The Information Commissioner’s Office has given the authority a “limited assurance” assessment on existing arrangements and warned it to improve its arrangements to ensure full compliance with the Data Protection Act.

Its report identified a number of areas for improvement, despite listing a number of areas of good practice.

Its report said: “It was reported that client records held on children, family and adults’ systems cannot be deleted.

“Keeping records indefinitely is not good practice and it is likely that CCC is breaching the Data Protection Act by doing so.”

The ICO report also said that Cambridgeshire does not have any formal procedures in place to routinely review the quality of personal information that is shared under existing data sharing agreements (DSAs).

It said: “Retention periods for shared data are outlined within DSAs, however CCC do not currently undertake any checks to provide assurances that these retention periods are being adhered to in practice. “There is also no requirement for parties involved in sharing arrangements to report any data security incidents or breaches to CCC.”

In addition, at the time of the ICO audit, less than half of staff had completed a security e-learning module.

There was also no detailed guidance, documented processes or formal training available for information governance officers who handle requests.

However, areas of good practice include guidance on the council’s website on how to make a subject access request, as well as various leaflets describing how users’ information will be used.

Cambridgeshire is also part of the Cambridgeshire and Peterborough Information Sharing Partnership which has created the Cambridgeshire and Peterborough Information Sharing Framework.

The ICO said: “The framework comprises of high level principles that all the partners sign up to when they are sharing information.”

The council's corporate information governance policy is benchmarked to ISO 27001 requirements.