nomic, cultural or social identity of the individual. Practitioner An individual working with children and young people who makes decisions about sharing personal data on a case-by-case basis. In this guidance, this includes individuals working in any type of organisation or business. Privacy Notice or Privacy Information You must provide information to individuals to tell them what is happening to their data and what you plan to do with it. This is information which outlines your purposes for processing someone’s personal data, your retention periods for that personal data, and who it will be shared with. However, there are some circumstances in which you don’t have to do this. Please see detailed guidance on the ICO website: The Children’s Commissioner’s Office has published a child friendly privacy policy38 which offers an example. Processing Any operation or set of operations which is performed on personal data or on sets of personal data. This includes collecting, storing, recording, consulting, using, amending, analysing, disclosing, restricting or deleting it. Public Task This is a lawful basis for processing personal data where a specific task is carried out in the public interest, and which is laid down by law; or the processing is needed in the exercise of official authority (e.g. a public body’s tasks, functions, duties or powers) which is laid down by law. You do not need to have a statutory power, so long as there is a clear basis in law. Special category data Under the UK GDPR, personal data which is considered sensitive and needs more protection, such as: • personal data revealing racial or ethnic origin • personal data revealing political opinions • personal data revealing religious or philosophical beliefs • personal data revealing trade union membershi