We have been made aware of a data breach affecting Access Personal Checking Services Ltd (APCS), a company who carry out DBS checks for a wide range of organisations, including some Church of England bodies. Up until March this year, the Diocese of Derby used APCS to process its DBS check processing, which means that some of our clergy, lay leaders, church volunteers and the Parish Support Team are affected.
Affected data includes name, date of birth, email, address, place of birth, gender, National Insurance number, passport details, driving licence details. The data is text data only. It does not include images or documents. It does not include medical information, information on any disclosures, information about protected characteristics, such as ethnicity, disability, sexual orientation, marital status.
APCS believe the data compromised involves applications from 1 December 2024 to May 2025.
We have emailed all PCCs who we believe are directly affected by this data breach via their PCC secretary, clergy and the designated person who coordinates the DBS checks in those parishes.
We have also outlined the steps that each affected PCC needs to take, as data controllers, to report this breach of personal information to the Information Commissioners Office and the Charity Commission.
What can I do?
While there is no guarantee that the information exposed in this breach won't be misused, most people affected by data breaches do not experience any problems. However, if you are affected by this breach, there are some steps you can take to remain vigilant about how your data could be used:
- Stay alert to unexpected emails, calls, or letters that mention personal details about you
- Never give personal information to unsolicited callers, even if they seem to know details about you
- Verify any unexpected contact by calling the organisation directly using their official number
- Monitor for new applications made in your name:
- Check your credit report
- Look for any new accounts, credit searches, or applications you didn't make
- For general advice, contact:
- Citizens Advice: 0808 223 1133
- Action Fraud: 0300 123 2040
As always, stay alert for any suspicious activity via email, SMS, or phone calls. Responsible organisations will not contact you and ask you to provide them with personal account information such as your username and password. If you are unsure about anyone you are in communication with, online or over the phone, make sure you verify their identity independently before engaging with them further.
What support is available?
There is specific support available to the individuals named in the data breach which will be communicated directly to them.
We have set up an email address databreachsupport@derby.anglican.org for people who have any questions or concerns that they wish to share with us about this data breach and our response to it.
We will also soon publish a list of Frequently Asked Questions (FAQs) on our website.
What do churches and PCCs need to do?
Details for PCCs, as data controllers, about how to report a data breach to the ICO can be found on their website here. This should be done within 72 hours of an organisation becoming aware of a breach.
Template guidance for how to submit a referral to the Charity Commission can be found here.
We are actively monitoring this incident and will regularly update this page as new advice or guidance becomes available.
