Most of the personal information we process is provided to us directly by you for one of the following reasons:
- You have made a complaint or enquiry to us.
- You have made an information request to us.
- You wish to attend, or have attended, an event.
- You subscribe to our e-newsletter.
- You have applied for a job with us.
- You are representing your organization.
We also receive personal information indirectly, in the following scenarios:
- We have contacted an organization about a complaint you have made and it gives us your personal information in its response.
- Your personal information is contained in reports of breaches of data protection law (‘breach reports’) given to us by organizations.
- A complainant refers to you in their complaint correspondence.
- Whistleblowers include information about you in their reporting to us.
- We have seized personal information as part of an investigation.
- From other regulators or law enforcement bodies.
- An employee of ours gives your contact details as an emergency contact or a referee.
BSI will retain user data for a period up to 26 months from the date captured. Contact firstname.lastname@example.org in case of a data change request, or if you wish deleted or exported. However if user data is submitted through a formal form (Ask an expert, etc.) data retention can exceed 26 months.