Service providers and PII

Gabby Dunne made this Freedom of Information request to Lancaster City Council

This request has been closed to new correspondence from the public body. Contact us if you think it ought be re-opened.

The request was successful.

Dear Lancaster City Council,

1. Do you use an external IT service provider/Managed Service Provider (MSP)?
- Yes
- No

2. Does your provider/MSP serve as a processor of your Personally Identifiable Information (PII)?
- Yes
- No

If No, thank you for your time.
If Yes, please see below:

3. Does your contract/Service Level Agreement (SLA) with the provider(s) have clear provisions for the allocation of responsibilities in the event of a data breach?
- Yes
- No

4. Have you revisited your original contract(s) to ensure compliance with the General Data Protection Regulation (GDPR)?
- Yes
- No

5. Does the contract/SLA define the time frame in which a security breach at the provider must be reported to you?
- Yes
- No

6. Do you have policies in place for privileged account management?
- Yes
- No

7. Has your service provider/MSP suffered a data breach involving your organisation’s PII in the last 12 months?
- Yes
- No

8. If yes, how long did it take for them to notify you?
- <30 minutes
- 31 mins – 1 day
- 1 – 2 days
- 2 – 3 days
- More than 3 days

Yours faithfully,

Gabby Dunne

info, Lancaster City Council

2 Attachments

Dear Ms Dunne,

Freedom of Information Request - Ref: FOI 1885

Thank you for your request received on 17th July 2018 in which you asked
for the following information from the City Council:


Do you use an external IT service provider/Managed Service Provider (MSP)?


Your request has been handled under the Freedom of Information Act 2000







If you have any queries or concerns about this response, please contact
this office. For details of how to appeal a decision we have made, see



How to Appeal


Internal Review

If you are not satisfied with this response, you have the right to an
internal review.  The handling of your request will be looked at by
someone who was not responsible for the original case, and they will make
a decision as to whether we answered your request correctly.


If you would like to request a review, please write or send an email to
the Council at the following address:


Information Governance

Lancaster City Council

Town Hall

Dalton Square




Email:  [1][Lancaster City Council request email]


Information Commissioner’s Office


If you remain dissatisfied after an internal review decision, you have the
right to apply to the Information Commissioner’s Office. The Commissioner
is an independent regulator who has the power to direct us to respond to
your request differently if she considers that we have handled it


You can contact the Information Commissioner’s Office at the following


Information Commissioner’s Office

Wycliffe House

Water Lane





Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a
national rate number

Website:  [2]



Re-use of Public-Sector Information


Some of the information that we provide in response to FOIA requests will
be subject to copyright protection. In most cases the copyright will be
owned by Lancaster City Council. The copyright in other information may be
owned by another person or organisation, as indicated on the information


You are free to use any information supplied for your own non-commercial
research or private study purposes. The information may also be used for
any other purpose allowed by a limitation or exception in copyright law,
such as news reporting. However, any other type of re-use, for example by
publishing the information in analogue or digital form, including on the
internet, will require the permission of the copyright owner.


For information where the copyright is owned by Lancaster City Council,
please contact this office if you would like to request permission.


For information where the copyright is owned by another person or
organisation you must apply to the copyright owner to obtain their



Yours sincerely


Clay Garland

Information Governance Officer / Deputy Data Protection Officer

Email: [email address]

Tel: (01524) 58 2204


Governance (Information Governance), Town Hall, Lancaster LA1 1PJ

Email: [3][Lancaster City Council request email]                               

Website: [4]







show quoted sections