Last updated: 5 October 2026
1. Controller
The data controller is the Global Converged Security Board (GCSB), based in the United Kingdom. Full registered entity details, registered address and any ICO registration number will be published on the About page. Privacy contact: use the Contact page and select "Other", with the subject "Privacy request".
GCSB is established in the UK and is therefore subject to the UK GDPR and the Data Protection Act 2018. Where GCSB offers services to people in the EU or EEA, the EU GDPR also applies. If required, an EU representative under Article 27 will be named on the About page.
2. Lawful bases
- Contract (Art. 6(1)(b)): awarding and maintaining credentials, member accounts, CPD tracking.
- Legitimate interests (Art. 6(1)(f)): publishing the Public Register and verification service so employers and the public can confirm credentials; site security; handling enquiries. We have balanced these interests against your rights, and the register shows only the minimum data needed.
- Consent (Art. 6(1)(a)): appearing in the Member Directory. You can withdraw consent at any time from your profile, and the listing is removed immediately.
- Legal obligation (Art. 6(1)(c)): keeping records required by law and responding to lawful requests.
3. Your rights
- Access: a copy of your personal data (Art. 15).
- Rectification: correct inaccurate data (Art. 16). Members can edit their own profile at any time.
- Erasure: deletion where there is no overriding reason to keep it (Art. 17).
- Restriction of processing (Art. 18).
- Data portability: your data in a machine-readable format (Art. 20).
- Objection: including to processing based on legitimate interests (Art. 21).
- Withdraw consent at any time, without affecting earlier processing.
- Not to be subject to solely automated decisions with legal effects. GCSB makes no such decisions; credential decisions are made by people.
We respond within one month, which may be extended by two months for complex requests. Requests are free unless they are clearly unfounded or excessive. How to make a request.
4. International transfers
Where data is transferred outside the UK or EEA, we rely on adequacy regulations or decisions, or on standard contractual clauses with the UK International Data Transfer Addendum.
5. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in the EU or EEA, to the data protection authority in the country where you live or work.