Corporate Privacy Policy

Last updated: 20 April 2026

1. Introduction 

The Cheshire and Warrington Combined Authority (CWCA) is committed to protecting personal data and being transparent about how information is used and safeguarded. 

This Corporate Privacy Policy explains: 

  • how CWCA approaches data protection across the organisation 
  • how we comply with data protection legislation 
  • the rights individuals have in relation to their personal data 

This policy sits above and alongside: 

2. Who we are 

The Cheshire and Warrington Combined Authority is a strategic public authority responsible for coordinated governance, investment and partnership working across the Cheshire and Warrington sub‑region.

For the purposes of data protection legislation, CWCA is the data controller for the personal data it processes. 

3. Our commitment to data protection 

CWCA is committed to ensuring that personal data is: 

  • processed lawfully, fairly and transparently 
  • collected for specified and legitimate purposes 
  • limited to what is necessary 
  • accurate and kept up to date 
  • retained only for as long as necessary
  • kept secure 

We embed data protection into our governance arrangements, decision‑making and project design. 

4. Lawful basis for processing 

CWCA processes personal data under one or more of the lawful bases set out in UK data protection legislation, most commonly: 

  • performance of a task carried out in the public interest or under official authority 
  • compliance with a legal obligation 
  • legitimate interests, where appropriate 
  • consent, where required 

The lawful basis relied upon will depend on the specific activity and will be explained in relevant privacy notices. 

5. Privacy notices 

This Corporate Privacy Policy does not describe all individual uses of personal data in detail. 

Where CWCA undertakes specific activities that involve the processing of personal data, such as consultations, funding programmes, engagement platforms or recruitment, we will provide a separate privacy notice explaining: 

  • what data is collected 
  • why it is needed 
  • how it will be used 
  • how long it will be retained 

Privacy notices will be made available at the point data is collected. 

6. Sharing personal data 

CWCA may share personal data with: 

  • partner organisations 
  • delivery bodies 
  • professional advisers 
  • regulatory or enforcement bodies 
  • This will only take place where: 
  • it is lawful 
  • it is necessary for a defined purpose 
  • appropriate safeguards are in place 

We do not sell personal data. 

7. Data retention 

CWCA retains personal data in line with approved retention schedules. 

Personal data is only kept for as long as necessary for the purpose for which it was collected, after which it is securely deleted or anonymised. 

Retention periods will be set out in relevant privacy notices. 

8. Data security 

CWCA uses appropriate technical and organisational measures to protect personal data, including: 

  • access controls
  • secure systems and networks
  • staff training
  • governance oversight

9. Individual rights 

Individuals have rights under data protection legislation, including the right to: 

  • access their personal data 
  • request correction of inaccurate information 
  • request erasure in certain circumstances 
  • restrict or object to processing 
  • withdraw consent where processing is based on consent 

Requests can be made using the contact details below. 

10. Complaints 

If you have concerns about how your personal data is handled, you may: 

  • contact the CWCA Data Protection Officer, or
  • raise a concern with the Information Commissioner’s Office (ICO) 

11. Contact details 

Data Protection Officer 
Cheshire and Warrington Combined Authority 
contact@cheshireandwarrington-ca.gov.uk

12. Review of this policy 

This Corporate Privacy Policy will be reviewed periodically and updated as required.