91ÁÔÆæ

When a data breach report form has been submitted, the following personal information is provided to us: name(s), the relationship to 91ÁÔÆæ (e.g. staff, student, external), staff and student IDs (if applicable) and the email address(es) of the reporting party, the person that identified the breach and the person that caused the potential or actual breach. We may also process the personal information that has been potentially or actually breached in order to assess the risk and severity.

The legal basis for 91ÁÔÆæ processing this personal information is ‘legal obligation’ as we have a legal obligation to process potential and actual data breaches. Special category data is information about your health (physical or mental), race, ethnic origin, religious or political beliefs, membership of a trade union and sexual orientation.

The special condition permitting the processing of the special category personal data depends on the context. The most likely to apply are Article 9(2)(b) ‘Employment, social security and social protection law’, which would include the Equality Act 2010, or Article 9(2)(g) Substantial Public Interests – Statutory and government purposes. Only if no other conditions of processing apply, we will rely on your explicit consent.

We will use the personal information to process and mitigate risks of potential and actual data breaches. We usually keep data breach documentation on file for up to the last action plus 6 years, unless there is an identified need to keep it for longer. For security reasons this does not always include the identity of the data subject of the data breach or the breached personal data. When this time has been reached, the personal information is securely destroyed.

The personal data will only be accessible to relevant staff involved in considering the breach. Hard copies of personal information are kept in a secure location and personal data stored electronically is on secure systems within the UK or EU.

We may share the personal data with the Information Commission when required. We may also share relevant personal data with external organisations if it was needed in order to process the potential or actual breach (e.g. we needed to inform a data processor of mitigating actions that need to be taken when investigating a breach), if we believe we are compelled to by law or we seek external assistance such as a consultant or legal advice. The legal basis for this processing is ‘legal obligation’ as we have a legal obligation to process potential and actual data breaches. In addition to the circumstances stated above we will share your personal information if we believe someone’s life is in danger or we believe we are compelled to by law.

You have the right to correct or update your personal data at any time. Please get in touch with your main contact at the University to update your details. If you are a student your main contact for this is the . If you cannot contact them, please email informationmanagement@bcu.ac.uk to update your personal data. You may have the , the , the and / or the right to data portability and you have the  Follow the links to find out whether those rights apply in these circumstances. To do any of those things or if you have followed the links but would like clarification, please email informationmanagement@bcu.ac.uk.

You have the right to request to see the personal data we hold about you. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

If you are not content with how we handle your information, please follow our Data Protection Complaints Procedure. If you have used that procedure and are unsatisfied with the response you have received, you then have the right to complain directly to the Information Commission. You can find out more about this on the 

• 91ÁÔÆæ’s Data Protection Policy and Appropriate Policy Document
• 91ÁÔÆæ’s Privacy Notices