- This policy, and the role/permission design it depends on (Section 6.3), together form the Academy's primary record of how it meets its data protection accountability obligations.
- Significant new features that touch personal data — most notably the donor portal and public marketing site, both still in design — are built around the same consent-filtered, aggregate projection layer described throughout this policy, reviewed for privacy impact before launch rather than after.
- Any new field, report, or public page that would expose more identifying information than this policy currently contemplates triggers a review of this policy itself before it ships, not after.
- The Academy designates the Data Protection Focal Person (Section 6.2) as the point of contact and internal owner for this policy, breach response (Section 18), and rights requests (Section 15), until a dedicated Data Protection Officer is appointed.
19. Accountability and Governance
Last updated 20 August 2026