Privacy and Data Policy

Llynfi and Upper Afan Ministry Area Council

Data Protection Policy

(Version 1.1 Date 2026)

1. Status of this Policy

1.1 This Data Protection Policy is a governance policy of the Llynfi and Upper Afan Ministry Area and forms part of the Ministry Area’s Governance, Authority and Operational Framework.

1.2 The policy supports, and should be read alongside:

General Data Protection Regulations (GDPR)
Data Protection Act 2018
Data Use and Access Act 2025
The Church in Wales Constitution
Relevant Charity Commission and Information Commissioners Office guidance. (ICO)

2. Purpose

2.1 The purpose of this policy is to set out how the Ministry Area complies with its legal and ethical responsibilities in relation to personal data.

2.2 The Ministry Area is committed to protecting personal data, respecting privacy, and ensuring that personal information is handled lawfully, fairly, transparently, and securely in all aspects of its religious, pastoral, charitable, safeguarding, and administrative work.

3. Scope and Application

3.1 This policy applies to:

Members of the Ministry Area Council (MAC)
Members of the MAC Executive Board and Leadership Team
Clergy
Employees
Volunteers, lay officers, and office‑holders
Any person processing personal data on behalf of the Ministry Area

3.2 The policy applies to personal data held in any form, including paper records, electronic files, email systems, images, and audio‑visual recordings.

4. Legal and Regulatory Framework

4.1 The Ministry Area processes personal data in accordance with:

The UK General Data Protection Regulation (UK GDPR)
The Data Protection Act 2018
The Data (Use and Access) Act 2025
Applicable Church in Wales legislation and guidance

4.2 Trustees of the Ministry Area, acting through the Ministry Area Council, are legally responsible for compliance with data protection law.

5. Data Controller and Governance Responsibilities

5.1 The Ministry Area Council is the designated Data Controller.

5.2 The Ministry Area Council appoints a Ministry Area Data Manager, who is responsible for:

Day‑to‑day oversight of data protection compliance
Acting as the first point of contact for data protection matters
Managing subject access requests
Managing data breaches and liaising with the Information Commissioner’s Office (ICO) where required

5.3 Ultimate accountability for data protection compliance rests with the Ministry Area Council, in line with the Governance Framework.

6. Data Protection Principles

6.1 The Ministry Area adheres to the data protection principles set out in UK GDPR.

Personal data must be:

Processed lawfully, fairly, and transparently
Collected for specified, explicit, and legitimate purposes
Adequate, relevant, and limited to what is necessary
Accurate and kept up to date
Kept for no longer than is necessary
Processed in a manner that ensures appropriate security

6.2 These principles apply to all Ministry Area activities involving personal data.

7. Lawful Bases for Processing

7.1 The Ministry Area processes personal data only where a lawful basis applies, including:

Consent
Legal obligation
Contract
Legitimate activities of a religious not‑for‑profit body
Safeguarding and pastoral responsibilities

7.2 Special category data, including data relating to religious belief or safeguarding, is handled in accordance with additional legal safeguards.

8. Data Security and Confidentiality

8.1 The Ministry Area implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure.

8.2 These measures include:

Restricted access to personal data
Secure storage of paper and electronic records
Appropriate use of passwords, encryption, and Bcc email practices
Clear expectations of confidentiality for all clergy, employees, and volunteers

8.3 Training and guidance are provided to those who handle personal data, in line with diocesan guidance.

9. Data Breaches

9.1 All actual or suspected personal data breaches must be reported immediately to the Ministry Area Data Manager.

9.2 Data breaches will be:

Assessed and recorded
Reported to the ICO where legally required
Managed in a way that seeks to minimise harm to individuals

9.3 Where required, affected individuals will be informed without undue delay.

10. Rights of Individuals

10.1 The Ministry Area recognises and upholds the rights of individuals under data protection law, including the right to:

Be informed about the use of their personal data
Access their personal data
Request rectification or erasure
Object to or restrict processing in certain circumstances

10.2 All subject access requests must be referred to the Ministry Area Data Manager and will be handled within statutory timescales.

11. Data Retention and Disposal

11.1 Personal data is retained only for as long as necessary for lawful church, safeguarding, or administrative purposes.

11.2 Records are securely disposed of when no longer required, in line with Church in Wales guidance and best practice.

12. Adoption and Review

12.1 This Data Protection Policy was adopted by the Ministry Area Council of the Llynfi and Upper Afan Valley Ministry Area on:

12.2 It will be reviewed no less frequently than every three years, or earlier if required by changes in legislation, diocesan guidance, or Ministry Area governance arrangements, in line with the Governance Authority and Operational Framework.