Agenda item

A report from the Head of Performance and Delivery attached

The Audit Committee considered a report presented by Helen Corbishley, Head of Performance, Delivery and Compliance and Data Protection Officer, providing an update on information governance activity and performance for the period April to September 2026, covering Freedom of Information (FOI) requests, Subject Access Requests (SARs), Environmental Information Regulations (EIRs), data breaches and GDPR training compliance.

The Committee was advised that 109 FOI requests had been received during the reporting period, with 53 currently outstanding beyond the statutory timescale. An increase in FOI requests had been experienced both locally and nationally, with the increase correlating to a reduction in overall compliance rates. Members were informed that a compliance improvement programme was underway, including revised internal processes, weekly performance reporting, training and targeted support for services with significant backlogs. Work was also progressing to migrate services onto a new FOI case management system.

In relation to Subject Access Requests, Members noted that 68 requests had been received, of which 17 were outside the statutory timescale. Officers reported that SAR volumes had increased by approximately 75% over a year, reflecting national and regional trends. To improve efficiency, a business case was being developed for enhanced IT and PDF redaction tools, including consideration of artificial intelligence-assisted redaction technology.

The Committee noted that four EIR requests remained open, with three outside the statutory timescale.

Members were advised that 105 data breaches had been recorded during the six-month period, with the vast majority resolved within target timescales. Officers reported that staff awareness of information governance requirements had improved and that many breaches resulted from emails being sent to incorrect recipients. Since the previous report, no breaches had met the threshold for referral to the Information Commissioner's Office (ICO).

The report further highlighted that GDPR compliance training completion stood at 65%, with a significant increase in completion rates expected before the next reporting period due to changes in induction arrangements for new starters.

Members were given the opportunity to ask questions and make comments and the following points were raised:

• Councillor Green referred to the number of data breaches reported and asked what mitigation measures were implemented when breaches occurred and whether existing processes required strengthening.

In response, Helen Corbishley advised that staff were required to complete an online incident reporting form detailing the breach and immediate mitigating actions taken. Where repeat behaviours were identified, additional controls and interventions were considered and implemented.

• Councillor Green queried the significant increase in requests over the past year, FOI (28%) and SARs (75%) and asked whether this was attributable to particular service areas.

Helen Corbishley advised that the increase reflected a wider national trend, with the most significant volumes being received within Corporate Core services and Children's Services.

• Independent Member David Webster noted that new training arrangements appeared to be having a positive impact, with FOI and SAR volumes reducing since April. He asked whether the GDPR training figure represented a rolling position.

Helen Corbishley confirmed that the training compliance figure was rolling and advised that revised induction arrangements would require new starters to complete training within their first few weeks of employment.

• Independent Member, Ben Thomas asked whether services using the new case management system had seen improvements.

Helen Corbishley reported notable improvements in areas already using the system, particularly Human Resources and Children's Services, where collaboration within the system had improved response times. The intention was for all service areas to be migrated to the system by December 2026.

• Councillor Gartside commented that compliance figures should be viewed in the context of increasing volumes and the scale of the authority's information governance responsibilities.

• Councillor M Smith asked how the severity of data breaches was assessed.

Helen Corbishley explained that the ICO's risk assessment methodology was used to consider factors such as risk, potential harm, and mitigations when determining severity and whether a breach should be escalated.

• Councillor Rubinstein asked how vexatious requests were managed.

Helen Corbishley advised that a person could not be classified as vexatious, but a request could be. Enhanced reporting arrangements enabled patterns to be identified and advice would be sought from the ICO where appropriate. Members were also advised that alternative routes existed for members of the public seeking information.

• Councillor Chaudhry asked whether management information was available regarding outstanding GDPR training compliance.

Helen Corbishley confirmed that compliance reports were produced monthly, reported through the Governance and Assurance Board and circulated to service managers.

• Councillor Hook sought clarification regarding governance arrangements for the compliance improvement programme.

Helen Corbishley advised that progress was monitored through established governance and assurance reporting mechanisms.

• Councillor Hook also asked whether the recent increase in request volumes represented a one-off spike and whether additional staffing resources were required.

Helen Corbishley advised that longer-term trend analysis was not yet available. Whilst additional resources were always beneficial, current efforts were focused on process efficiencies and improving information accessibility, which would help reduce workloads and improve performance.

It was agreed:

1. That the Audit Committee notes the Information Governance performance for the first six months of 2026/27.