9 Steps Checklist

Step 1 - Ensure that those people in the Local Church, Circuit or District who collect and/or use (process) personal information (data) are aware of the requirements under GDPR.

Refer to Step 1 of the 9 Steps Focus Note.

Use and implement the toolkit of data protection guidance, policies and best practice that continues to be developed and promoted by the Working Party accessible from the data protection page on TMCP’s website (and the Methodist Church Website).

Step 2 - Carry out a review of the personal information (data) the Local Church, Circuit or District holds (known as a “data mapping” exercise) and maintain the results / keep them updated.

Refer to Step 2 of the 9 Steps Focus Note.

Use the Template Data Mapping Form for Managing Trustees produced by the Working Party and the Non-Exhaustive List of Examples.

Step 3 - Ensure clear and accessible information is provided to individuals about how their personal information (data) will be used (use of a Privacy Notice).

Refer to Step 3 of the 9 Steps Focus Note.

Use the Privacy Notice (sometimes referred to as a “privacy policy”) to give members, ministers, volunteers, lay workers, supporters (and all those whose personal information Local Churches, Circuits and Districts hold), the privacy information that needs to be provided to them under GDPR. Decide on the best way to get this information to individuals and refer to the New – Privacy Notice for Managing Trustees and the Template Fair Processing Statement.

Step 4 - Understand the rights of the people whose personal information Managing Trustees hold (data subjects) and work out what Managing Trustees need to do to accommodate these rights.

Refer to Step 4 of the 9 Steps Focus Note.

See Section C of the GDPR Guidance Note and ICO guidance on data subjects' rights for a summary of these rights.  Access the Data Subject Access Request Policy and the DSAR Form via TMCP’s website (form recommended for use by data subjects wishing to request details of the personal information a managing trustee body holds about them).

Step 5 - Identify what legal reason (lawful basis) Managing Trustees have to use the personal information (data) they hold and record this.

Refer to Step 5 of the 9 Steps Focus Note.

See the Lawful Bases Guidance Note and the ICO's guidance on lawful bases for more details of the lawful  bases for using personal information. To identify which lawful bases Managing Trustees should rely on in any given situation please refer to the Annex to the Privacy Notice. This can be used as a record as to the lawful bases being relied on.

Step 6 - Review how Managing Trustees obtain, record and manage consent – one of the legal reasons (lawful bases) discussed in Step 5.

Refer to Step 6 of the 9 Steps Focus Note.

Focus on the areas identified in the Annex to the Privacy Notice where the Managing Trustees rely solely on the consent of individuals to use their data and use the Consent Record and Data Collection Consent Form to help you to record and obtain consent. Read the Lawful Bases Fact Sheet 4 – Consent, GDPR Myths article and Data Protection FAQs for more information on consent.

Step 7 - Review data relating to children and systems for obtaining consent.

Refer to Step 7 of the 9 Steps Focus Note.

Contact the Connexional Safeguarding Team if you have any particular questions about safeguarding and the data protection implications in this complex area. Specific guidance is being produced in conjunction with the Working Party.

Step 8 - Be prepared to deal with any data breaches.

Refer to Step 8 of the 9 Steps Focus Note.

Follow the Security Policy to minimise the risk of a personal data breach and if a breach occurs, regardless of how small it is, follow the Interim Breach Policy and use the Breach Record for Managing Trustees.

Step 9 - Consider data protection implications when making key decisions.

Refer to Step 9 of the 9 Steps Focus Note.