be notified of a personal data breach which is likely to result in high risk to their rights and freedoms; and make a complaint to the supervisory authority. Staff must immediately forward any request received in relation to the rights outlined above to the Head of Legal immediately in accordance with the RB’s Subject Access Request Policy and Individual Rights Policy This is particularly important because the RB must respond to a valid request within the legally prescribed time limits (under GDPR in the majority of circumstances this is 1 month from the day the request is received). Informing members of The RB The RB is subject to certain rules and privacy laws when informing members and other individuals about Church in Wales activities, events, fundraising drives etc. Prior consent is required for electronic communication (for example, by email, text or automated calls). The right to object to being kept informed (i.e. opt-out, or unsubscribe) must be explicitly offered to the individual in an intelligible manner so that it is clearly distinguishable from other information, when their personal data is collected and in every subsequent communication. An individual's objection to kept informed must be promptly honoured. If a member or other individual opts out at any time, their details should be suppressed as soon as possible. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future. Reporting a Personal Data Breach Data protection law requires the RB to notify personal data breaches to the relevant supervisory authority (for our purposes, this will usually be the Information Commissioner’s Office) and individual data subjects, in certain circumstances. Staff should be aware that a personal data breach is any act or omission that compromises the security, confidentiality, integrity or availability of personal data or the physical, technical, administrative or organisational safeguards that the RB or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of personal data is a personal data breach. If staff know or suspect that a personal data breach has occurred, they should not attempt to investigate the matter themselves. The RB has a Personal Data Breach Reporting Procedure in place Staff should be familiar with this procedure and immediately contact the Head of Legal in the event of a personal data breach in accordance with that procedure. should ensure that they preserve all evidence relating to the potential personal data breach.
be notified of a personal data breach which is likely to result in high risk to their rights and freedoms; and make a complaint to the supervisory authority. Staff must immediately forward any request received in relation to the rights outlined above to the Head of Legal immediately in accordance with the RB’s Subject Access Request Policy and Individual Rights Policy This is particularly important because the RB must respond to a valid request within the legally prescribed time limits (under GDPR in the majority of circumstances this is 1 month from the day the request is received). Informing members of The RB The RB is subject to certain rules and privacy laws when informing members and other individuals about Church in Wales activities, events, fundraising drives etc. Prior consent is required for electronic communication (for example, by email, text or automated calls). The right to object to being kept informed (i.e. opt-out, or unsubscribe) must be explicitly offered to the individual in an intelligible manner so that it is clearly distinguishable from other information, when their personal data is collected and in every subsequent communication. An individual's objection to kept informed must be promptly honoured. If a member or other individual opts out at any time, their details should be suppressed as soon as possible. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future. Reporting a Personal Data Breach Data protection law requires the RB to notify personal data breaches to the relevant supervisory authority (for our purposes, this will usually be the Information Commissioner’s Office) and individual data subjects, in certain circumstances. Staff should be aware that a personal data breach is any act or omission that compromises the security, confidentiality, integrity or availability of personal data or the physical, technical, administrative or organisational safeguards that the RB or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of personal data is a personal data breach. If staff know or suspect that a personal data breach has occurred, they should not attempt to investigate the matter themselves. The RB has a Personal Data Breach Reporting Procedure in place Staff should be familiar with this procedure and immediately contact the Head of Legal in the event of a personal data breach in accordance with that procedure. should ensure that they preserve all evidence relating to the potential personal data breach.