Powys County Council
We read the privacy notices published across central government, councils, tax and benefits offices, health bodies and policing. These are the patterns that repeat. A public body is not a company and you are not its customer: it holds your record because a law lets it, which changes what you can ask for and what you can expect back.
Reported incidents
Pupils' and staff data taken in an attack on its schools' systems
2026-06-04Affected School IT systems
Powys County Council said on 4 June 2026 that a cyber attack found in April 2026 had affected systems at 13 schools in mid Wales. Personal data of pupils, staff and others linked to one of those schools was taken. The council has not named the schools and says it is contacting the people affected directly. It says the attack was contained quickly, the schools stayed open and specialists are investigating its cause and scope.
People affected typically ask Powys County Council to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.