PCC News

GDPR is now UK GDPR but thankfully it is not too dissimilar, and the major changes do not affect the diocese. Most churches will have done what was needed back in 2018, but it is worth bringing data protection back into focus again as it’s really important we look after people’s personal data correctly.

One of the best sources of information is still the Parish Resources website: www.parishresources.org.uk/gdpr

Every point below is covered on this website with other useful information.

At your next PCC meeting it would be good to go through the essential components required if you haven’t done so recently. Some things to consider:

1. Make sure your data privacy notice and data retention policy are still up to date and relevant
2. Revisit your lawful basis of data processing. You may be able to use ‘legitimate interest’ as well as informed consent. This needs to be clearly indicated within your privacy notice.
3. Undertake a data audit. You may have undertaken a data audit before, but it is good practice to conduct an audit every couple of years to ensure you do not have personal data held incorrectly or insecurely. You might be surprised by how much personal data people have within their emails, computer files and on printed documents (all of this counts).
4. Check that you are protecting people and their personal data by following the guidance below:
   • Always use bcc (blind copy) when sending an email to multiple people
   • Never store unprotected digital documents with personal data on them. Always password protect/encrypt them or store securely and delete them when no longer needed
   • Always document your reasoning behind holding personal data and state why and where it is being held. It is not enough now just to say you comply; you need to have it documented

It may help you to consider using a software package that collates and holds your personal data, for example iKnow from Church edit. It can help you to keep people’s data secure.

Lastly it would very helpful if you could also ensure that the Parish Persons Dashboard on the Diocesan database and all Data Protection Forms are up to date as this helps us as a Diocese comply with our UK GDPR. Do contact us on qngn@qvbprfrbsabejvpu.bet or 01603 880853 if you need any further information.