Purpose and lawful basis for processing
Our purpose for processing your personal data is so we can contact you about your organisations story being used as a case study.
The lawful basis we rely on to process your personal data is article 6(1)(e) of the GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a regulator.
What we need
We will also ask for details about your organisation’s compliance with data protection that are relevant to the case study.
What we do with it
We’ll use your telephone number and/or your email address to contact you in order to obtain the information we need for use in the case study.
We’ll use the name of your organisation and the details you provide about it on our website and other communication channels such as social media to share your example. Responses are anonymised before publication. If we do want to publish your name and job title alongside your case study we’ll always seek your agreement beforehand.
If you provide your details to be used as an end of transition example your details will also be shared with the communications team at the Department for Digital, Culture, Media and Sport (DCMS). They may also contact you for details about your organisation’s compliance with data protection that are relevant to the case study. Your case study may also be shared via their communications channels. A copy of the privacy notice for DCMS is here.
How long we keep it
For information about how long we hold personal data, see our retention schedule.
What are your rights?
We process personal data for the use of case studies in our capacity as a regulator, so you have a right to object to our processing of your personal data. There are some legitimate reasons why we may refuse your objection, which depend on why we are processing it.
For more information on your rights, please see ‘Your rights as an individual’ in the list on the left under the ‘General information’ header.
Do we use any data processors?
No.