This article is to help organisations who submit data for the CREST Awards scheme. It's purpose is to help you understand the data sharing relationship between the British Science Association (BSA) who manage the CREST Awards, and you as another organisation and data controller.
The CREST scheme is run by the BSA, and we are the Data Controllers for the data we process as part of this. Even when another controller (for example, a school) submits data to us, we do not take on the role of a data processor, as the BSA has designed, created and administers the programme, and as such have “determined the purposes and means of the processing” of the personal data involved (as defined at Article 4(7) of the GDPR).