Norfolk Council Faces Surge in Data Requests as 39 Million Files Move to New System
Norfolk County Council has successfully migrated more than 39 million files to a new SharePoint system, but is dealing with a significant rise in data and information requests from the public. The council's Audit and Governance Committee reviewed the annual information governance report on 28 July 2026.
Norfolk County Council has transferred over 39 million files to Microsoft SharePoint as part of a major overhaul of how it stores and manages digital records, the Audit and Governance Committee heard on 28 July 2026.
The migration is part of the council's electronic storage programme, which has also introduced new tools such as retention labels to help staff manage how long documents are kept.
However, the council is simultaneously dealing with a sharp increase in requests from members of the public. The number of Subject Access Requests — where individuals ask to see personal data held about them — Freedom of Information requests, and formal complaints all rose significantly during 2025-26.
Nigel Gollop, the council's Head of Information Governance Service, told the committee that work is ongoing to manage rising demand while continuing to meet legal response deadlines.
One notable change affecting staff involves Microsoft Teams chat messages. The council has reduced how long these messages are retained from 30 days to 7 days, in line with guidance from the Information Commissioner's Office. Officers clarified that Teams chats should be used only for short-term communication, and that anything requiring a longer record should be saved elsewhere in accordance with the council's retention rules.
Committee members also raised questions about what will happen to sensitive historical records when Norfolk's councils are reorganised into three new unitary authorities, with vesting day set for 1 April 2028. Officers confirmed that initial discussions about transferring information are underway, but acknowledged that managing longstanding records will be complex and will require further work.
The committee agreed that the council's senior information risk officer, data protection officer, and Caldicott Guardians — who oversee patient and service-user data — have adequate systems in place and are effectively fulfilling their responsibilities.
Comments
No comments yet. Be the first to share your thoughts.