National Church Institutions data protection

The National Church Institutions (NCIs) use personal information to carry out their many functions supporting the mission and ministry of the Church of England. Legislation requires and sometimes empowers the NCIs to provide goods and services to the wider Church.

The NCIs therefore collect a wide range of personal data required for or incidental to the discharge of its functions, involving employees, clergy, pensions, housing, public consultations, recruitment and appointment, parliamentary functions etc.  The NCIs will endeavour to ensure that they use personal information in line with the expectations and interests of those with whom they come into contact, including their employees, office holders and customers, for the benefit of the Church and wider society and in compliance with data protection legislation.

Your rights

Data protection legislation gives you specific rights regarding your personal data:

1. The right to be informed
2. The right to access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object

The NCIs will facilitate such individual rights requests and ensure that action is taken within the legislated timescales.

In dealing with the processing of valid request(s) the NCIs will be guided by the following principles:

• The NCIs will be open and transparent with data subjects when communicating with them about their rights, including the provision of appropriate privacy notices.
• The NCIs will comply with the request unless exemptions or restrictions apply.
• The NCIs will always provide an acknowledgement of the receipt of the request.
• The NCIs will accept requests by phone, email, letter and social media.
• The NCIs will provide a response in compliance with the duties placed upon it as a Data Controller.
• The NCIs will support the individual to make the request clear to enable them to get the best possible response.
• The NCIs will facilitate the exercise of data subjects’ rights in order to enable to them to make their request to the correct data controller.
• The NCIs will ensure that partner organisations or 3rd party processors are made aware of such requests and are expected to collaborate with the NCIs and the data subject in order to fulfil them.

The NCIs will provide a written response to all requests in the same format as the request was received (except social media) or in the most secure method available to meet the needs of the data subject.

The NCIs will not comply with requests where the identity of the requester cannot be verified.

In responding to request(s) the NCIs will meet the following timescales:

• Provide an acknowledgement of the receipt of any request within 5 working days of receipt
• Provide a response as required by law and set out in the table below:

The right to be informed

This is your right know about how your data is being processed, who it is given to, for what purpose and anything else that guarantees your rights. The NCIs will provide this information to you in the form of Privacy Notice.

The right of access

You have a right to access your personal data and relevant supplementary information. This is known as a Subject Access Request. 

Occasionally it may take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.

In most cases we cannot charge you a fee to comply with a subject access request. However, where the request is considered manifestly unfounded or excessive we may charge a “reasonable fee” for the administrative costs of complying with the request. We may also charge a reasonable fee if you request further copies of your data following a request. We would base this fee on the administrative costs of providing further copies.

The right to rectification

If you believe that any personal data we are holding about you is incorrect or incomplete, you have the right to have your personal data rectified if it is inaccurate or incomplete. In most cases we will delete information, correct information or add additional notes indicating corrections.

The right to erasure

You have the right to ask us to delete your personal data under certain circumstances. Please note that this although you may make a request, where the NCIs are required to hold the information for statutory reasons we will not necessarily agree to erase such data.  

The right to restrict processing

You have a right to request the NCIs to ‘block’ or supress processing of your personal data. Please note that this is not an absolute right, and we may not be able to comply.

The right to data portability

You have the right to obtain and reuse your personal data for your own purposes. You have the right to receive your personal data in a structured, commonly used and machine-readable format. The NCIs will assist in the transmission of such data to another entity, upon request, to the extent technically feasible. Note that this right only applies to automated information which you initially provided consent for us to use, or where we need the information to perform a contract for you.

The right to object to processing

You have the right to object to processing in certain circumstances.  This is not an absolute right, and may be refused.

The cessation of processing does not require the NCIs to erase or delete data unless an erasure request has been made and agreed.

You have an absolute right to stop your data being used for direct marketing.

The right to withdraw consent

If you have consented to the processing of your personal data via a consent form or process, you have the right to revoke such consent through a consent withdrawal process. This will be specific to the process you have consented to. If you withdraw your consent, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Rights related to automated decision making including profiling

There are restrictions on automated decisions based solely on automated means without any human involvement. Also there are restrictions on profiling.

Concerns about data protection

If you have a concern about the way we are collecting or using your personal data, we would appreciate the chance to deal with your concerns.  You can raise your concern by contacting the Data Protection Team using the form at the bottom of this page or in writing to:

Data Protection Team
Church of England Record Centre
15 Galleywall Road
London
SE16 3PB

You have the right to make a complaint at any time on the Information Commissioner's website at or by writing to them at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate)

Making a request

Individual rights requests may be submitted by phone, email, letter, or via social media. Whilst not a legal requirement, applicants are invited to complete our application form as this will assist us in identifying the data held about you.

We may need to request specific information from you to help us confirm your identity and ensure your rights to access your personal data (or to exercise any of the other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to help locate the information.

We may change this statement from time to time to reflect privacy or security updates. We encourage you to periodically review this page for the latest information.