The General Data Protection Regulation (GDPR) came into effect from 25 May 2018.  As an EU Regulation, the new law took effect automatically and when the UK leaves the EU, the GDPR will be incorporated into UK law by the European Union (Withdrawal) Bill. The UK Government has also published the Data Protection Bill, which will supplement GDPR standards in the UK.

This means that, even post-Brexit, the Wales Coastal Monitoring Centre will need to comply with the GDPR.

​

The GDPR’s data protection principles are similar to those under the Data Protection Act.  The Wales Coastal Monitoring Centre must be able to demonstrate that any personal data we handle is:

​

• processed lawfully, fairly and transparently;

• collected for specified, explicit and legitimate purposes;

• adequate, relevant and limited to what is necessary;

• accurate and kept up to date where necessary;
  kept for no longer than is necessary where data subjects are identifiable; and

• processed securely and protected against accidental loss, destruction or damage

​

How do we protect your personal data?

​

The Wales Coastal Monitoring Centre takes the security of your personal data seriously.  We have internal controls and processes in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

​

We endeavor to ensure that suitable organisational and technical measures are in place to prevent the unlawful or unauthorised processing of your Data and against the accidental loss of or damage to your Data. This includes

​

• storing Data on an appropriately secure systems;

• training all our staff in their data protection responsibilities;

• maintaining detailed documentation of the data we collect, how it’s used, where it’s stored, which employee is responsible for it, etc.

​

​

Your Rights

​

Data subjects will have the:

​

• right to be informed about the processing of their personal data;

• right to rectification if their personal data is inaccurate or incomplete (requests to amend data will normally have to be processed within one month);

• right of access to their personal data and supplementary information, and the right to confirmation that their personal data is being processed;

• right to be forgotten by having their personal data deleted or removed on request where there is no compelling reason for an organisation to continue to process it (again employers will have to respond without undue delay and within one month of the request);

• right to restrict processing of their personal data, for example, if they consider that processing is unlawful or the data is inaccurate;

• right to data portability of their personal data for their own purposes (they will be allowed to obtain and reuse their data); and

• right to object to the processing of their personal data for direct marketing, scientific or historical research, or statistical purposes

​

If you would like access to the records we hold regarding your personal data please contact us

​