Whether or not your PCC uses Safeguarding Hubs, it must have a Data Privacy Notice. This tells church members why and how their personal data is being processed. It should cover all church purposes, not just safeguarding.
Is there a template Data Privacy Notice?
Yes.
The Parish Resources website provides some very helpful information for parishes, including a template Data Privacy Notice.
What should be included in a Data Privacy Notice?
As a minimum, the following information should be included in your Data Privacy Notice:
"We have a legal obligation to collect and process personal data for safeguarding purposes. This includes keeping a record of DBS checks and safeguarding training undertaken by church volunteers [and employees]. This data is securely processed on behalf of the PCC by Clearly Simpler Limited."
However, if you are using the above-mentioned template, you may want to include the following information.
Privacy Notice Section | Suggested Information |
Why do we collect and use your personal data? | We collect and use personal data about church volunteers [and employees] in order to comply with the Church of England's safeguarding requirements. |
What categories of personal data we process?: |
|
What is the lawful basis for us to process your personal data? |
We collect and process this data because we have a legal obligation to do so. This obligation is set out in the Church of England's:
|
Where do we collect your data from? |
We collect this data from:
|
Processing your data | This data is securely processed on behalf of the PCC by Clearly Simpler Limited using a system called Safeguarding Hubs. |
Sharing personal data |
We may share this data with the Diocese of ... where there is a lawful basis for doing so. |
How long do we keep data? | We keep data in accordance with the guidance set out in the guide “Keep or Bin: The Care of Your Parish Records”: See the records management guides issued by The Church of England. |
Related pages
- Summary of the GDPR requirements
- What is the lawful basis for processing personal data?
- Does a PCC need a Data Privacy Notice?
- Does a PCC need a Data Processing Agreement?