Personal data relates to a living individual who can be identified from that data.  Identification can be by way of the information alone or in conjunction with any other information in the data controller’s possession, or that is likely to come into such possession.  The processing of personal data is governed by the UK General Data Protection Regulation (2021) and The Data Protection Act 2018 (DPA), which contains equivalent regulations and protections to GDPR (‘GDPR’).

• The right to be informed - To be provided with clear and concise information about what we do with your personal data.

• The right of access – To request a copy of your personal data.

• The right to rectification – To allow you to have inaccurate personal data rectified or incomplete personal data completed.

• The right to erasure - To have your personal data erased at any time.  This is also known as the ‘right to be forgotten’.

• The right to restrict processing – To have the freedom to restrict the processing of your personal data in certain circumstances that limit the way that we use your data.

• The right to data portability - To view the personal data you have provided to a controller in a structured, commonly used and machine-readable format.  It also gives you the right to request that a controller transmit this data directly to another controller.

• The right to object - To ask us to stop processing any of your personal data.

• Rights related to automated decision-making and profiling - To protect your rights if we carry out solely automated decision-making that has legal or similarly significant effects on you.

• You have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

GBNI is registered with the Information Commissioner’s Office as, ‘The Girls’ Brigade Northern Ireland Ltd’ (‘GBNI’).  This Privacy Policy outlines how we decide the personal data you provide to us, is processed and for what purposes it is used.  GBNI, as the data controller, will take care to preserve, respect and protect your privacy.  We do not process personal data unless it is expressly provided to us voluntarily.  We do not share, sell, or otherwise provide personal data to third-party organisations in any way.  

GBNI may change this Privacy Notice from time to time by updating it on the GBNI website.  You should check the website periodically to ensure that you agree with any changes.

We comply with our obligations under GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure; and by ensuring that appropriate technical measures are in place to protect personal data.
 
We use personal data for the following purposes:

• Administer membership records.

• Manage our volunteers (including AccessNI applications).

• Provide medical assistance, if needed.

• Provide our membership with training opportunities.

• Develop and provide age-appropriate programme resources.

• Provide a range of suitable competitions.

• Administer a number of Award Schemes.

• Promote the values and interests of the organisation.

• Maintain accurate accounts and records; and

• Inform you of upcoming news, events, activities and services.

GBNI primarily relies on the following legal bases for processing particular data:

• Legitimate Interest – For the processing of members' details for GBNI business purposes regarding programmes, resources, training, regulations and general management of the organisation, across company, district and national levels.  For the processing of registered customers' details to allow us to provide the best possible service to our customers with the goods and services they require.

• Legal Obligation – Under the law we must hold accurate accounting records for the purposes of HMRC and other funding bodies.

• Consent – We annually review the consent given by our membership so that we hold up-to-date records to assist with the management and administration of the organisation, again across all company, district and national levels.

The local church where the GB company operates, acts as the data controller for the processing of personal data at company level.  Captains and leaders of the GB company, act as the data processors and must follow the church’s guidelines and policies when processing personal data on the church’s behalf. 

When the GB company is off-site from the local church and is carrying out activities under the authority of GBNI, then GBNI acts as the data controller for the processing of personal data.  Such as outings, camps and attending GBNI events either at district or at national level.  District Office Bearers act as the data processor and must follow GBNI guidelines and policies when processing personal data on the districts behalf.

How do GB companies use your data?

Personal data is provided to the GB company voluntarily through parental consent (namely, a parent/carer/legal guardian express agreement).  A GB member aged 13 or over is considered capable of giving consent themselves and will not require express agreement from a parent/carer/legal guardian. 

The Annual Parental Consent Form asks for name, address, date of birth, GP name and contact details, medical information and treatment, emergency contact details for two people, intimate care consent, photo consent, communication/IT consent for older girls and recognition of our safeguarding policies.  GB companies will use this information only for the administration and management of their GB company.  GB companies are not permitted to use any of this information for any other purpose than what the form intends.  Only Sub-officers aged below 18 years of age may have partial data enclosed on this form entered into the GBNI My Brigade system.  See the National Level section of this document to understand how GBNI processes personal data to be compliant with GDPR.

When a GB member attends an activity outside of the church premises, they are required to submit either a completed Consent for Trips/Outings/Gb Activities or Camps/Overnight Stays Form to the Leader in charge before the activity.  Personal data requested on these forms include the participant's name, address, date of birth, GP name and contact details, medical information and treatment, emergency contact details for two people and photo consent. GB companies will use this information only for the administration required for the named activity on the form.  GB companies are not permitted to use any of this information for any other purpose than what the form intends.  The Leader in charge of the company brings the forms to the activity and keeps them with her at all times.  GBNI/district personnel should never come into contact with this personal data except for Photo Consent, health and safety and/or safeguarding reporting. 

All leaders are also asked to complete a Leader Annual Consent Form which asks for name, address, date of birth, GP name and contact details, medical information and treatment, emergency contact details for one person, communication/IT consent and sign up to the GBNI Newsletter.  GB companies will use this information only for the administration and management of their GB company.  Partial data enclosed on this form may be entered into the GBNI My Brigade system.  See the National Level section of this document to understand how GBNI processes personal data to be compliant with GDPR.

The above-written consent is processed on behalf of the local church which acts as the data controller.  The GB company must ensure to follow the church’s guidance and policies when processing personal data under GDPR.  No personal data should be shared with any third-party without clear written consent.

Some companies may use Google Form versions of the above forms, all procedures outlined above must be carried out in the same manner online as in paper form.  Information must be password-protected and stored on a secure device.

Due to the historical nature of GB and the desire to keep photos and video recordings, GBNI has re-evaluated how it collects photo consent across all areas of GBNI.  Please refer to the ‘Use of photographs, videos and sound recordings’ section of this document for full details.

How long is data stored for?

GB companies will only keep personal data for as long as necessary to fulfil the purposes for which they collected it (e.g. annual registration) and including for the purposes of satisfying any legal, accounting, or reporting requirements.

GB companies are not permitted to store personal data forever; they only hold GB members and family data for as long as they are legally able to do so.  However, sometimes they will keep personal information for historical reasons (e.g. photographs, badge and attendance records) but you will always have a right to ask for it to be destroyed.

In determining the appropriate retention period for personal data, we require our GB companies to consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which they process your personal data and whether they can achieve those purposes through other means, and the applicable legal requirements.

How is data secured?

Each GB company must put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. 

GB companies are not permitted to share your personal data to any third-party organisations. However, GB companies may occasionally have to share some data regarding GB members with service providers such as:

• Section Leaders; to share emergency details and any medical requirements.

• Girls’ Brigade Headquarters (e.g. registration to GBNI level activities, health and safety reporting, safeguarding reporting and use of photographs)

• A new GB company; if a member wishes to transfer

• District Office Bearers

• The Duke of Edinburgh’s Award Office

• Designated Church Officers for Health and Safety and Child Protection

• Safeguarding Trusts

• PSNI

• Department of Education for funding purposes

GBNI acts as the data controller for the processing of personal data at district level.  District Office Bearers act as the data processor and must follow GBNI guidelines and policies when processing personal data on the district's behalf.

How district personnel use your data?

If working alongside the district as a District Executive Member, Office Bearer, GBNI Team Representative, Youth Forum Representative, Prayer Coordinator and Brigade Council Representative; you will be required to give voluntary consent to receive communication regarding your district and any arrangements for the forthcoming GB session. 

The District Personnel Data Consent Form asks for name, address, contact telephone numbers including mobile, and email address and consent to be contacted regarding GB business.  District personnel will use this information only for the administration and management of the district.  District personnel are not permitted to use any of this information for any other purpose than what the form intends.

You are free to share only the information you wish to on the form, and you are free to request for your consent to be updated or removed at any time.  Please contact the District Secretary if you would like to withdraw any consent you have given.  Please note: Your data will be shared with GBNI and placed on the GBNI My Brigade and you must notify GBNI Headquarters of any changes to this data.

How long is data stored for?

District personnel will only keep personal data for as long as necessary to fulfil the purposes for which they collected it (e.g. annual registration) and including for the purposes of satisfying any legal, accounting, or reporting requirements. 

Districts are not permitted to store personal data forever; they only hold GB members' data for as long as they are legally able to do so.  However, sometimes they will keep personal data for historical reasons (e.g. photographs and minutes of meetings) but you will always have a right to ask for it to be destroyed.

In determining the appropriate retention period for personal data, we require our District personnel to consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which they process your personal data and whether they can achieve those purposes through other means, and the applicable legal requirements.

How is data secured?

Each District must put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. 

District personnel are not permitted to share your personal information with any third-party organisations/suppliers. However, District personnel may occasionally have to share some information regarding GB members’ with service providers such as:

• District personnel; when supervising events, may require to be notified of any medical requirements

• Girls’ Brigade Headquarters/Designated Officers (e.g. health and safety reporting, child protection reporting and use of photographs)

• District Office Bearers

• The Duke of Edinburgh’s Award Office

• Safeguarding Trusts

• PSNI

At this level we provide a vast range of services that capture and process some form of personal data.  Each service is listed giving details on what we use, why we use it, and how it is stored and disposed of. 

General Public

GBNI does not store or capture any personal information on users with general public access.  However, when you visit and navigate around our website, we collect statistical information relating to site usage through Google Analytics. This information does not include any personally identifiable information.

There are a number of areas within the site, which may ask for some personal data to allow access to use those areas of the site.  The data collected will be held for the sole purpose of GBNI and will not be distributed to any third-party organisations.

Our “Contact Us” and “Feedback” pages, ask for your name, email address and phone number.  These details are then sent to either info@gbni.co.uk or nationalsecretary@gbni.co.uk for the recipient to respond to your request.  Once actioned the email will be deleted or may be stored on file if GBNI deems it necessary.

Online Shop

GBNI ask all customers to register with our online shop.  We collect and store the following information - name, billing address, postal address, email, telephone number, GB company and order history.  You can log into your account at any time and update your details.  We use this information to fulfil orders, follow up on order queries, manage stock and email customers with shop notices regarding extra openings or closures.  We use both Royal Mail and DPD Courier Services to dispatch our orders.  We do not share personal data with Royal Mail as we operate a franking service on-site.  For larger orders being sent through our DPD Courier service, we input the customer’s name, postal address, order number and email address into the DPD CDS Shipping Solutions Application which is on an encrypted PC.  If you do not wish to use the courier service, you may collect your order in-store or contact customerservices@gbni.co.uk to arrange payment of any additional postage charges applied by Royal Mail for larger orders.

Login Area

Leaders of GBNI-affiliated companies are asked to register to use a Leaders-only part of the site for access to leader only items on the shop, resources, paperwork, online booking and other promotional materials for viewing and download.  We collect and store their name, email address and GB company name for this purpose.  GBNI only requires the requested personal information to ensure those applying for access to this area are registered leaders on the GBNI My Brigade database.  You can delete your account at any point by contacting info@gbni.co.uk.

Online Booking

Leaders of GBNI-affiliated companies may use our online booking system to book training courses and other events.  We collect and store the name, company name, district number, email address, mobile number and other requirements e.g. dietary or access.  This information is used to fulfil the booking.  The information may be placed onto an excel register and used for the purpose of the activity.  This data is stored on an external secure server and will be deleted after the event.  All paper registers if containing personal data will be destroyed after the event.  Reminder emails/texts may be sent to the participant before the event.  GBNI provides a text messaging reminder service through Google contacts on a secure mobile device owned by GBNI and stored at GBHQ.

My Brigade Database

The data collected in this area is held for the sole purpose of GBNI and will not be distributed to any third-party organisations.  GBNI only requires the requested personal information for all currently registered Leaders for insurance purposes and making contact for any GBNI-related business.  The database is a web-based service hosted on a secure external server and is maintained by our web support company Flint Studios.  The database has a separate login feature that can only be accessed by approved users and is directly managed by GBHQ administration staff. 

There are four levels of access:

1. Company – Only your Captain and/or Correspondent can access and amend the data held under the named company.

2. Chaplain - Company Chaplains can only view and sign their part of forms that they need to give final approval for i.e Training Applications, Queen's Award Applications and Annual Partnership Agreements as part of the Annual Return.

3. District – Only the District Secretary can access and amend data regarding the district.  However, she cannot amend any of the personal data.  Company admins, can view contact details only of their district personnel and company contacts in line with permissions granted by each personnel for GBNI to display.

4. HQ – Only GBHQ staff have access to this area which gives full access to all areas for all companies and Leaders' data.  Staff can amend all details and generate reports that are useful for the management of administration for the organisation.

All current Leaders must complete a Leader Annual Consent Form giving clear consent to share their personal information with GBNI.   We ask for name, address, contact numbers, email, date of birth and general information regarding the Leaders rank, training, AccessNI and contact consent approvals.  A Leader can either log in to their account and update their own details, ask their Captain/Correspondent to update or remove their details at any point, or contact info@gbni.co.uk to make the requested changes.

The Captain/Correspondent can opt into our GBNI email address that can be allocated to each GB company to increase online security.

My Brigade  also links appointed Leaders to their District and Board of Trustee roles.  District roles are outlined in the District Booklets provided to GBHQ in June of each year by each district.  GBNI Board of Trustee roles are appointed through the election process carried out by Brigade Council.  Each Leader holding a role at either level must complete a Personal Data Declaration Form to confirm how GBNI are allowed to use their personal data for this role.

All details for resigning Leaders on the My Leaders database associated to the named GB company must be removed annually by their company Captain/Correspondent.  Please note that our online My Brigade system does not retain an archive system and is stored on a secure external server.  Manual returns will be kept securely on file at GBHQ for a period of two years after which point these returns will be destroyed.

GBNI is partly funded by external bodies who may ask us to provide them with information relating to the work we do and at times we may be required to pass on statistical information provided on the paper/electronic Annual Return regarding our membership and activities that are funded by them.

Bulk Text Messaging Service

GBNI operates a bulk text messaging service to the following recipients:

• GB Captains/Correspondents/Chaplains/Officer Bearers – for general reminders of deadlines and upcoming news, events and training in GBNI.

• Leaders with confirmed bookings – to provide updates and reminders to attend courses, events, competitions, and trainings with GBNI.

• Team Representatives – for reminders of team meetings and general communication.

GBNI sends all bulk messages via the GBNI mobile that is password protected.  Only active Captains/Correspondents details are stored on this device.  GBNI Teams, Youth Forum and Prayer Coordinators communicate through a WhatsApp group that is managed by GBNI via the GBNI mobile or PC app.  Districts may operate their own WhatsApp or alternative system to communicate among their own executive members.  Recipients can opt out of this service at any point by contacting GBHQ via info@gbni.co.uk or by logging into their personal info on the GBNI website under My Leader Profile and changing their individual settings.

GBNI Newsletter

The GBNI Newsletter is distributed by post up to three times a year to Captains/Correspondents to their home address as shared on My Brigade.  This distribution is done internally and not shared with a third part distributor.

eNews

Leaders of GBNI-affiliated companies are invited to subscribe to our eNews via the GBNI website under My Leader Profile.  Leaders will not be automatically added to this service, they must give explicit consent by manually opting in and saving the changes to their profile.  We only collect and store your name, GB Company and email address.  We use this information to deliver the GB eNews via email.  GBNI eNews is issued through a secure password-protected email facility via MailChimp.  You can unsubscribe from this service at any point by selecting the unsubscribe button at the bottom of your last eNews received, by updating My Leader Profile in your account or by emailing info@gbni.co.uk.  

eDofE

GBNI is an operating authority for The Duke of Edinburgh’s Award.  Registered participants who log into the eDofE system via www.dofe.org are advised to read over the DofE privacy policy and understand how they store and use data.  GBNI personnel can access and manage certain areas of the eDofE system regarding our members and centres that are involved in The Duke of Edinburgh’s Award scheme.  The information gathered is requested by the DofE Office for administration and management purposes.  GBNI only uses this information for its involvement in registration, administration and completing the award for its members.  At no point is the information used for another GBNI business.  Paper registrations are returned to the associated GB company.  GBNI only holds paper requests for attending the presentation service which are stored securely and are then disposed of, after the event.

Research Surveys

When completing online research surveys for GBNI, most surveys will be anonymous.  However, depending on the nature of the research to be carried, GBNI from time to time ask for your name, associated GB company and email address.  Surveys are managed through GBNI’s licence for MS Business Premium using MS Forms which is password protected.  The data collected through these surveys will be used for research analysis for GBNI only.

Use of Photographs, Videos and Sound Recordings

Due to the historical nature of GB and the desire to keep photos and video recordings, GBNI has re-evaluated how it collects photo consent across all areas of GBNI.  Going forward, photo/video consent will be collected on a detachable slip on the consent forms which only gathers the necessary data for securing consent to take, keep and use photos and videos.  This gives more security and freedom for companies to dispose of annual consent forms without destroying photo consent for images that are held by the company or by GBNI.  GB companies will be required to review and update photo consent annually to take photos/videos at company-level activities.

GBNI may take photographs, videos and sound recordings at its events for use in printed and electronic media for promotional purposes.  For GBNI level activities, GB companies will be required to seek photo/video consent before each activity by asking parents to complete a ‘Consent for Day Trips/Outings/GB Activities Form’ either a paper copy or an online version.  The GB company will then detach the slip or print out the online consent and attach it to a Register of Attendance form to be presented to GBNI personnel at each GBNI event before its commencement.  This is to safeguard the consent of the photo and how GBNI may use it.  No photo is permitted of any child without written consent from a parent, carer, or legal guardian.  Leaders are not permitted to sign consent on behalf of a parent, carer or legal guardian.

All participants and spectators will be informed of this privacy policy before recording and you are free to indicate to the organisers if you do not consent to be in such images or recordings.  Depending on the activity, you may be asked to step out from the shot. 

All photo consent collected at GBNI activities is held securely at GB headquarters for our records and will be disposed of when the photo is no longer being used for GBNI purposes.  All images are archived on a secure SharePoint account and may be used for research, publication, press releases, education, displays and exhibitions.  Images and recordings will not be distributed to any third-party organisations with exception to sending a press release to local newspapers (you will be informed of this before the commencement of the event).  Some images or recordings may be selected for permanent preservation in GBNI’s history room for historical purposes and may be used for publication, education, displays and exhibitions.

CCTV

GBNI operates CCTV cameras on site at its Headquarters for access and security purposes.  Images are recorded on a hard drive that is stored securely and encrypted.  Signage is well displayed across the premises to inform, staff, visitors and customers.

Protection of Financial Information

It is only natural to have concerns around entering sensitive personal or credit card details. GBNI would like to assure you that all purchases made on the GBNI site for assessments, online booking courses or shop orders are processed off-site by our merchant services partners Shopify and Stripe.  We do not collect or store any financial information.  Refunds are issued via our Shopify and Stripe portals which have two factor authenticators. At no point are personal bank account details visible to GBNI staff. If we do have to take a booking/order over the phone, it will be processed via the GBNI website under the user’s profile or if paying an invoice, payments will be processed via the Stripe Portal.  Any person found to be using credit cards fraudulently on this website will be prosecuted.  All financial records are kept for a period of seven years and are then securely disposed of.

How we use your data?

GBNI use your information to provide the service that you have opted in to, such as our Newsletter, eNews, leader access areas, online booking and online shop orders.  We do not pass your personal information to any other third-party organisation unless we are required by law to do so.  We do not under any circumstances rent, sell or otherwise provide your data to third-party organisations for their marketing purposes.  Nor do we provide members of the public with contact details for leaders without prior consent as indicated in the company Annual Return for the current session.  GBNI does not hold personal data for children centrally; this information is held securely at company level with the exception of documents needed for issues regarding safeguarding, health and safety and security.  We only hold information for as long as it is necessary for the management and administration purposes of the organisation.  Once data is deemed no longer necessary, it shall be securely disposed of.

Google Analytic cookies: GBNI uses Google Analytics, a web analytics service provided by Google Inc.  Google uses cookies to collect and analyse information about how the website is used.  Google undertakes not to associate your IP address with other data held by Google. The data cannot be used to identify any individual but allows us to analyse how to improve our site and deliver a better service.  If you do not wish to accept cookies you can deactivate the appropriate settings on your browser.

This information is collected from your computer regardless of whether or not you register with us and is not personal to you. This includes the following:

• Operating system (e.g. Microsoft Windows 11 or IOS);

• Browser software (e.g. Microsoft Edge, Google Chrome or Safari);

• Your IP address (the unique Internet network address of your machine);

• Our geographic location;

• Access times (the time spent on the GBNI website);

• Referring domain (the website you were browsing prior to your visit to the GBNI website);

• The device you are using to visit the site (e.g. mobile, PC or tablet); and

• The click-through rate (the number of pages entered whilst visiting our website).

How is data secured?

We are committed to ensuring that your information is secure. To prevent unauthorised access or disclosure, we have put in place appropriate technical measures to safeguard and secure the information we process; to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.  Any personal data that we collect is stored on our secure GBNI server based at our headquarters in NI and on the secure external server provided by our web support company.  We use the latest firewall and security technology to ensure the integrity and safety of all information that we store. We do not transfer any data outside of the UK for any reason.  All staff complete an induction process at the point of employment and are supplied with a copy of our latest Data Protection Policy and associated policies.  All current staff have completed data protection training and are trained how to securely use our internal systems that hold personal data.

GBNI may occasionally have to share some information regarding GB members with service providers such as:

• GBNI personnel when supervising events may be required to be notified of any medical requirements

• Designated Officers (e.g. health and safety reporting, child protection reporting and use of photographs)

• District Office Bearers

• GBNI Board Officer Bearers

• The Duke of Edinburgh’s Award Office

• IT communications company

• Website support company

• Postal service companies

• Global Payments/Sagepay

• Safeguarding Trusts

• PSNI

GBNI has put in place procedures to deal with any suspected data security breach and if you are subject to a suspected data breach, you will be notified along with the Information Commissioner’s Office where we are legally required to do so.

Everyone has the right to withhold or restrict any of their information and can amend information if it changes.  Everyone has the ‘right to be forgotten’ and can send a request to GBNI to check what details have been stored about them and for their details to be deleted from our records.  However, due to any potential safeguarding, health and safety or security issues, information may need to be retained for a period of 30 years, if GBNI deems this necessary.  To make a Subject Access Request, please call GB Headquarters on 028 9454 8054, press 2 for the office or alternatively email us via info@gbni.co.uk.  Please allow 30 days for this information to be provided.

Except where stated to the contrary, the photos, content and material on this site is Copyright 2020, The Girls' Brigade, Northern Ireland - all rights reserved.   Material on this site may be downloaded or printed for private use by leaders in GBNI-affiliated companies for use within their own company provided that the source (GBNI) is acknowledged.  The GBNI logos may not be copied from this site for any use.  GBNI-affiliated companies may use the GB logos under certain circumstances - full details may be found on the logo page on this site. No third-party usage permitted of photos, content or material without prior written consent from GBNI.

It is important to note, that this is not an exhaustive list and there may be other areas where data is collected for administration purposes of the organisation.  We aim to keep this privacy notice up-to-date and as accurate as possible.

Every effort is made to ensure accuracy.  All information on this site has been placed here in good faith.  We do not intend:

• To break the law of the UK or any other applicable country;

• To cause harm to any person through the information included;

• To infringe the copyright of any person; or

• To cause offence to others, particularly racial or sexual offence.

This privacy notice only applies to the GBNI’s collection of information.  If you follow a link from the GBNI website to any third-party websites; please ensure you familiarise yourself with their privacy notice before sharing your personal information as it will not be covered by our privacy notice.  If you feel that any part of our services breaches these rules, please contact at first instance, info@gbni.co.uk, and subsequently the GBNI National Secretary (nationalsecretary@gbni.co.uk) or at the postal address given below.

Everyone is responsible for the safe management of personal data within your GB company.  Therefore, it is vital that all leaders are aware of the data protection policies and procedures and how to report a data breach. The reporting procedures will depend on where the data was breached:

• When on-site at your local church e.g. Company night, enrolment, display, coffee mornings, rehearsals etc. All breaches must be reported to the GB Captain as soon as possible. The GB Captain must then declare the details of the breach to your designated Data Protection Lead within your church.

• When off-site from your local church e.g. At camp, trip to the local farm, going to the cinema etc. All breaches must be reported to GBHQ immediately.

• When attending a GBNI or district event e.g. Training courses, competitions, one-off events etc. All breaches must be reported directly to the Chairperson of the event. The Chairperson will complete a Data Breach Report Form and should scan the form to GBHQ within 24 hours.

A Data Breach Reporting Form must be completed giving details of the breach and should be passed to the appropriate Data Lead to action immediately.  All high-risk breaches must be reported to the ICO within 72 hours.

You can contact us by email, telephone or by post.