{"number":"2a.3","body":"","content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"gridType":"RichTextBlock","content":"\u003Ch4\u003E2a.3.1 Data Protection Policy Statement\u003C/h4\u003E\n\u003Cp\u003E\u003Cstrong\u003E2a.3.1.1 Policy statement\u003Cbr\u003E\u003C/strong\u003ETo deliver programmes for young people and manage Scouts effectively, Scouts collect and store a significant amount of data, including personal data. This applies to both members and non-members, and data may be stored digitally or on paper.\u003C/p\u003E\n\u003Cp\u003EAll personal data must be handled and stored in compliance with data protection laws, including the UK General Data Protection Regulation (UK GDPR). \u0026nbsp;The responsibility for ensuring this compliance falls to each member within the Federation.\u003C/p\u003E\n\u003Cp\u003EThese are the seven core principles of the UK GDPR \u2013 they form the foundation for UK GDPR compliance and influence how Scout units manage and protect personal data:\u003C/p\u003E\n\u003Col\u003E\n\u003Cli\u003E\u003Cstrong\u003ELawfulness, Fairness, and Transparency\u00A0\u003C/strong\u003E\u003Cbr\u003EData must be processed lawfully, fairly, and in a transparent manner in relation to the data subject.\u00A0\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose Limitation\u00A0\u003C/strong\u003E\u003Cbr\u003EData must be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes.\u00A0\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EData Minimisation\u00A0\u003C/strong\u003E\u003Cbr\u003EOnly the data that is necessary for the intended purpose should be collected and processed.\u00A0\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccuracy\u00A0\u003C/strong\u003E\u003Cbr\u003EPersonal data must be accurate and, where necessary, kept up to date. Inaccurate data should be erased or corrected without delay.\u00A0\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EStorage Limitation\u00A0\u003C/strong\u003E\u003Cbr\u003EData should not be kept longer than necessary for the purposes for which it is processed.\u00A0\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EIntegrity and Confidentiality (Security)\u00A0\u003C/strong\u003E\u003Cbr\u003EData must be processed in a way that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage.\u00A0\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccountability\u00A0\u003C/strong\u003E\u003Cbr\u003ERecords should be kept in order to demonstrate compliance. The Data Lead is the responsible person within a Scout Unit for managing data protection duties and will support the Trustee Board.\u00A0\u003C/li\u003E\n\u003C/ol\u003E\n\u003Cp\u003EFurther guidance is available in step 1 of the \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/introduction/\u0022 title=\u0022Introduction\u0022\u003EScout Unit Data Protection Toolkit\u003C/a\u003E.\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003E2a.3.2 Responsibilities within Data Protection\u003C/h4\u003E\n\u003Cp\u003E\u003Cstrong\u003E2a.3.2.1 Responsibilities for Trustee Boards\u003Cbr\u003E\u003C/strong\u003EAs part of the management of personal data collected and used by their charity, the Trustee Board of each Scout unit within the Federation (whether or not a charity in law) must ensure that their Group, District, County, Country Headquarters or UK Headquarters:\u003C/p\u003E\n\u003Col style=\u0022list-style-type: lower-alpha;\u0022\u003E\n\u003Cli\u003Ehas a Data Lead \u2013 either the Lead Volunteer, or another volunteer with the Data Lead accreditation\u003C/li\u003E\n\u003Cli\u003Epublishes and maintains a \u003Cstrong\u003Edata protection policy\u003C/strong\u003E. For Groups, Districts and Counties, details can be seen in step 10 of the \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/\u0022 title=\u0022GDPR Toolkit\u0022\u003EScout Unit Data Protection Toolkit\u003C/a\u003E which includes a guidance template. For the Nation and UK charities, they must develop, publish and maintain a data protection policy.\u0026nbsp;\u003C/li\u003E\n\u003Cli\u003Epublishes and maintains a \u003Cstrong\u003Edata retention policy\u003C/strong\u003E. For Groups, Districts and Counties, details can be seen in step 11 of the \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/\u0022 title=\u0022GDPR Toolkit\u0022\u003EScout Unit Data Protection Toolkit \u003C/a\u003Ewhich includes a guidance template.\u003C/li\u003E\n\u003Cli\u003Eensures that appropriate records are kept to demonstrate compliance.\u003C/li\u003E\n\u003Cli\u003Eis able to demonstrate data protection compliance when requested.\u00A0\u003C/li\u003E\n\u003C/ol\u003E\n\u003Cp\u003E\u003Cstrong\u003E2a.3.2.2 Responsibilities for Leadership Teams\u003C/strong\u003E\u003Cbr\u003EWith leadership by the Scout Unit\u2019s Data Lead, each Group, District, County, Country Headquarters or UK Headquarters Leadership Team must ensure that the members of their charity are compliant with:\u003C/p\u003E\n\u003Col style=\u0022list-style-type: lower-alpha;\u0022\u003E\n\u003Cli\u003EUK Data Protection Law \u00A0\u003C/li\u003E\n\u003Cli\u003Etheir published data protection policy and data retention policy \u00A0\u003C/li\u003E\n\u003C/ol\u003E\n\u003Cp\u003EThe Leadership Team must ensure that \u00A0\u003C/p\u003E\n\u003Col style=\u0022list-style-type: lower-alpha;\u0022\u003E\n\u003Cli\u003EData protection documentation such as polices and records are maintained and kept up-to-date\u00A0\u003C/li\u003E\n\u003Cli\u003EThey know how any subject rights requests, data breaches and data Protection complaints will be managed. Guidance for subject rights request registers, together with a subject access request form, is included in step 4 of the \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/\u0022 title=\u0022GDPR Toolkit\u0022\u003EScout Unit Data Protection Toolkit\u003C/a\u003E\u00A0\u003C/li\u003E\n\u003C/ol\u003E\n\u003Cp\u003E\u003Cstrong\u003E2a.3.2.3 Responsibilities for all adults\u003Cbr\u003E\u003C/strong\u003EAll members aged 18 or over must ensure that they are compliant with their Group, District or County data protection and data retention policies. This means that each adult operating within Scouts, whether as staff or as a volunteer, is also responsible for ensuring that they handle all personal data in compliance with those policies and the law.\u00A0\u003C/p\u003E\n\u003Cp\u003EUse of the membership system must be in line with our \u003Ca href=\u0022/about-us/policy/acceptable-usage-policy/\u0022 title=\u0022Acceptable Usage Policy\u0022\u003EAcceptable Usage Policy\u003C/a\u003E. \u00A0\u003C/p\u003E\n\u003Cp\u003EAll members and non-members have rights listed in step 4 of the \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/\u0022 title=\u0022GDPR Toolkit\u0022\u003EScout Unit Data Protection Toolkit\u003C/a\u003E.\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""}]}],"config":null}]},"deprecated":false,"url":"/por/2a-key-policies/2a3-data-protection/","id":39868,"nodeName":"2a.3 Data Protection","title":"Data Protection","type":"pORRule","image":{"url":"/media/10478/scouts-logo.jpg?width=800\u0026height=450\u0026v=1db789232a4a190","caption":"Scouts Logo","type":"jpg","size":30784,"width":800,"height":450,"altText":"The Scouts logo"},"assets":null,"headerOptions":{"headerTitle":"Data Protection","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"Find out about Scouts\u0027 Privacy and Data Protection Policy.","subHeader":"Find out about Scouts\u0027 Privacy and Data Protection Policy.","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC8zOTg2OCJ9","canonicalUrl":"https://www.scouts.org.uk/por/2a-key-policies/2a3-data-protection/"}