Derbyshire County Council delivers services for people of all ages in every community across the county. Many, but not all, of these services are required due to legal, statutory or regulatory requirements. Much of the information and data which is held and/or generated by delivering these services is subject to protection under the Data Protection Act 1998 and the Council works to ensure that this information is protected at all times. The Council’s information asset risk management strategy has identified and appointed information asset Risk Owners from all departments. Risks to Information assets are recorded in departmental Asset Registers and managed under the Council’s Information Security Management System (ISMS).