Local authority · GDPR

Local authority — GDPR: managing a mosaic of processing activities

Local authorities are responsible for a wide variety of processing activities: civil registration, electoral rolls, after-school programmes, social services, and video surveillance. Each has its own purposes and rules, making GDPR compliance demanding, often with limited resources. This guide details typical processing activities, video surveillance, children's data, and the DPO.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • All local authorities, regardless of their size, are concerned.
  • Maintaining a multi-service register.
  • Governing children's data.
  • Governing video surveillance.
  • Specific caps may apply to public bodies under national law.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

The local authority acts on the basis of public interest missions and legal obligations. Its processing activities cover all services, with particular challenges around children's data and video surveillance of public spaces.

The DPO is mandatory for public bodies and frequently shared between local authorities.

Is the 'Local Authority' sector affected?

All local authorities, regardless of size, are concerned. Small municipalities are too, often with limited resources that justify a shared-services approach.

Service providers (business software vendors) are data processors and must be governed accordingly.

Detailed obligations

Maintain a multi-service register

Document all processing activities across all of the local authority's services.

Govern children's data

Handle after-school and school catering data with vigilance.

Regulate video surveillance

Define the legal basis, information, proportionality and retention periods for images.

Oversee subcontractors

Sign DPAs with business software publishers and hosting providers.

Appoint a DPO

Appointing a DPO, potentially shared between public bodies.

Sanctions & risks

Specific caps may apply to public bodies under national law. A breach involving children's data or video surveillance data is particularly sensitive.

Common mistakes in the sector

  • 1Partial register. Omitting services from the register.
  • 2Disproportionate video surveillance. Filming beyond what is necessary or retaining footage for too long.
  • 3Children's data neglected. Failing to regulate after-school activities.
  • 4DPO missing. Failing to appoint a DPO where mandatory.

Practical case

A municipality deploys video surveillance without a clear legal basis or defined retention period. Remediation requires justifying the system, informing the public, limiting the retention period, and registering it in the record of processing activities.

Compliance roadmap

  1. 1

    Map. Inventorying the processing activities of all departments.

  2. 2

    Prioritise. Prioritise children and video surveillance.

  3. 3

    Contractualise. Govern business software publishers.

  4. 4

    Secure. Appropriate retention periods and security.

  5. 5

    DPO. Designate or pool.

Frequently asked questions

Yes, but it can be pooled across local authorities.

Back to the Local authority guideLocal authority & AI Act Local authority & NIS2

Take action on GDPR

Free assessment or a chat with an expert dedicated to local authority.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the local authority sector secured their compliance with DCO.

See testimonials