Church of Scotland Law Department is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: Privacy@churchofscotland.org.uk

The Law Department is processing the personal data for the purpose of providing details of trustees of unincorporated bodies which own land (or which tenants land on a lease of more than 20 years) in Scotland as required under the Land Reform (Scotland) Act 2016 (Register of Persons Holding a Controlled Interest in Land) Regulations 2021 (as amended).

The RCI is a publicly searchable register that is managed on behalf of the Scottish Ministers by the Registers of Scotland (RoS), intended to show who controls the decision of owners (or tenants) of land and property in Scotland where this information may not be publicly available elsewhere.

We will collect the names, addresses and dates of birth of the persons who are trustees of congregations which are unincorporated bodies which own land and property in Scotland (or which hold a lease of more than 20 years). We will also collect details of your position at your Church, e.g. Minister, Session Clerk, Congregational Treasurer.

The lawful basis for processing this data is UK GDPR Article 6(1)(c) "processing is necessary for compliance with a legal obligation to which the controller is subject." This legal obligation is detailed within the Land Reform (Scotland) Act 2016 (Register of Persons Holding a Controlled Interest in Land) Regulations 2021 (as amended).

As we are collecting your role in the church, we are processing special category data. The lawful basis for this is UK GDPR Article 9(2)(g) "processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject."

The RCI is a publicly searchable register online. Dates of birth will not appear on the public register. If having details available on the RCI would put an individual at risk of violence, abuse or intimidation, there is a right to make a security declaration so that the information would not be made publicly unavailable.

To gather the required information, a form will be issued and emailed to the appropriate individuals. We use Microsoft products for this. They are a processor and only act on the instructions of the Church. We have an appropriate contract in place with them.

As RoS host the RCI on their website this means that it is accessible online to anyone who is interested. However, RoS registers are held securely online and have appropriate safeguards in place.

The data will be held until we receive confirmation of registration from RoS plus 60 days for the purpose of checking. We will hold the Confirmation of registration record from Ros for five years. Following that period of time, the data will be destroyed securely, following Church procedures.

Individuals have a number of rights under data protection laws. These are detailed here. For this processing purpose the following rights apply:

• Right to be informed – addressed by this privacy notice
• The right of access – this means you can request a copy of any personal data held by the organisation
• The right to rectification – this means you can request your data is corrected if it is inaccurate or incomplete
• Right to restrict processing – this links with other rights and means the processing can be restricted until the issue is resolved
• Right to know of any automated decision making – the Church does not process data in this way.