Privacy notice

At the Education Workforce Council (EWC) we respect the privacy of our registrants, stakeholders, and visitors to our website.

Your privacy

We take our duty to process your personal data very seriously. This policy explains how we collect, manage, use, and protect your personal data. We may change this policy from time to time to reflect best practice. Please check back frequently.

About the EWC

The Education Workforce Council (EWC) is the independent regulator for the education workforce in Wales, covering teachers and learning support staff in school and further education settings, qualified youth/youth support workers and work-based learning practitioners. This privacy notice covers the principle aims and main functions of the Council. More information on the work of the EWC can be found on our website.

Your information

If we hold information about you, we assure you that we are processing that information fairly, lawfully and securely. The EWC is known as the ‘controller’ of the personal data provided to us. This privacy notice tells you what to expect when EWC collects personal information. If you wish to talk though anything in our privacy policy, find out more about your rights or obtain a copy of the information we hold about you, please contact This email address is being protected from spambots. You need JavaScript enabled to view it.. For general contacts please visit the 'contact us' page.

Where we obtain your information

We obtain information directly from you through your communication with us, or where applicable via employers. For more information on the following please refer to the applicable section:

What personal information we collect
How we use your information
Why our use of your personal data is lawful

What are your rights?

You may request to see your personal information or have it corrected. Under the Data Protection laws you have rights we need to make you aware of. The rights available too you depend on our reason for processing your information.

Right to be informed – privacy information is available via the EWC privacy notice.
Right of access - you have a right to see the personal information that we hold on you and some other supplementary data. These rights are commonly referred to as ‘subject access’. We will require proof of identity before disclosing any information. We will respond to your request without undue delay and at the latest within one month of receipt. There are exemptions which may mean that we do not need to comply with all, or part, of your request.
Right to rectification – you have a right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Right to erasure– you have the right (in certain specific circumstances) for your data to be ‘erased’
Right to restrict processing – you have the right to ask us to restrict the processing of your information. This right is limited where the processing is based on legitimate interests and/or is for the purpose of research and statistics.
Right to object to processing –you have the right (in certain specific circumstances) to object to processing
Right to data portability - the right to ask that we transfer information about you to another organisation. This right only applies if we are processing information based on your consent, or under a contract and the processing is automated.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please see the requests page for more information and if you wish to make a request.

Retention of information about you

The length of time we keep your information for will depend how long is needed to provide you with service. We will keep it in line with our retention schedule, legislative requirements and best practice guidance until the data is no longer needed for the purpose it was collected. Following this the information will be destroyed and disposed of in a secure manner. If we are required to keep the information for statistical purposes we will anonymise or pseudonymise it where possible.

International transfers

Some of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
Where we use certain service providers, we may use specific contracts approved by the UK which give personal data the same protection it has in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

Children's information

We do not provide services directly to children or proactively collect their personal information. However, we are sometimes given information about children while handling a complaint or conducting an investigation. The information in the relevant parts of this notice applies to children as well as adults.

Sensitive data conditions

Sensitive data can only be processed where you have given consent or unless a sensitive data condition is satisfied. The consent you provide is not confined to the initial request but to the subsequent recording, use and disclosure. It is our policy to ensure that any sensitive personal data we hold or process is kept to a minimum. The sensitive data condition is satisfied when:

the processing is necessary to protect the vital interests of the worker or another person where consent cannot be given or the data controller cannot reasonably be expected to obtain it;
to protect the vital interests of another person where consent is unreasonably withheld;
the collection of sensitive medical/health data is required to defend a tribunal claim or for other legal proceedings;
the processing is of information in categories relating to racial or ethnic origin religious beliefs or other beliefs of a similar nature or physical or mental health condition is necessary for the purpose of identifying or keeping under review the existence or absence of equality in opportunity or treatment, and there are safeguards for that data subject;
where a public sector body needs the information to discharge its statutory functions; where the collection of medical or health information is done by a confidential occupational health service and is necessary for preventative medicine, diagnosis or care and treatment;
where the collection of health information is necessary for important, non-obtrusive research;
where the worker has deliberately made his/her sensitive personal information public.

Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Information management strategy

We manage the information we hold with aim of reaching the right balance between making information more widely available to the public, whilst protecting individual confidentiality and ensuring that adequate protection is in place.

Our information management polices include how we:

respond to subject access and Freedom of Information requests
secure the information we hold
ensure the information created, collected and stored and is proportionate to the need , and is retained only for as long as it is needed.

Your right to complain

If you have queries or concerns regarding how we have handled your personal data, you can contact us via email, This email address is being protected from spambots. You need JavaScript enabled to view it., or in writing to the address below and we will investigate the matter.

Data Protection Officer
Education Workforce Council
9th Floor, Eastgate House
35-43 Newport Road
Cardiff
CF24 0AB

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the Information Commissioner’s Office (ICO) https://ico.org.uk/global/contact-us/.

Freedom of Information (FOI)

The FOI Act:

allows you to see information held by us;
requires us to have a publication scheme;
make a request in writing to the Data Collection and Reporting Manager;
state clearly the information or documents you would like to access, providing as much detail as possible;
provide your name and address;
state the media by which you would like the information to be sent to you, for example, by mail, fax or e-mail.

For more information and to make a request please see the FOI section.

How to contact us

The EWC is the controller for the personal information we process. If you wish to talk through anything in our privacy policy, find out more about your rights or obtain a copy of the information we hold about you, please contact This email address is being protected from spambots. You need JavaScript enabled to view it.. For general contacts please use https://www.ewc.wales/site/index.php/en/contact-us.

Data Protection Officer’s contact details

Our Data Protection Officer is Nia Erain Griffith. You can contact her at This email address is being protected from spambots. You need JavaScript enabled to view it. or via post to: