Appendix two Parish Data Audit Getting ready for GDPR Review all your databases, email lists, spreadsheets, paper documents and other lists of personal data. If there are any issues, identify what you need to do. If action is not clear, then highlight questions needing further insight. New consent forms, privacy notices, and new or revised policies or procedures may need to be implemented to ensure compliance with GDPR. Description Why is the data Basis for Who holds the What security How long is data Is this covered ACTION held and what is processing data data and who controls are in kept for? by our privacy REQUIRED it used for (e.g. consent, can access it? place? notice? legitimate interest) Example: For claiming Gift Consent given by Held by Gift Aid On paper, kept in Six complete No – not yet Write privacy Gift Aid Aid completion of Officer. Also a locked filing calendar years written a notice Declarations declaration accessed by cabinet after last gift privacy notice treasurer claimed on the declaration
Appendix two Parish Data Audit Getting ready for GDPR Review all your databases, email lists, spreadsheets, paper documents and other lists of personal data. If there are any issues, identify what you need to do. If action is not clear, then highlight questions needing further insight. New consent forms, privacy notices, and new or revised policies or procedures may need to be implemented to ensure compliance with GDPR. Description Why is the data held and what is it used for Basis for processing data (e.g. consent, legitimate interest) Who holds the data and who can access it? What security controls are in place? How long is data kept for? Is this covered by our privacy notice? ACTION REQUIRED Example: Gift Aid Declarations For claiming Gift Aid Consent given by completion of declaration Held by Gift Aid Officer. Also accessed by treasurer On paper, kept in a locked filing cabinet Six complete calendar years after last gift claimed on the declaration No – not yet written a privacy notice Write privacy notice
GDPR-Guide-for-Parishes.docx