cloud storage, websites, software and shared files used for Council business;
• Access to personal data, Council documents and online systems used in the course of Council business.

It applies to councillors, employees, volunteers and contractors, whether or not they are using equipment owned by the Council.

4. Legal Framework

The Council and any person using IT in its name must comply with all relevant legislation, including in particular:

4.1 UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025

The Council is the Data Controller for the personal data processed in the course of its business. Personal data must be used fairly, lawfully and transparently and must be kept secure. The Council must implement appropriate technical and organisational measures, including access controls, encryption and retention rules, to protect personal data. The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025 and whose principal data protection provisions came into force on 5 February 2026, amends but does not replace this framework.

4.2 Computer Misuse Act 1990

The Computer Misuse Act 1990 makes it a criminal offence to access a computer system or data without authorisation, to access a system in preparation for further criminal acts, or to make unauthorised modifications to a system or to data. Council IT systems are protected by authentication and other measures designed to prevent unauthorised access.

4.3 Privacy and Electronic Communications Regulations 2003 (PECR)

The Privacy and Electronic Communications Regulations regulate electronic communications, including email marketing and the use of cookies on the Council’s website. The maximum penalty under PECR was aligned with the UK GDPR in 2026.

4.4 Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018

The Council’s website and any mobile applications used for the delivery of Council business must meet the WCAG 2.2 AA accessibility standard, and the Council maintains a published Accessibility Statement explaining where this is, and is not, met.

4.5 Equality Act 2010 and the Public Sector Equality Duty

The Council is subject to the Public Sector Equality Duty under section 149 of the Equality Act 2010 and to the duty to make reasonable adjustments. The Council’s use of IT, including the design and content of its website, the format of documents and the operation of email and other digital channels, must take account of those duties.

4.6 Confidentiality and the Common Law

In addition to its statutory obligations, the Council and those acting on its behalf are subject to ordinary obligations of confidentiality at common law and under contract, including in relation to information received from third parties in confidence and information considered in closed session.

5. Acceptable Use

5.1 Users Must:

• Use Council IT equipment primarily for Council business;
• Keep passwords confidential, use strong unique passwords and, where available, multi-factor authentication;
• Report suspected security breaches and suspected data breaches to the Clerk immediately;
• Store Council documents only in systems approved by the Clerk;
• Follow the data protection principles of minimisation, accuracy, security and storage limitation in line with UK GDPR.

5.2 Users Must Not:

• Access systems or data without authorisation (which is a criminal offence under the Computer Misuse Act 1990);
• Download or install unauthorised software on Council devices;
• Use Council devices to access harmful, illegal or inappropriate content;
• Transfer Council data to personal storage, personal email or private cloud accounts.

6. Data Protection and Security

6.1 Handling Personal Data

All personal data processed by, or on behalf of, encryption and be used only for the explicit purposes for which it was obtained, accessed only by those with a legitimate need to know, stored securely with appropriate password protection or encryption, and not transferred outside systems approved by the Clerk.

6.2 Data Retention

Personal data must be kept only for as long as necessary, in accordance with the storage limitation principle of UK GDPR and the Council’s Document Retention and Disposal Procedure.

6.3 Data Breaches

All actual or suspected data breaches must be reported to the Clerk (or, where one is appointed, the Data Protection Officer) immediately. Personal data breaches that meet the threshold for notification under Article 33 UK GDPR must be reported to the Information Commissioner’s Office (or its statutory successor) within 72 hours of the Council becoming aware of the breach. The Council’s Data Breach Policy sets out the full procedure.

7. Email, Internet and Communications

7.1 Email

All Council business must be conducted using a Council-controlled email address (typically theclerk@millomtowncouncil.co.uk or another Council-owned address). Personal email accounts (such as personal Gmail, Outlook or Yahoo accounts) must not be used for Council business, and Council email must not be set to forward automatically to a personal inbox. This is to ensure continuity of access to Council records when individuals leave the Council, and to maintain the Council’s control over its information for the purposes of UK GDPR, the Freedom of Information Act 2000 and the Council’s document retention obligations.

Personal data sent by email must be minimised and, where appropriate, encrypted or sent through a secure channel. Suspected phishing emails or other suspicious messages must be reported to the Clerk and not forwarded onwards.

7.2 Internet

Internet access using Council systems or for Council business must be for lawful purposes only. Users must avoid websites that present obvious security risks and must not download or share copyrighted material in a way that infringes the rights of the copyright holder.

8. Bring Your Own Device (BYOD)

Where personal devices are used for Council business, those devices must be password or PIN protected, kept up to date with current security and antivirus software, and used only with applications approved by the Clerk for the storage of Council data. Loss or theft of any device used for Council business must be reported to the Clerk immediately.

9. Training and Awareness

All users will receive periodic training on their data protection obligations under UK GDPR and the Data Protection Act 2018, on cybersecurity essentials including password management, phishing and secure storage, and on the proper handling of Council information. Councillors and staff are responsible for understanding and complying with their data protection duties.

10. Monitoring

The Council may monitor systems and devices used for Council business in order to ensure compliance with this policy, to investigate security incidents and to protect Council data. Any monitoring will be carried out fairly, transparently and in accordance with UK GDPR.

11. Enforcement

Breaches of this policy may result in:

• Removal of IT access;
• Disciplinary action under the Council’s disciplinary procedures (in the case of employees and volunteers);
• Action under the Council’s Code of Conduct (in the case of councillors);
• Reporting to law enforcement authorities, in the case of conduct that may constitute an offence under the Computer Misuse Act 1990 or other criminal legislation;
• Reporting to the Information Commissioner’s Office (or its statutory successor) where required by the Council’s data protection obligations.

12. Review

This policy is owned by the Clerk / Monitoring Officer and will be reviewed at least annually, or sooner where there are material changes in the law (including any further commencement of provisions of the Data (Use and Access) Act 2025 or successor legislation), in the technologies used by the Council, or in the way IT is used in support of Council business.

All councillors, staff and volunteers are responsible for the safety and security of the Council’s IT systems. By following this policy, the Council aims to maintain a secure and effective IT environment that supports its functions and serves the community of Millom.

For all IT-related enquiries or assistance, please contact the Town Clerk.

Signed: …………………………………… (Chair) Dated: 27th May 2026