{"subTitle":"Data protection is a key responsibility for anybody that has access to the personal data of \nindividuals","backgroundImage":{"url":null,"caption":null,"type":null,"size":0,"width":0,"height":0,"altText":null},"backgroundColour":null,"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EData protection is a key responsibility for anybody that has access to the personal data of individuals.\u003C/p\u003E\n\u003Cp\u003EThis guidance material has been designed to help you understand the legislation applicable for data protection and provide tooling for alignment to the legislation.\u003C/p\u003E\n\u003Cp\u003EFollowing feedback on the GDPR Toolkit, the Scouts UK Headquarters (UK HQ) have redesigned this guidance to be more step based with bite size materials that can be used in isolation. This includes the simplification of the previous GDPR Framework to line up with the new steps-based guidance.\u003C/p\u003E\n\u003Cp\u003EDuring this guidance material, local Scout Groups, Districts and Counties/Areas/Regions (Scotland) will be collectively referred to as \u2018Scout Units\u2019.\u003C/p\u003E\n\u003Cp\u003EThere are 12 steps as part of this guidance. To keep track of your progress through the material you can use the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/11791/gdpr-alignment-checklist.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR Alignment Checklist\u0022\u003EGDPR Alignment Checklist\u003C/a\u003E. As you are working through these 12 steps you may identify risks in the way you are operating. The \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/20753/gdpr-risk-register-2023.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR Risk Register\u0022\u003EGDPR Risk Register\u003C/a\u003E can be used to assist in tracking these risks.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EThe 12 steps in this guidance are broken down as below:\u003C/h4\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 1: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/\u0022 title=\u0022Step 1: What do I need to know about GDPR?\u0022\u003EWhat do I need to know about GDPR\u003C/a\u003E \u2013 Introduction to GDPR and key terms to be aware of\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 2: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/\u0022 title=\u0022Step 2: Who is responsible for what?\u0022\u003EWho is responsible for what\u003C/a\u003E \u2013 Exploration of the roles within GDPR and what they mean\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 3:\u003C/strong\u003E\u0026nbsp;\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/\u0022 title=\u0022Step 3: Appointing a data protection lead\u0022\u003EAppointing a Data Lead\u003C/a\u003E \u2013 The benefits of a Data Lead\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 4:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/\u0022 title=\u0022Step 4: Understanding data subjects\u0022\u003EUnderstanding data subjects\u2019 rights\u003C/a\u003E \u2013 Exploring the rights of data subjects and how to respond to these rights\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 5: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/\u0022 title=\u0022Step 5: Gathering data\u0022\u003EGathering data\u003C/a\u003E \u2013 Examples and tooling for the creation of best practice surveys and forms\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 6:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/\u0022 title=\u0022Step 6: Data discovery\u0022\u003EData discovery\u003C/a\u003E \u2013 Exploring the data you have and how to look for it\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 7:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/\u0022 title=\u0022Step 7: Keep a record\u0022\u003EKeep a record\u003C/a\u003E \u2013 Recording the data you have and the processes you use to gather it\u0026nbsp;\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 8:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/\u0022 title=\u0022Step 8: Check your security\u0022\u003ECheck your security\u003C/a\u003E \u2013 Looking at the ways you can secure data and keeping a record of the security in place\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 9:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/\u0022 title=\u0022Step 9: Third parties\u0022\u003EThird parties\u003C/a\u003E \u2013 Discovering and recording the third parties you use\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 10:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/\u0022 title=\u0022Step 10: Publish your privacy stance\u0022\u003EPublish your privacy stance\u003C/a\u003E \u2013 Guidance on creating a data protection policy\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 11:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/\u0022 title=\u0022Step 11: Delete and destroy\u0022\u003EDelete and destroy\u003C/a\u003E \u2013 Making sure you only keep data as long as you need it and how you should get rid of it\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 12:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/\u0022 title=\u0022Step 12: Responding to a breach\u0022\u003EResponding to a breach\u003C/a\u003E \u2013 Understanding what a breach is and how to deal with it\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/11791/gdpr-alignment-checklist.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR alignment checklist\u0022\u003EGDPR Alignment Checklist\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/20753/gdpr-risk-register-2023.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR risk register\u0022\u003EGDPR Risk Register\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"sections":[{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EData protection is a key responsibility for anybody that has access to the personal data of individuals.\u003C/p\u003E\n\u003Cp\u003EThis guidance material has been designed to help you understand the legislation applicable for data protection and provide tooling for alignment to the legislation.\u003C/p\u003E\n\u003Cp\u003EFollowing feedback on the GDPR Toolkit, the Scouts UK Headquarters (UK HQ) have redesigned this guidance to be more step based with bite size materials that can be used in isolation. This includes the simplification of the previous GDPR Framework to line up with the new steps-based guidance.\u003C/p\u003E\n\u003Cp\u003EDuring this guidance material, local Scout Groups, Districts and Counties/Areas/Regions (Scotland) will be collectively referred to as \u2018Scout Units\u2019.\u003C/p\u003E\n\u003Cp\u003EThere are 12 steps as part of this guidance. To keep track of your progress through the material you can use the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/11791/gdpr-alignment-checklist.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR Alignment Checklist\u0022\u003EGDPR Alignment Checklist\u003C/a\u003E. As you are working through these 12 steps you may identify risks in the way you are operating. The \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/20753/gdpr-risk-register-2023.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR Risk Register\u0022\u003EGDPR Risk Register\u003C/a\u003E can be used to assist in tracking these risks.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EThe 12 steps in this guidance are broken down as below:\u003C/h4\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 1: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/\u0022 title=\u0022Step 1: What do I need to know about GDPR?\u0022\u003EWhat do I need to know about GDPR\u003C/a\u003E \u2013 Introduction to GDPR and key terms to be aware of\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 2: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/\u0022 title=\u0022Step 2: Who is responsible for what?\u0022\u003EWho is responsible for what\u003C/a\u003E \u2013 Exploration of the roles within GDPR and what they mean\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 3:\u003C/strong\u003E\u0026nbsp;\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/\u0022 title=\u0022Step 3: Appointing a data protection lead\u0022\u003EAppointing a Data Lead\u003C/a\u003E \u2013 The benefits of a Data Lead\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 4:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/\u0022 title=\u0022Step 4: Understanding data subjects\u0022\u003EUnderstanding data subjects\u2019 rights\u003C/a\u003E \u2013 Exploring the rights of data subjects and how to respond to these rights\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 5: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/\u0022 title=\u0022Step 5: Gathering data\u0022\u003EGathering data\u003C/a\u003E \u2013 Examples and tooling for the creation of best practice surveys and forms\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 6:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/\u0022 title=\u0022Step 6: Data discovery\u0022\u003EData discovery\u003C/a\u003E \u2013 Exploring the data you have and how to look for it\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 7:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/\u0022 title=\u0022Step 7: Keep a record\u0022\u003EKeep a record\u003C/a\u003E \u2013 Recording the data you have and the processes you use to gather it\u0026nbsp;\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 8:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/\u0022 title=\u0022Step 8: Check your security\u0022\u003ECheck your security\u003C/a\u003E \u2013 Looking at the ways you can secure data and keeping a record of the security in place\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 9:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/\u0022 title=\u0022Step 9: Third parties\u0022\u003EThird parties\u003C/a\u003E \u2013 Discovering and recording the third parties you use\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 10:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/\u0022 title=\u0022Step 10: Publish your privacy stance\u0022\u003EPublish your privacy stance\u003C/a\u003E \u2013 Guidance on creating a data protection policy\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 11:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/\u0022 title=\u0022Step 11: Delete and destroy\u0022\u003EDelete and destroy\u003C/a\u003E \u2013 Making sure you only keep data as long as you need it and how you should get rid of it\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 12:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/\u0022 title=\u0022Step 12: Responding to a breach\u0022\u003EResponding to a breach\u003C/a\u003E \u2013 Understanding what a breach is and how to deal with it\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/11791/gdpr-alignment-checklist.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR alignment checklist\u0022\u003EGDPR Alignment Checklist\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/20753/gdpr-risk-register-2023.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR risk register\u0022\u003EGDPR Risk Register\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":null,"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","id":47216,"nodeName":"Introduction","title":"Introduction","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Introduction","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxNiJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/introduction/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThirty years ago, the world was a very different place. The reach of technology was limited, and the way organisations used and processed your personal data was very different to how they use it today.\u003C/p\u003E\n\u003Cp\u003EThe changes that have happened over the last two decades forced the European Union (EU) to review the old data legislation and bring it up to speed with the modern era. The EU\u2019s General Data Protection Regulation (GDPR) raised the standards for processing personal data, to strengthen and unify protection for individuals across the EU. The new legislation came into force in the UK on 25 May 2018.\u003C/p\u003E\n\u003Cp\u003ESince this date the UK has left the European Union as a Member State but has effectively adopted the GDPR as part of UK law. This has meant that the UK was subject to an adequacy review with the European Union to ensure that the residual Data Protection Act 2018 met the requirements of the GDPR. This was completed and the UK was granted Adequacy, meaning that the Data Protection Act 2018 was seen as an adequate legislation for EU data protection and the principles of the GDPR.\u003C/p\u003E\n\u003Cp\u003EScout Groups, Districts, Counties/Areas/Regions (Scotland), Countries (each known as \u2018Scout Units\u2019) and the Scouts UK Headquarters (\u2018UK HQ\u2019) collect and process lots of personal data on the young people, adult volunteers and staff. This could be anything from names, addresses, telephone numbers right through to more sensitive data such as religion, ethnicity and disabilities. As a result, it\u2019s important that all Scout Units and UK HQ are aware of the legislation and comply with it.\u003C/p\u003E\n\u003Cp\u003EThe Scout Unit Trustee Boards have responsibility for making sure that they comply with legal requirements, including data protection legislation.\u003C/p\u003E\n\u003Cp\u003ELocal Scout Units are generally exempt from having to register and pay for the ICO Data Protection Fee, this is due to each being a not-for-profit. However, if the local Scout Unit are using CCTV for crime prevention purposes, or is involved with personal data from outside the Scout Unit the registration and fee are applicable. \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee-self-assessment/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003ECheck out the assessment for measuring these criteria\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EThere are many key terms that are in the GDPR and used throughout this guidance:\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EPersonal data \u003C/strong\u003E\u2013 Any information that can be used to identify an individual. This information could be names, addresses, telephone numbers or more sensitive information such as religion, ethnicity and disabilities.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EData subject\u003C/strong\u003E \u2013 This is an individual. For Scout Units this could be young people, adult volunteers, parents and guardians and any staff employed locally.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EData controller\u003C/strong\u003E \u2013 This is the entity that determines the means and purpose of processing personal data. This is an organisation gathering, processing and retaining personal data, such as the local Scout Unit.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EData processor\u003C/strong\u003E \u2013 This is an organisation who processes the information on behalf of the data controller. This could be the provider of a membership platform, cloud service provider or event organiser.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003ELawful basis\u003C/strong\u003E \u2013 The legally justified reason for processing personal data, such as it being necessary to contact members about Scout affairs.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EProcessing activity\u003C/strong\u003E \u2013 Anything that you do with personal data, which may include the capture, storage, access, use, sharing and destruction.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003ESubject Rights Request (SRR)\u003C/strong\u003E \u2013 This is a request from an individual to the Scout Unit or UK HQ to find out what information you hold on them. They also have the right to request that you change or permanently remove any details that you hold on them.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EBreach\u003C/strong\u003E \u2013 This is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This could come from a hacker or physically losing files/folders.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EData Lead\u003C/strong\u003E \u2013 Accredited representative within a Scout Unit for data protection duties.\u003C/p\u003E\n\u003Cp\u003EAn \u003Ca href=\u0022/volunteers/learning-development-and-awards/learning/\u0022 title=\u0022Learning\u0022\u003EeLearning module\u003C/a\u003E is also available to support members.\u003C/p\u003E\n\u003Cp\u003EIn addition to the terms above the GDPR has a series of guiding principles at its core, these are as follows:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003ELawful\u003C/strong\u003E \u2013 the data processing is aligned to a lawful basis, such as legitimate interest, consent, performance of a contract etc.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EFairness\u003C/strong\u003E \u2013 would the data subject consider this processing activity fair?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ETransparency\u003C/strong\u003E \u2013 is it clear to the data subject what is happening with their personal data?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose\u003C/strong\u003E \u2013 can you explain the processing activity and is it justified?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimisation\u003C/strong\u003E \u2013 the data being processed is kept to the minimum required for the purpose\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EStorage limitation\u003C/strong\u003E - how long is the personal data required and can you justify this?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccuracy\u003C/strong\u003E \u2013 is the data accurate and up to date? Can it be updated going forward?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ESecure\u003C/strong\u003E \u2013 is the data secure in use, storage and transfer?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccountability\u003C/strong\u003E \u2013 the organisation that is subject to the GDPR needs to have systems in place to ensure compliance and be able to evidence it.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe below examples are scenarios that may exist at local Scouting level, these scenarios have been used to demonstrate some of the key terms in action:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":true,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EAdvertising for new members could include: events, email campaigns, canvassing.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EIt needs to be clear who you are marketing to and the lawful basis you are using as grounds to contact them. This needs to be evidenced as either:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EConsent \u2013 they opted-in\u003C/li\u003E\n\u003Cli\u003ENon-digital \u2013 physical event/canvassing\u003C/li\u003E\n\u003Cli\u003ELegitimate interest \u2013 your use of the data is necessary and is not overridden by their interests or fundamental rights. On balance, it\u2019s more positive for them than\u00A0\u003Cbr\u003Enegative.\u003C/li\u003E\n\u003Cli\u003EIt is important that the individual being contacted has an ability to opt out of the communication\u003C/li\u003E\n\u003C/ul\u003E","label":"Marketing"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EPotential new members and/or their parents or guardians communicate with you via:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EEmail or other electronic means\u003C/li\u003E\n\u003Cli\u003EFace-to-face\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EWhen communicating with a potential member, parent or guardian, they have usually enquired with you already giving you legitimate interest for the communications. Care needs to be taken to keep these communications private, especially when personal data is shared amongst groups.\u003C/p\u003E","label":"Want to join"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EThe Young Person/Adult Information Form is used to capture information about a young person or adult volunteer in order to begin the joining/appointment process, this could be via:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EEmail\u003C/li\u003E\n\u003Cli\u003EWeb form\u003C/li\u003E\n\u003Cli\u003EPaper form\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EThe Young Person/Adult Information Form may be the first data capture exercise for a new member.\u003C/p\u003E\n\u003Cp\u003EThe form must state:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe purpose\u003C/strong\u003E - What you are going to do with the form and the data.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ETimeframe\u003C/strong\u003E - How long you will hold onto the data (delete or securely destroy when\u00A0\u003Cbr\u003Eno longer required).\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe data collected must be:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimised\u003C/strong\u003E - It only includes what you need.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EKept secure\u003C/strong\u003E - Special care taken in storing.\u003C/li\u003E\n\u003C/ul\u003E","label":"Information forms"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EThe young person, parent/guardian or adult volunteer are now active within the\u0026nbsp;Scout Unit.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EThe young person, parent/guardian or volunteer\u2019s data will be stored in a filing system such as Excel sheets on local laptops, online record keeping systems and/or paper based records.\u003C/p\u003E\n\u003Cp\u003EDuring this period you need to consider:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThird parties that are holding data on your behalf, such as online record keeping systems or cloud storage systems.\u003C/li\u003E\n\u003Cli\u003EAccuracy of date. Is it kept up-to-date?\u003C/li\u003E\n\u003Cli\u003EData flows i.e. where is the data stored, how is it accessed and by who, and is the data\u0026nbsp;\u003Cbr\u003Eshared?\u003C/li\u003E\n\u003C/ul\u003E","label":"Active"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EScouting events are held frequently involving young people and adult volunteers.\u003C/p\u003E\n\u003Cp\u003EThese can be:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ESectional activities in a meeting place\u003C/li\u003E\n\u003Cli\u003EEvents or nights away\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThese events can require further data gathering, such as activity or nights away information and health forms completed by parents/guardians and adult volunteers.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EWhen further data gathering is being completed you need to consider:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose\u003C/strong\u003E \u2013 what are you going to do with it\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimisation\u003C/strong\u003E \u2013 it only includes what you need\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ERetention\u003C/strong\u003E \u2013 delete when no longer required\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ESecure\u003C/strong\u003E \u2013 special care taken in storing, and access only given to those who need it\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThis activity should consider what data you already have on file and only capture what is necessary.\u003C/p\u003E","label":"Events"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EYoung person and adult volunteer information may be collected as part of the joiners process. This may include:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EReligion\u003C/li\u003E\n\u003Cli\u003EEthnicity\u003C/li\u003E\n\u003Cli\u003EDisabilities\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003ECapturing and processing of personal data of any kind needs to be handled with care, especially with details considered sensitive, such as ethnicity, religion and disabilities.\u00A0\u003C/p\u003E\n\u003Cp\u003EIn all cases the purpose of the processing should be well understood and documented. The lawful basis required for processing special category data are different. Please view our\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/3lwkbh23/lawful-basis.pdf\u0022 target=\u0022_blank\u0022 title=\u0022Lawful basis guide\u0022\u003Eguide to Lawful Basis\u003C/a\u003E.\u003C/p\u003E","label":"Collection of sensitive (special category) data"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EAt every meeting or event, the leader in charge is obliged, for safety reasons to take a register of those attending the\u00A0session.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003ERegistration of those attending each meeting is good practice from a safety perspective.\u003C/p\u003E\n\u003Cp\u003EWhat this highlights is the importance of the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EAccurate data on members\u003C/li\u003E\n\u003Cli\u003EMaintaining a log of attendees but retaining a high level of data protection, such as the use of digital data as opposed to paper records and minimised data purely for attendance.\u003C/li\u003E\n\u003C/ul\u003E","label":"Register"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EA requirement of being an adult volunteer in Scouting is to keep young people, parents/guardians and other adult volunteers updated.\u003C/p\u003E\n\u003Cp\u003EThese are updates about weekly meetings, upcoming events and general Scout Unit news.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003ECommunication to the young people, parents/guardians or adult volunteers is essential for the effective operation of a Scout Unit. The GDPR recognises these types of communications and categorises them as necessary to fulfil your role.\u003C/p\u003E\n\u003Cp\u003EHowever, this communication should only be for the purposes of the Scout Unit and not for further advertising, unless the person receiving the communication has specifically opted-in.\u003C/p\u003E","label":"Communications"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EWhen a young person gets to a certain age, they go through the Moving On process to the next section. In most situations, they will have a new section leader. The young person can also leave Scouting at any point.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EWhen data is being transferred from one person (a Section Leader) to another, care needs to be taken in the transfer and receipt. In addition, the data being transferred needs to be accurate and minimised.\u003C/p\u003E\n\u003Cp\u003EIf at any time a young person wishes to leave Scouting, their data may need to be deleted fully if not required for further purposes.\u003C/p\u003E\n\u003Cp\u003EAll personal data should have a defined and appropriate retention period.\u003C/p\u003E","label":"Moving on"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EIt may occur that personal data is disclosed externally accidently or removed from the Scout Unit via malicious means.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EIn the event of a breach, via malicious means or through accidental disclosure/loss etc, the data controller (the Scout Unit) is obligated to do the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ERemediate the breach\u003C/li\u003E\n\u003Cli\u003EReport the breach to the data subject if deemed severe enough\u003C/li\u003E\n\u003Cli\u003EReport the breach to the ICO if deemed serious enough and within 72 hours of becoming aware of the breach\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EFor more information see \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/\u0022 title=\u0022Step 12: Responding to a breach\u0022\u003EStep 12: Responding to a breach\u003C/a\u003E.\u003C/p\u003E","label":"Data breach"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EIn the event that a member or parent/guardian asks for their data to be deleted, updated or provided to them as a copy, the data controller has 30 days to respond to the request\u00A0unless there are justified grounds to extend by a further 30 days or an exemption applies.\u003C/p\u003E\n\u003Cp\u003EThis is covered further in \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/\u0022 title=\u0022Step 4: Understanding data subjects\u0022\u003EStep 4: Understanding data subjects\u2019 rights\u003C/a\u003E\u003C/p\u003E","label":"Subject Access Request"}]},{"gridType":"RichTextBlock","content":"\u003Cp\u003E\u0026nbsp;\u0026nbsp;\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022/volunteers/learning-development-and-awards/learning/\u0022 title=\u0022Learning\u0022\u003EGDPR eLearning module\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee-self-assessment/\u0022 target=\u0022_blank\u0022 title=\u0022Self assessment on ICO website\u0022\u003ECheck if you\u0027re exempt from the ICO Data Protection Fee\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/3lwkbh23/lawful-basis.pdf\u0022 target=\u0022_blank\u0022 title=\u0022Lawful Basis PDF\u0022\u003EGuide to Lawful Basis PDF\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 1","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","id":47217,"nodeName":"Step 1: What do I need to know about data protection?","title":"Step 1: What do I need to know about data protection?","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 1: What do I need to know about data protection?","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxNyJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EScout Groups, Districts, Counties/Areas/Regions (Scotland) (each known as \u2018Scout Units\u2019)\u00A0are separate charities as is the Scouts UK Headquarters (\u2018UK HQ\u2019), as a national charity, with each accountable for their own compliance with the GDPR.\u003C/p\u003E\n\u003Cp\u003EResponsibility to be compliant with the GDPR rests with the respective Trustee Boards, and it\u2019s UK HQ\u2019s\u00A0intention to sign-post appropriate resources to support local Scout Units in fulfilling their\u00A0responsibility.\u003C/p\u003E\n\u003Cp\u003EEach adult member and associate member must also ensure that they\u00A0comply with data protection law when handling any personal data.\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch3\u003EData Controllers\u003C/h3\u003E\n\u003Cp\u003EA data controller is defined as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. This will be the local Scout Unit with accountability sitting with the Trustee Board.\u003C/p\u003E\n\u003Cp\u003EWith regard to personal data stored on the Adult Membership System, UK HQ and the Scout Units are independent Data Controllers. Independent Data Controllers may each use and access a shared database but each remains responsible for the personal data within its own control and capacity.\u003C/p\u003E\n\u003Cp\u003EAccordingly, Scout Units remain responsible for ensuring that their handling of personal data locally is in compliance with the GDPR and \u003Ca href=\u0022/por/\u0022 title=\u0022POR Rule Book\u0022\u003EPolicy, Organisation \u0026amp; Rules (POR)\u003C/a\u003E (which includes uploading and maintaining such data onto The Adult Membership System) and the UK HQ remains responsible for ensuring that its handling of personal data nationally is also in compliance with the GDPR and POR\u0026nbsp;(including its particular responsibilities for data held on the Adult Membership System).\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch3\u003EData Processors\u003C/h3\u003E\n\u003Cp\u003EA Data Processor is defined as a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.\u003C/p\u003E\n\u003Cp\u003EThis means that any service provider or third party that has access to personal data and processes it on behalf of the Data Controller, is a Data Processor.\u00A0This Data Processor could also be a third-party system used for data storage, such as an online youth membership system.\u003C/p\u003E\n\u003Cp\u003EIn summary a Data Processor is responsible for processing personal data on behalf of a controller, but the controller determines the reasons for the processing.\u003C/p\u003E","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","id":47218,"nodeName":"Step 2: Who is responsible for what?","title":"Step 2: Who is responsible for what?","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 2: Who is responsible for what?","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxOCJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EData protection can be complicated and does require some knowledge of the subject. It is advisable that the responsibility for leading on data protection is an individual that can act as a Data Lead. Anyone acting as a Data Lead is responsible for supporting the Scout Unit they are attached to.\u003C/p\u003E\n\u003Cp\u003EThe General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018) require several specific provisions to be in place for an organisation, which consider proactive and reactive data protection practices.\u003C/p\u003E\n\u003Cp\u003ETo assist an organisation in handling the responsibility for guidance and advice, emphasis has been placed on the Data Protection Officer (DPO) role. In some cases, \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/accountability-and-governance/data-protection-officers/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office\u0022\u003Ethis role is mandated by the Information Commissioner\u2019s Office (ICO)\u003C/a\u003E. This is when the data gathered and processed is sensitive in nature (special category) and \u2018large scale\u2019. Large scale is not defined but it\u2019s implied to be more than 50% of the total data held.\u003C/p\u003E\n\u003Cp\u003EIf the requirement for a DPO does not apply, it is still advisable to align the proactive and reactive duties of the role to a Data Lead, either an internal or external resource:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EProactive\u003C/h4\u003E\n\u003Cp\u003EThe proactive duties that should align to the GDPR and DPA 2018 legislation include:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EKeeping updated on data privacy legislation and any changes\u003C/li\u003E\n\u003Cli\u003EInforming the organisation and staff of updates to data privacy legislation\u003C/li\u003E\n\u003Cli\u003EAssessing risk for any significant projects/changes that may require Data Privacy Impact Assessments (DPIA) \u2013 risk assessment for any new or changed processing activity or system, a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r2nhpvr0/template-risk-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Risk Register template\u0022\u003Etemplate has been provided\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003EA record of processing (and data inventory document)\u003C/li\u003E\n\u003Cli\u003EAny other steps to accountability\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EReactive\u003C/h4\u003E\n\u003Cp\u003E\u003Cspan\u003EThe data protection lead has a requirement to be available in a reactive capacity for situations such as:\u003C/span\u003E\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EA breach incident, where a breach has occurred and needs to be assessed, managed and reported upon, including reporting to the ICO\u003C/li\u003E\n\u003Cli\u003ESubject Rights Request (SRR), where a request has been received from a data subject to do something with the data you hold on them (disclose, delete, rectify, etc.)\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIt is advisable that the individual who takes on the role:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EBe up-to-date with the GDPR and DPA 2018\u003C/li\u003E\n\u003Cli\u003EBe able to communicate with the organisation at the highest level\u003C/li\u003E\n\u003Cli\u003EWhere possible, be independent and impartial with no conflict of interests with the organisation\u003C/li\u003E\n\u003Cli\u003EHave a good understanding of the organisation\u0027s data processing activities\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EDue to the diverse skillset throughout the volunteer structure, it is advisable to look within the local Scout Units for anybody that can fulfil this function.\u003Cbr\u003E\u0026nbsp;\u003Cbr\u003EThere is an accreditation with associated training that assists individuals in becoming a Data Lead.\u003C/p\u003E\n\u003Cp\u003EMore information about this role can be found on our \u003Ca href=\u0022/volunteers/running-things-locally/tools-to-support-leadership-teams/how-teams-share-tasks/accreditations/leadership-team-accreditations/\u0022 title=\u0022Leadership Team Accreditations\u0022\u003ELeadership Team Accreditations page\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r2nhpvr0/template-risk-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Risk Register template\u0022\u003ERisk Register template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca href=\u0022/volunteers/running-things-locally/tools-to-support-leadership-teams/how-teams-share-tasks/accreditations/leadership-team-accreditations/\u0022 title=\u0022Leadership Team Accreditations\u0022\u003EMore information about the Data Lead role\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 3","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","id":47219,"nodeName":"Step 3: Appointing a Data Lead","title":"Step 3: Appointing a Data Lead","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 3: Appointing a Data Lead","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxOSJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EBy definition in the GDPR we are all known as data subjects. Data subjects have the right to object to how their personal data is processed.\u003C/p\u003E\n\u003Cp\u003EThey also have the right to request access, correct, sometimes delete and restrict the personal data being processed. In addition, they have a right to complain to you and to the Information Commissioner\u2019s Office (ICO). Details of how to complain to the ICO can be \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/make-a-complaint/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003Efound on their website\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EUnless subject to an exemption under the GDPR and DPA 2018, a data subject has the following rights with respect to their personal data:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to be informed\u003C/strong\u003E \u2013 they have the right to know how their data will be used by you, especially if this is changing\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to access their personal data\u003C/strong\u003E \u2013 they can ask you to share with them the data you have about them. This is a Subject Access Request and is explored further on this page.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to rectification\u003C/strong\u003E \u2013 this just means they can update their data if it\u2019s inaccurate or if something is missing. Adult members will be able to edit and update some information directly on the Adult Membership System.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to erasure\u003C/strong\u003E \u2013 this means that they have the right to request that you delete any personal data you have about them. You must consider these requests very carefully as so long as you have a sound legal basis for retaining the data you are unlikely to need to delete it, for example, some information will be processed for legal reasons.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to restrict processing\u003C/strong\u003E \u2013 if they think that you are not processing their data in line with your data protection policy then they have the right to request that you restrict any further use of that data until the issue is resolved.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to data portability\u003C/strong\u003E \u2013 this means that if they ask you to export their personal data then you will do so in a way that can be read digitally \u2013 such as a PDF. This makes it easier to share information with others.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to object\u003C/strong\u003E \u2013 they can object to the ways their data is being used.\u003C/li\u003E\n\u003Cli\u003ERights in relation to automated decision-making and profiling \u2013 this protects the data subject in cases where decisions are being made about them based entirely on automated processes rather than a human input. It\u2019s highly unlikely that this will be used by local Scouts.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch3\u003ESubject access requests\u003C/h3\u003E\n\u003Cp\u003EWith these extensive rights available to data subjects it is important that you have a process for responding to a request from the data subject on any of the above. By far the most common of these is a subject access request (SAR).\u003C/p\u003E\n\u003Cp\u003EThe response to the data subject needs to be within one month from receiving the request. This can be extended by up to two months, if the request is complex and cannot be completed in time, but notice must be given to the data subject on the extension and the reason why. Further information on this can be \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003Efound on the ICO website\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EThe following process can be used as guidance to manage such requests:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EApplication:\u003C/strong\u003E Data subject to provide request scope or complete \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/wchge450/template-subject-access-request-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Template Subject Access Request Form\u0022\u003ESAR Request Form.\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EIdentity Evidence:\u003C/strong\u003E You must be certain you are giving the data to the correct person. The best way to do this is to ask for identification such as current passport or driving licence.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ERequest Logged: \u003C/strong\u003EThe date by which the identification checks and the specification of the data sought must be recorded in a SAR Register.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EDiscovery:\u003C/strong\u003E The Trustee Board discovers all instances where the data subjects\u0027 personal data is present (within the scope of the request), the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Inventory template\u0022\u003EData Inventory\u003C/a\u003E will help guide this.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EResponse:\u003C/strong\u003E Trustee Board to respond to data subject in electronic format and response logged.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Data Inventory template","buttonLink":{"name":"Data Inventory template","id":null,"url":"https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EDiscovery\u003C/h4\u003E\n\u003Cp\u003EDiscovery will entail either:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ECollecting the data specified by the data subject as part of their defined scope, or\u003C/li\u003E\n\u003Cli\u003ESearching all databases and all relevant filing systems (manual files) in the Scout Unit.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIt is suggested that the Trustee Board maintains a data inventory that identifies where all data within the Scout Unit is stored to make it easier and quicker when undertaking searches.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EResponding to a Subject Access Request (SAR)\u003C/h4\u003E\n\u003Cp\u003EThe Trustee Board is responsible for reviewing all provided documents to identify whether any third parties are identified in it and for either omitting or redacting identifying third party information from the documentation or obtaining written consent from the third party for their identity to be revealed. Consideration must also be given to ensure that nobody is put at risk by disclosing information.\u003C/p\u003E\n\u003Cp\u003EThird party data that is commonly reviewed includes email exchanges and incident reports that involves multiple individuals. \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/advice-for-small-organisations/frequently-asked-questions/right-of-accesssubject-access-requests-and-other-rights/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003EDiscover further guidance from the ICO\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EAny data subject can request access to their personal data, including children. In the case of children\u2019s requests, it is important to assess the competency of that child to make this request. \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-of-access/#children\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022 data-anchor=\u0022#children\u0022\u003ECheck out further guidance on this\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EIf the requested data falls under one of the following exemptions, it does not have to be provided:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ECrime prevention and detection\u003C/li\u003E\n\u003Cli\u003ENegotiations with the requester\u003C/li\u003E\n\u003Cli\u003EInformation used for research, historical or statistical purposes\u003C/li\u003E\n\u003Cli\u003EInformation covered by legal professional privilege\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe information should be provided to the data subject in electronic format unless otherwise requested and all the items provided are listed on a schedule that shows the data subject\u2019s name and the date on which the information is delivered.\u003C/p\u003E\n\u003Cp\u003EIn all cases care should be taken to redact all personal data or confidential information that the data subject should not see.\u003C/p\u003E\n\u003Cp\u003ETo assist in maintaining a log of the Subject Rights Requests (SRR) received and manage their progress, an \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk//media/qb3a1gjy/template-subject-rights-request-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Subjects Rights Request Register\u0022\u003ESRR Register is available\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Subject Rights Request Register template","buttonLink":{"name":"Subject Rights Request Register template","id":null,"url":"https://prod-cms.scouts.org.uk/media/qb3a1gjy/template-subject-rights-request-register.xlsx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Cp\u003EIn addition to the register, the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/wchge450/template-subject-access-request-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Template Subject Access Request Form\u0022\u003ESAR Form\u003C/a\u003E can be used to formalise the SAR with the data subject. The template form can be amended for use with the other types of rights requests.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Subject Access Request Form template","buttonLink":{"name":"Template Subject Access Request Form","id":null,"url":"https://prod-cms.scouts.org.uk/media/wchge450/template-subject-access-request-form.docx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Inventory template\u0022\u003EData Inventory template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/qb3a1gjy/template-subject-rights-request-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Subject Rights Request Register template\u0022\u003ESubject Rights Request Register template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/wchge450/template-subject-access-request-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Subject Access Request Form template\u0022\u003ESubject Access Request Form template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 4","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","id":47220,"nodeName":"Step 4: Understanding data subjects\u0027 rights","title":"Step 4: Understanding data subjects\u0027 rights","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 4: Understanding data subjects\u0027 rights","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyMCJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EIn Scouting, there will be occasions where information from young people and their parents/guardians and adult volunteers will be required. Usually these will be ahead of events, camps or day trips or when a new member joins the Scouts. This page aims to provide you with some good practice guidance if you need to gather information.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Guidance on creating a data protection policy","buttonLink":{"name":"Guidance Template For Creating A Data Protection Policy","id":null,"url":"https://prod-cms.scouts.org.uk//media/gw5esqec/guidance-template-for-creating-a-data-protection-policy.doc","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhy do we need additional information?\u003C/h4\u003E\n\u003Cp\u003EBefore collecting any data on an individual, we need to remember the principles of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA):\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003ELawful\u003C/strong\u003E \u2013 the data processing is aligned to a lawful basis, such as legitimate interest, consent, performance of a contract etc.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EFairness\u003C/strong\u003E \u2013 would the data subject consider this processing activity fair?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ETransparency \u003C/strong\u003E\u2013 is it clear to the data subject what is happening with their personal data?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose\u003C/strong\u003E \u2013 can you explain the processing activity and is it justified?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimisation\u003C/strong\u003E \u2013 the data being processed is kept to the minimum required for the purpose\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EStorage limitation\u003C/strong\u003E - how long is the personal data required and can you justify this?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccurate \u003C/strong\u003E- is the data accurate and up to date? Can it be updated going forward?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ESecure \u003C/strong\u003E- is the data secure in use, storage and transfer?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccountability\u003C/strong\u003E \u2013 the organisation that is subject to the GDPR needs to have systems in place to ensure compliance and be able to evidence it.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAs part of the principles of purpose and minimisation, it\u2019s good to think about the information you may have already collected before asking for more. It\u2019s likely that you\u2019ll already hold a lot of information from when the young person or adult volunteer joined Scouting and therefore there is no requirement to gather it again. You\u2019ll then only be asking for limited information for each event.\u003C/p\u003E\n\u003Cp\u003EThat said, you have a valid reason for asking for some information again as it is an obligation of your Trustee Board that the data held is accurate and it may have changed, or be very specific for that event, for example an emergency contact may be a grandparent rather than the parent because the parents may be going away at the same time as your week-long summer camp.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EKeep things to a minimum\u003C/h4\u003E\n\u003Cp\u003EWhen designing your form, try to avoid collecting unnecessary data. For example you do not need to know if the young person can swim, if your event will not include any water activities in its programme. This can usually be a symptom of reusing forms and each form should be considered against its own purpose.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003ELayout of the form\u003C/h4\u003E\n\u003Cp\u003EOften forms will be designed based on the need of the event or as you think of things to include on the form. It\u2019s worth taking a moment to think about the information you are collecting so that you can order it and maybe batch different kinds of information together.\u003C/p\u003E\n\u003Cp\u003EFor example, keeping names and contact details together. Keeping sensitive (special category) data together, such as medical details, will help the individual competing the form to follow its logic and for you to provide them with further description on the sections, if required. Where sensitive data is being gathered it is good practice to include a brief section explainer text so it\u2019s clear on the specific purpose for gathering it.\u003C/p\u003E\n\u003Cp\u003EWhere a form is capturing personal and/or sensitive personal data, you should include a Privacy Statement to assist in providing transparency for the individual completing the form. This should ideally be positioned at the top or bottom or top of a form so it\u2019s visible and read.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EPrivacy Statement\u003C/h4\u003E\n\u003Cp\u003EA Privacy Statement is required to provide the necessary transparency to the data subject and must include some basic detail, such as;\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe type of data being collected\u003C/li\u003E\n\u003Cli\u003EWhy the information is being collected\u003C/li\u003E\n\u003Cli\u003EWhere the information will be stored\u003C/li\u003E\n\u003Cli\u003EDetails of who will have access to the information\u003C/li\u003E\n\u003Cli\u003EA time period for when you will destroy the information\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EYou should also include a link to the Scout Unit\u0027s agreed and published Data Protection/Privacy Policy.\u003C/p\u003E\n\u003Cp\u003EThe statement must be written in clear and simple language so that it is easy to understand by the individual completing your form.\u003C/p\u003E\n\u003Cp\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/co3jljdz/template-privacy-statement.docx\u0022 target=\u0022_blank\u0022 title=\u0022Template privacy statement\u0022\u003ECheck out our tool to help you create your privacy statement\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Privacy Statement template","buttonLink":{"name":"Template Privacy Statement","id":null,"url":"https://prod-cms.scouts.org.uk//media/co3jljdz/template-privacy-statement.docx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EConsent\u003C/h4\u003E\n\u003Cp\u003EConsent is a lawful basis for processing data and can only be presented as a choice, yes or no. This means that consent should only be used where necessary and where another lawful basis for processing does not exist.\u003C/p\u003E\n\u003Cp\u003EThere will be certain information, or conditions which require specific consent to be given. This will include, but is not limited to:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ESensitive personal data where it is to be passed to a third party, such as when capturing registrations for an event and passing this data to an organisation assisting with that event\u003C/li\u003E\n\u003Cli\u003EAsking to use an image or video of someone\u003C/li\u003E\n\u003Cli\u003EUsing data for a different reason than the initial purpose it was collected\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe data subject will need to tick a box or sign their name to provide their consent. Implied or pre-filled boxes are not allowed, you need to be able to evidence that the data subject affirmatively gave their consent. Asking for consent for other information does come with the risk that consent can be retracted at any point, possibly making the organisation of an event harder.\u003C/p\u003E\n\u003Cp\u003ETake a look at an example of seeking consent:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"imageWithLink","gtmId":"","gtmClass":"","image":"/media/vt3kzwoh/consent-box.png","width":1413,"height":182,"altText":"An example of a consent box for gathering personal data.","caption":"","link":{"name":"Consent box example","id":null,"url":"https://prod-cms.scouts.org.uk/media/vt3kzwoh/consent-box.png","newWindow":false,"target":"_blank"}},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EAdult and young people data \u2013 is there any difference?\u003C/h4\u003E\n\u003Cp\u003EFundamentally, there is no difference between adult and young people data. The processing of young people data should come with an extra layer of due diligence to ensure its processing is absolutely necessary and that the security of that data is appropriate.\u003C/p\u003E\n\u003Cp\u003EWhile a data breach or loss of any data is serious, a breach or loss of young people\u2019s data comes with a potential for greater reputational damage which could jeopardise the future of scouting not just locally, but nationally as well.\u003C/p\u003E\n\u003Cp\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/using-childrens-information-a-guide/\u0022 target=\u0022_blank\u0022 title=\u0022Using children\u0027s information on the ICO website\u0022\u003EThe ICO have produced specific guidance on Young Person\u2019s data\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhat you do with the information when collected?\u003C/h4\u003E\n\u003Cp\u003EWhen your completed form is returned you need to think about where the information is stored and who will have access to it.\u003C/p\u003E\n\u003Cp\u003EIf your form is on paper, you will usually need to transfer the information to a spreadsheet or other digital system. Make sure you transfer the data accurately. Think where this electronic record is then saved and if you need to password protect it. You may be required to print off the spreadsheet to take with you on an event. You\u2019ll need to consider how many copies you print off and who will have access to them \u2013 keep this to a minimum where possible. If you\u2019re sharing the sheets with other Leaders, ensure you know how many copies you have made and that you are able to collect these back in at the end of the event.\u003C/p\u003E\n\u003Cp\u003EIf you\u2019re using an electronic collection method, where will the data actually be stored? Is this within the UK or within Europe? If not, you may wish to think about the provider you are using, as data stored outside of Europe will require an appropriate safeguard for that\u0026nbsp;data transfer. You can \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/\u0022 target=\u0022_blank\u0022 title=\u0022Guide to international transfers\u0022\u003Echeck out a list of countries currently considered adequate for data transfer, without additional safeguards, on the ICO website\u003C/a\u003E. Most service providers will publish this information on their websites, such as Google and Microsoft, however you may need to look or actually contact the company to ask them before using their service.\u003C/p\u003E\n\u003Cp\u003ELike the paper copies, you\u2019ll also need to ensure there\u2019s a privacy statement on the form and that you are able to delete the data when it\u2019s no longer required. Paper forms will need to be securely destroyed when not needed any more. One way would be to shred the paper forms.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003ERetention Period\u003C/h4\u003E\n\u003Cp\u003EThe period of time that you will need to keep the information following an event will vary depending on the type of data you have collected, and the possible reasons for keeping it. You will also need to refer back to any retention policy set by your Trustee Board.\u003C/p\u003E\n\u003Cp\u003EIt\u0027s good practice to delete data when not required any further, even if this falls inside your retention period set. In some cases, data may need to be kept longer than the retention period for analytical or statistical purposes, in most cases this won\u2019t require the personal data to be present and should be anonymised as soon as possible.\u003C/p\u003E\n\u003Cp\u003EWe\u0027ve created a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk//media/bufdptx1/data-retention-policy-template.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Retention Policy Template\u0022\u003ETemplate Data Retention Policy\u003C/a\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022\u0022 target=\u0022_blank\u0022 title=\u0022Template Data Retention Policy\u0022\u003E\u003C/a\u003E, which contains real Scouting examples. This has been created using a combination of the \u003Ca href=\u0022/about-us/policy/data-retention-policy/\u0022 title=\u0022Data Retention Policy\u0022\u003EUK HQ Data Retention Policy\u003C/a\u003E and examples from local Scouting. This template can be used by a local Scout Unit but may need tailoring to suit local processing activities.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Data Retention Policy template","buttonLink":{"name":"Data Retention Policy Template","id":null,"url":"https://prod-cms.scouts.org.uk//media/bufdptx1/data-retention-policy-template.docx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/gw5esqec/guidance-template-for-creating-a-data-protection-policy.doc\u0022 target=\u0022_blank\u0022 title=\u0022Data Protection Policy guidance\u0022\u003EGuidance on creating a data protection policy\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/co3jljdz/template-privacy-statement.docx\u0022 target=\u0022_blank\u0022 title=\u0022Privacy statement template\u0022\u003EPrivacy Statement template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/bufdptx1/data-retention-policy-template.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Retention Policy template\u0022\u003EData Retention Policy template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 5","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","id":47222,"nodeName":"Step 5: Gathering data","title":"Step 5: Gathering data","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 5: Gathering data","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyMiJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EWhen it comes to the protection of data you first need to understand what data you have and where it is.\u003C/p\u003E\n\u003Cp\u003EAs part of local Scouting, sensitive personal data (also known as special category data) is gathered, processed and transferred frequently. For example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ENew joiner details for either an adult volunteer or a young person\u003C/li\u003E\n\u003Cli\u003EProcessing of this data for the purposes of events, awards, moving on\u003C/li\u003E\n\u003Cli\u003EAnnual reviews of this data through Census (even though this is provided to UK HQ anonymously) or further data gathering to update medical records\u003C/li\u003E\n\u003Cli\u003EManagement of safeguarding incidents where data needs to be transferred to UK HQ for assistance\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EConsideration needs to be made when collecting, managing and transferring the data required to operate Scouting locally.\u003C/p\u003E\n\u003Cp\u003EThis can be broken down into simple questions to ask yourself:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhat?\u003C/h4\u003E\n\u003Cp\u003EWhat data am I collecting on the adult volunteers and youth members? Do I know the details I am asking the individuals to give me? This could be details such as:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EName\u003C/li\u003E\n\u003Cli\u003EAddress\u003C/li\u003E\n\u003Cli\u003EEmail address\u003C/li\u003E\n\u003Cli\u003EDate of birth\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThese data types are known as personal data, this becomes sensitive personal data when you add information such as:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ERace\u003C/li\u003E\n\u003Cli\u003EEthnic origin\u003C/li\u003E\n\u003Cli\u003EReligion\u003C/li\u003E\n\u003Cli\u003EHealth conditions\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe data being gathered and processed should only be the data necessary and be as minimal as possible. Asking for something you don\u2019t need is not justified.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhy?\u003C/h4\u003E\n\u003Cp\u003EWhy am I collecting the data? Can I determine a reason for this data collection and use, and does that align with the lawful purposes as defined by the GDPR? For example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe collection of young people\u2019s medical records is necessary for the protection of that young person whilst in the care of the Scout Group giving a legitimate reason to do so, but medical records are sensitive personal data (special category) and if they are required to be passed to a third party then they should only be gathered using consent, or if someone\u2019s life is at risk.\u003C/li\u003E\n\u003Cli\u003EThe collection of young people\u2019s religion may be necessary to respect their beliefs in regard to activities, food and holidays, but ethnicity and religious records are sensitive personal data (special category).\u003C/li\u003E\n\u003Cli\u003EThe collection of adult volunteers\u2019 personal data is necessary for the purposes of disclosure checks and safeguarding.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf you can\u2019t justify the reason behind the gathering or use of a certain type of personal or sensitive personal data (special category), then you shouldn\u2019t. This guidance will come from your Trustee Board.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EHow?\u003C/h4\u003E\n\u003Cp\u003EThere are many means by which you can gather and use data, this is explored further in \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/\u0022 title=\u0022Step 7: Keep a record\u0022\u003EStep 7: Keep a record\u003C/a\u003E. However the key question is; how am I collecting the data and how am I using it?\u003C/p\u003E\n\u003Cp\u003EThe consideration needs to be whether you can demonstrate that you have thought the process through and used all means available to collect, process and store data in the most appropriate way.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhen?\u003C/h4\u003E\n\u003Cp\u003EWhen should I delete the data I hold? Whilst the use of the data is required for the provision of local Scouting operations, the longer-term retention needs to be justified. For example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe young person\u2019s awards records are retained for a defined period when they leave in case they wanted to return and continue.\u003C/li\u003E\n\u003Cli\u003EAdult volunteer data is retained for a defined period post leaving for the purposes of ongoing handover of the appointment.\u003C/li\u003E\n\u003Cli\u003EGift Aid data needs to be retained for seven years to meet audit requirements by HMRC.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf justification cannot be made for the retention of data, then it should be securely deleted at the point it is no longer required. More information on this can be found in \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/\u0022 title=\u0022Step 11: Delete and destroy\u0022\u003EStep 11: Delete and destroy\u003C/a\u003E, which provides further guidance on retention periods and the secure destruction of data.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWho?\u003C/h4\u003E\n\u003Cp\u003EWho can access the data? This access could be via memberships systems, paper records or via email. In all cases the access to this data needs to be minimised to only who needs it and, if possible, only the subset of data they need, for example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe Group Scout Leader and Section Leader will require access to data for the young people and adult volunteers in their Group.\u003C/li\u003E\n\u003Cli\u003EAdult volunteers may require access to the data of the young people but potentially not to the other adult volunteers in their Scout Group.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf any of the above are in doubt, then please refer to your Trustee Board for guidance. The questions above should be asked to assist in the protection of personal and sensitive personal data, in the case of local Scouting, this is young people\u2019s data and duty of care should be considered.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhere?\u003C/h4\u003E\n\u003Cp\u003EThere are many places this data can be stored, and these will normally be chosen based on ease of use or what you are used to using. Where do you store the data you have for local Scouting? Consideration needs to be made as to where the data is stored such as:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIs the storage system secure and safe?\u003C/li\u003E\n\u003Cli\u003EWho needs access to the system and can we easily collaborate?\u003C/li\u003E\n\u003Cli\u003ECan I trace access to the storage location and minimise where necessary?\u003C/li\u003E\n\u003Cli\u003EIs there a reputable system available today that I can use, such as secure cloud storage or an online membership system?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAll of the above questions help in constructing an appropriate data protection policy where you are capturing data. \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/\u0022 title=\u0022Step 10: Publish your privacy stance\u0022\u003EStep 10: Publish your privacy stance\u003C/a\u003E explores this further.\u003C/p\u003E","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","id":47223,"nodeName":"Step 6: Data discovery","title":"Step 6: Data discovery","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 6: Data discovery","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyMyJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EOnce the data in use and the processes for gathering the data are understood, there is a requirement to keep a record of these. The GDPR introduces a key principle for organisations to be accountable for their data processing activities. This means that it is essential to have this detail captured in a processing register.\u003C/p\u003E\n\u003Cp\u003EThe processing of personal data is the activity where you gather, transfer or do something with the data, such as events registration, passing this data to the event facility and contacting the registrants with detail of the event.\u003C/p\u003E\n\u003Cp\u003EThe \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Inventory template\u0022\u003ETemplate Data Inventory\u003C/a\u003E is available for use by Trustee Boards to capture this detail.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Data Inventory template","buttonLink":{"name":"Template Data Inventory","id":null,"url":"https://prod-cms.scouts.org.uk//media/nizfq205/template-data-inventory.xlsx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Cp\u003EWhen recording the processing activities, it is key to align each of these to a pre-defined justified purpose, known as the lawful basis for processing. There are 6 of these that align to personal data (name, address, email etc.) and eleven for sensitive (special category) data (ethic origin, medical conditions etc.).\u003C/p\u003E\n\u003Cp\u003EThere are a number of these, however it will usually materialise that only a few will be required. Here are some examples of these:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EPersonal data\u003C/h4\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EConsent of the data subject:\u003C/strong\u003E Should be used for communications preferences or consent for the use of photographic images (however legitimate interest may also be appropriate for photography, \u003Ca href=\u0022/volunteers/staying-safe-and-safeguarding/safeguarding-in-the-programme/recording-at-scout-events/\u0022 title=\u0022Photography, video and audio recording at Scout events\u0022\u003Echeck out further guidance\u003C/a\u003E).\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing is necessary for the performance of a contract:\u003C/strong\u003E Should be used for the personal data gathered and processed as part of a member joining.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing is necessary for compliance with a legal obligation:\u003C/strong\u003E Should be used for the retention of records as part of accident reporting.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ENecessary for the purposes of legitimate interests pursued by the controller or a third party:\u003C/strong\u003E Should be used for the passing of a waiting list from one local Scout Group to another, this is for personal data only (name, address, email etc.).\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing is necessary to protect the vital interests of the data subject or of another natural person:\u003C/strong\u003E Should be used when passing personal data of a Scout member to paramedics, or other healthcare professional, when they are administering care to them, such as their name and address. This should be used in conjunction with the special category condition for vital interests. When sensitive data is also required to be disclosed, consent is not required.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003ESensitive (special category data)\u003C/h4\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EExplicit consent of the data subject:\u003C/strong\u003E Should be used if you are required to transfer the data to a third party, such as for an event.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing is necessary to protect the vital interests of a data subject:\u003C/strong\u003E Should be used in an emergency situation where you need to pass data to a medical professional.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided the processing relates only to members or former members:\u003C/strong\u003E Should be used for the sensitive (special category) data gathered and processed as part of a joining member or event registration, where the data is not passed on to a third party.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhen choosing the lawful basis behind the processing activity it is worth noting that consent allows the data subject to rescind their permission for the processing activity. In addition, if legitimate interest is chosen you should consider that the data subject can challenge your purpose and justification. It\u0027s good practice to offer a process for opting out of the activity, such as email communications. Check out the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/3lwkbh23/lawful-basis.pdf\u0022 target=\u0022_blank\u0022 title=\u0022Lawful basis\u0022\u003Efull list of lawful basis\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EIf legitimate interest is the chosen lawful basis for processing, then it is important to maintain a record of this activity. It is also important that the record shows how the decision was made and that the legitimate interest balances between the organisations purpose and the rights to freedom of the data subject. To assist, you can use our \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/n3umcwxn/template-legitimate-interest-assessment.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Legitimate Interest Assessment\u0022\u003ELegitimate Interest Assessment\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EPhotographs, film and audio recordings\u003C/h4\u003E\n\u003Cp\u003E\u003Ca href=\u0022/volunteers/staying-safe-and-safeguarding/safeguarding-in-the-programme/recording-at-scout-events/\u0022 title=\u0022Photography, video and audio recording at Scout events\u0022\u003ERead our guidance regarding the use of photographs, film and audio recordings\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Inventory template\u0022\u003EData Inventory template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/3lwkbh23/lawful-basis.pdf\u0022 target=\u0022_blank\u0022 title=\u0022Lawful Basis\u0022\u003EList of Lawful Basis\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/n3umcwxn/template-legitimate-interest-assessment.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Legitimate Interest assessment tool\u0022\u003ELegitimate Interest Assessment Tool\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 7","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","id":47224,"nodeName":"Step 7: Keep a record","title":"Step 7: Keep a record","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 7: Keep a record","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyNCJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EToday\u2019s technology age means that there are many tools available to us all when it comes to the management of our day-to-day jobs and activities.\u003C/p\u003E\n\u003Cp\u003EThis situation exists within local Scouting and in most cases, you will opt to use the tooling you are familiar with or makes your operation as easy as possible. The below guidance draws out these technologies and provides guidance on the security measures that should be considered:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EPaper\u003C/h4\u003E\n\u003Cp\u003EWhilst not strictly a technology, paper is still used to capture and retain data. This is the case within Scouting and as such needs to be considered, for example paper-based records could exist for the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ENew joiners form\u003C/li\u003E\n\u003Cli\u003ENew joiners waiting lists\u003C/li\u003E\n\u003Cli\u003EEvents consent from parents\u003C/li\u003E\n\u003Cli\u003EAnnual health records updates\u003C/li\u003E\n\u003Cli\u003EEvents coordination with events companies\u003C/li\u003E\n\u003Cli\u003EAward notifications/nominations\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe following should be considered when using paper:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ENot digitally searchable \u2013 not easy to find specific information\u003C/li\u003E\n\u003Cli\u003EIf lost or damaged it\u2019s not recoverable\u003C/li\u003E\n\u003Cli\u003ENot easy to transfer\u003C/li\u003E\n\u003Cli\u003EProne to error or misinterpretation\u003C/li\u003E\n\u003Cli\u003ERequires physical storage and security\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIn some cases, paper-based records are justified or are the only means of data capture, where this is the case then duty of care needs to be considered, such as:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EMinimise the use of paper to only what is required.\u003C/li\u003E\n\u003Cli\u003ETransfer of paper is secure, such as physical hand-to-hand transfer or registered post.\u003C/li\u003E\n\u003Cli\u003EPaper forms are securely destroyed after use, if possible.\u003C/li\u003E\n\u003Cli\u003ESecure destruction should be through a shredding machine.\u003C/li\u003E\n\u003Cli\u003EKeep the paper records secure always, especially when in transit, consider using:\n\u003Cul\u003E\n\u003Cli\u003EA lockable brief case.\u003C/li\u003E\n\u003Cli\u003EA lockable filing cabinet if long term stored.\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EIf transferred to somebody, audit that they return them when complete.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EPaper should be considered transient wherever possible and not for longer-term storage, meaning that the data should ideally be transferred as soon as possible to a digital system and then the paper medium securely destroyed.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EDigital forms\u003C/h4\u003E\n\u003Cp\u003EDigital forms offer the ability to capture data in a digital means via a website link. The form is presented to the person entering the details as designed by yourself.\u003C/p\u003E\n\u003Cp\u003EThe following should be considered when using web forms/online surveys:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EDigital forms can be from your own website, online survey tool or a membership database.\u003C/li\u003E\n\u003Cli\u003EDigital forms are widely used and accepted as means of gathering data.\u003C/li\u003E\n\u003Cli\u003EThey need to be carefully created to capture only the data required and offer a clear capture flow, see \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/\u0022 title=\u0022Step 5: Gathering data\u0022\u003EStep 5: Gathering data\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003EDigital forms reduce mistakes of data capture.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhere web forms or digital surveys are being used the following best practices should be considered:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe presentation of the form is easy to understand and follow.\u003C/li\u003E\n\u003Cli\u003EThe form itself is using a secure transfer mechanism, the link to it should start with \u2018HTTPS://\u2019.\u003C/li\u003E\n\u003Cli\u003EYou understand how the data is used after the form is completed, is it emailed to yourself, is it retained within a database where the form is located?\u003C/li\u003E\n\u003Cli\u003EIf the detail is emailed to yourself post it being completed, this email should be treated with care and deleted when not required any further.\u003C/li\u003E\n\u003Cli\u003EIf the data is retained in a forms database, then ensure access to this database is protected by a strong username and password and the access to it is limited to only those that require the data.\u003C/li\u003E\n\u003Cli\u003EDelete any data that is not needed from the locations it is stored.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EDigital forms are a good way to gather accurate data in a secure way.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EE-Mail\u003C/h4\u003E\n\u003Cp\u003EThe most common communication tool used today is e-mail. This can be either personal or corporate e-mail from a large variety of providers. E-mail is used commonly to transfer all types of data and can be used to transfer documents with information in or the data directly in the body of the e-mail itself. It is worth being aware that 85% of all reported data breaches in the UK come from sending e-mail to the wrong recipient.\u003C/p\u003E\n\u003Cp\u003EThe following should be considered when using e-mail to gather or transfer data:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EE-mails are sent in clear text, this means that if they are intercepted the contents can be read.\u003C/li\u003E\n\u003Cli\u003EMost e-mail systems retain lots of copies of the data sent and received, for example in:\n\u003Cul\u003E\n\u003Cli\u003EInbox folder\u003C/li\u003E\n\u003Cli\u003ESent items folder\u003C/li\u003E\n\u003Cli\u003EDeleted folder\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EIt is easy to mistype an e-mail address or select an incorrect pre-populated address.\u003C/li\u003E\n\u003Cli\u003EThe security of an e-mail system varies depending on the service provided.\u003C/li\u003E\n\u003Cli\u003EE-mails can be stored locally on your laptop/desktop.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhere e-mail is being used the following best practices should be considered:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EFree e-mail services generally lack a level of security appropriate for sending lots of sensitive personal data.\u003C/li\u003E\n\u003Cli\u003EReview the e-mail service you have; good service add-ons include:\n\u003Cul\u003E\n\u003Cli\u003EAnti-virus scanning\u003C/li\u003E\n\u003Cli\u003EAnti-malware scanning\u003C/li\u003E\n\u003Cli\u003EEncrypted e-mail\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EDelete e-mails when they are no longer required, especially if they contain data within attachments, this should be from the folders highlighted above.\u003C/li\u003E\n\u003Cli\u003EAdd a delay to the sending of your e-mails by 2 minutes. Most email clients allow this as a \u2018Rule\u2019, any mis-typed email can then be stopped before it leaves.\u003C/li\u003E\n\u003Cli\u003EDon\u2019t store your e-mails locally on your laptop/desktop to minimise the data you store.\u003C/li\u003E\n\u003Cli\u003EMinimise the use of e-mail to what is necessary when it comes to gathering or transferring data.\u003C/li\u003E\n\u003Cli\u003ETake care when replying to all in the email chain, you may not want all email participants to be part of any ongoing communications.\u003C/li\u003E\n\u003Cli\u003EIf you are looking to email multiple individuals and don\u2019t want everybody to see the email addresses on the distribution list, then simply add all of their email addresses to the \u2018BCC\u2019 field. You can then add your own email address in the \u2018TO\u2019 field, this will mask all addresses except yours.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAdditionally, e-mail mass mailers may be used to communicate with members for group updates, events and other operational means. When looking at a service like this you should consider the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIs the service with a reputable provider?\u003C/li\u003E\n\u003Cli\u003EDoes that provider align to the GDPR?\u003C/li\u003E\n\u003Cli\u003EIs the data set you are providing minimised to only what is required?\u003C/li\u003E\n\u003Cli\u003EDoes the data get stored with the provider, if so, can you delete it when finished with?\u003C/li\u003E\n\u003Cli\u003EE-mail is an effective way to communicate but can lead to lots of data across lots of folders.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003ELaptop/Desktop/Tablet\u003C/h4\u003E\n\u003Cp\u003ELaptops/desktops/tablets are common place in most households as well as in people\u2019s place of work. As volunteers within the Scouts you will probably have access to or be using this type of technology to manage the operations for local Scouting.\u003C/p\u003E\n\u003Cp\u003ESecurity of laptops/desktops/tablets is key when gathering/storing or transferring data, the security already in place for the physical device could vary depending on whether this is company or personal asset and your line of work.\u003C/p\u003E\n\u003Cp\u003EThe following should be considered when using a laptop/desktop/tablet to gather, store or transfer data:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIs the laptop/desktop/tablet a shared resource?\u003C/li\u003E\n\u003Cli\u003EWho owns the laptop/desktop/tablet and is ultimately responsible for it?\u003C/li\u003E\n\u003Cli\u003EHow is the laptop/desktop/tablet to be used?\u003C/li\u003E\n\u003Cli\u003EIs data stored locally on the device or is it located within an online system?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhere a laptop/desktop/tablet is being used, the following best practices should be considered:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe laptop/desktop/tablet is protected by a username and strong password, strong is defined as:\n\u003Cul\u003E\n\u003Cli\u003EConsists of at least eight characters.\u003C/li\u003E\n\u003Cli\u003ECombination of letters, numbers and symbols (@, #, $, %, etc.).\u003C/li\u003E\n\u003Cli\u003EContains letters in both uppercase and lowercase.\u003C/li\u003E\n\u003Cli\u003EDoes not include whole words that are unique to you.\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EThe laptop/desktop/tablet includes hard disk encryption \u2013 Check your operating system provider and search for options of hard disk encryption.\u003C/li\u003E\n\u003Cli\u003ESoftware packages such as anti-virus and anti-malware are included.\u003C/li\u003E\n\u003Cli\u003ESoftware on the laptop/desktop/tablet is up-to-date.\u003C/li\u003E\n\u003Cli\u003EImplement a digital password safe to store all passwords you must remember, there are many free tools available.\u003C/li\u003E\n\u003Cli\u003EStorage of data locally is minimised to only what is required.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003ELaptops especially are very useful for mobile management of local Scouting, but the mobile element introduces a loss or theft risk. Reduce the exposure by considering the measures above.\u003C/p\u003E\n\u003Cp\u003EIn addition to this guidance there is a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nlvjckjg/template-data-security-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Template Data Security Register\u0022\u003ETemplate Data Security Register\u003C/a\u003E that you can use to help maintain a list of the types of media used in local Scouting. This register can also act as a risk register for any media types that need to be reviewed or tracked as a risk.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nlvjckjg/template-data-security-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Security template\u0022\u003EData Security Register template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 8","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","id":47225,"nodeName":"Step 8: Check your security","title":"Step 8: Check your security","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 8: Check your security","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyNSJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThe operation of a local Scout Group, District, County/Area/Region (Scotland) or Country (collectively known as \u2018Scout Units\u2019) will inevitably involve the services of other organisations or companies. In the case where these parties process the personal data you control on your behalf, they are known as third party data processors.\u003C/p\u003E\n\u003Cp\u003EIn the first instance you should discover all third parties your local Scout Unit Country are working with. During this process it is important to understand the type of relationship you have with the third party, these can be broken down as follows:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EData controller to data processor, whereby the data controller enlists the services of the data processor to process data on their behalf\u003C/li\u003E\n\u003Cli\u003EData controller to data controller, where both independently determine the purpose for processing but there is a transfer of data between them\u003C/li\u003E\n\u003Cli\u003EJoint data controllers would be acting together to decide the purposes and manner of data processing\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIn all cases it is advisable to have at least an agreement in place between you. The type of agreement is dependent on the relationship;\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EData controller to data processor \u2013 requires a formal data processing agreement \u2013 \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/\u0022 target=\u0022_blank\u0022 title=\u0022ICO contracts guidance\u0022\u003EICO guidance has more information\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003EData controller to data controller \u2013 it is advisable to have a documented agreement or arrangement between them. This could be based on both having GDPR aligned privacy notices\u003C/li\u003E\n\u003Cli\u003EJoint data controllers - required to have a documented agreement or arrangement between them that determines each other\u2019s responsibilities\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EHere are examples of Scouting scenarios:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EData controller to data processor \u2013 Local Scout Unit to third party platform provider, such as Google (Google Suite) or Microsoft (Office 365)\u003C/li\u003E\n\u003Cli\u003EData controller to data controller - Local Scout Unit to - an event organising company, that require participants data to manage event activities\u003C/li\u003E\n\u003Cli\u003EJoint data controllers \u2013 Unlikely to be used within Scouting, but an example could be a Scout Group working with another Scout Group on an event whereby both are equally responsible for administering a joint participant database.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIt is advisable to maintain a record of all third-party relationships and to demonstrate that relationships align with the controls of the GDPR.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EThird party due diligence\u003C/h4\u003E\n\u003Cp\u003EThe procurement of new services or renewing of existing services with third parties should be completed with an appropriate level of due diligence.\u003C/p\u003E\n\u003Cp\u003EWhen considering a third party for the provision of a service the following criteria can be used as a guideline to reduce the risk involved with using this third party:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe reputation of this third party\u003C/li\u003E\n\u003Cli\u003EThe location of the third party and their service (when the data is classified as personal data this should ideally be in the UK, the European Economic Area, or an adequate country. Alternatively, there must be an appropriate and EU Commission recognised safeguard in place, see the section below on Adequacy.\u003C/li\u003E\n\u003Cli\u003EThe standards the third party measure themselves by, such as:\n\u003Cul\u003E\n\u003Cli\u003EISO 27001\u003C/li\u003E\n\u003Cli\u003EISO 27018\u003C/li\u003E\n\u003Cli\u003EISO 27701\u003C/li\u003E\n\u003Cli\u003EISO 9001\u003C/li\u003E\n\u003Cli\u003EPCI DSS\u003C/li\u003E\n\u003Cli\u003ESOC II\u003C/li\u003E\n\u003Cli\u003ECyber Essentials Plus\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe above detail is best captured directly from the third party. We have provided a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/egbnma2i/template-third-party-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Third Party Register template\u0022\u003ETemplate Third Party Register\u003C/a\u003E to assist with collecting this information.\u003C/p\u003E\n\u003Cp\u003EWhere the service provider has the potential to introduce a data protection risk, this should be assessed further. A tool to assist with this assessment is the Data Protection Impact Assessment (DPIA), which helps guide you through an analysis of the services and the provider. The DPIA is a risk assessment tool that considers both data privacy and information security.\u003C/p\u003E\n\u003Cp\u003EWe have produced a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/jkzb1sno/template-dpia.docx\u0022 target=\u0022_blank\u0022 title=\u0022DPIA template\u0022\u003ETemplate DPIA\u003C/a\u003E which you can use for this.\u003C/p\u003E\n\u003Cp\u003EThe decision to progress with a third party and service should be based on the output of the above assessments and made by appropriate members of the local Scout Unit Trustee Board.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EContracts\u003C/h4\u003E\n\u003Cp\u003EYou should review any existing contracts you have with the third party and check for its alignment to the GDPR. At a high level the agreement should consider the\u00A0following when it is a data controller to data processor relations, this type of structure can also be used for other relationship agreements;\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":false,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cul\u003E\n\u003Cli\u003Ethe subject matter and duration of the processing;\u003C/li\u003E\n\u003Cli\u003Ethe nature and purpose of the processing;\u003C/li\u003E\n\u003Cli\u003Ethe type of personal data and categories of data subject; and\u003C/li\u003E\n\u003Cli\u003Ethe obligations and rights of the controller;\u003C/li\u003E\n\u003Cli\u003Ethe processor must only act on the written instructions of the controller (unless required by law to act without such instructions);\u003C/li\u003E\n\u003Cli\u003Ethe processor must ensure that people processing the data are subject to a duty of confidence;\u003C/li\u003E\n\u003Cli\u003Ethe processor must take appropriate measures to ensure the security of processing;\u003C/li\u003E\n\u003Cli\u003Ethe processor must only engage a sub-processor with the prior consent of the data controller and a written contract;\u003C/li\u003E\n\u003Cli\u003Ethe processor must assist the data controller in providing subject access and allowing data subjects to exercise their rights under the GDPR;\u003C/li\u003E\n\u003Cli\u003Ethe processor must assist the data controller in meeting its GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments;\u003C/li\u003E\n\u003Cli\u003Ethe processor must delete or return all personal data to the controller as requested at the end of the contract; and\u003C/li\u003E\n\u003Cli\u003Ethe processor must submit to audits and inspections, provide the controller with whatever information it needs to ensure that they are both meeting their Article 28 obligations, and tell the controller immediately if it is asked to do something infringing the GDPR or other data protection law of the EU or a member state.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe Information Commissioner\u2019s Office (ICO) have \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/\u0022 target=\u0022_blank\u0022 title=\u0022ICO contracts guidance\u0022\u003Eprovided comprehensive guidance on the structure of such an agreement\u003C/a\u003E.\u003C/p\u003E","label":"Compulsory"}]},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EAdequacy\u003C/h4\u003E\n\u003Cp\u003EIn addition to the contract structure it is important to assess the third party based on the data location. This is known as the adequacy and is specifically focused on ensuring the third party are in the UK or an EU country, and hence bound by the GDPR, or they are in a nation that offers the same levels of data protection.\u003C/p\u003E\n\u003Cp\u003EIn cases where a nation has been found to align to the GDPR a relationship is brokered between themselves and the UK, known as an adequacy agreement. It is then the responsibility of the third party to become a subscriber to the nation\u2019s agreement and be measured against it. An example is the EU Privacy Framework that exists between the United States and the EU. Companies and organisations that are in the US and processing data of EU and UK citizens should align to this framework. A list of adequate countries can be found \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/\u0022 target=\u0022_blank\u0022 title=\u0022ICO guide to international transfers\u0022\u003Eon the ICO Website\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EAs the majority of cloud based solution providers reside in the US its worth checking the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://www.dataprivacyframework.gov/s/\u0022 target=\u0022_blank\u0022 title=\u0022Data Privacy Framework\u0022\u003EData Privacy Framework register\u003C/a\u003E to see if the third party is part of the framework already.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EData sharing\u003C/h4\u003E\n\u003Cp\u003EFinally, consideration needs to be made when transferring data to a third party, specifically around the mechanism used to complete this transfer.\u003C/p\u003E\n\u003Cp\u003EA data transfer can be anything from a paper form sent via post or electronic transfer via email or directly through websites. In all cases care should be taken to secure the transfer. Basic techniques for securing these kinds of transfers would be the use of special delivery services from the postal service and encryption for electronic systems.\u003C/p\u003E\n\u003Cp\u003EOn occasion, data sharing may be required with ad-hoc third parties with whom there is no contract relationship, but the sharing is necessary for certain conditions. These conditions could include the referral of a safeguarding concern to UK HQ, a request for information from a police officer or request from a member\u2019s solicitor for data. Where these requests do not meet the criteria to be processed as a Subject Access Request they should be treated as followed:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ERequest for information \u2013 Where a request is made to you for information it is important to make sure the request is assessed and responded to appropriately. This should include identifying the requestor and ensuring their grounds for data sharing are appropriate. In most cases it is not appropriate or possible to gain the consent of the data subject, therefore another lawful basis needs to be aligned.\u003C/li\u003E\n\u003Cli\u003EDisclosure of information \u2013 There may be occasions where the Local Scout Unit are looking to make a voluntary disclosure of information, such as to UK HQ for a safeguarding concern with a young person. In this case consent of the data subject is not an appropriate lawful basis, therefore this disclosure should be assessed and captured.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIn both cases, where data is being disclosed or requested it is important that the assessment of the situation is expedient and balanced and should consider any safety to individuals first, the below are a series of guiding principles to consider with the sharing of data, specifically in safeguarding scenarios:\u003C/p\u003E\n\u003Cp\u003EThe sharing of information should be completed with justification and awareness. Please read the full guidance:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":false,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose\u003C/strong\u003E - can I explain the activity? The purpose of the sharing needs to be clear and easy to understand so that the data subject gets a good idea of what is happening with their personal data.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimisation\u003C/strong\u003E - what do I need? The personal data being shared should be limited to only what is required for the purpose defined.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ELawful\u003C/strong\u003E - The data sharing should be aligned to a lawful basis, such as legitimate interest, consent, performance of a contract etc. In most cases this would be legitimate interest, or consent from the young person or their parents/carer.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccurate\u003C/strong\u003E - is the data accurate and up to date? The personal data being shared should be accurate and up to date, this is an ongoing obligation.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ESecure\u003C/strong\u003E - is the personal data secure in transfer and at the target? The personal data should be appropriately secured with the receiving party and during transfer\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ERetention\u003C/strong\u003E - how long is the personal data required? The sharing of personal data is still bound by a requirement to align a retention period, this is the obligation of the receiving party. In the example of the Scout Group transferring personal data to the Scout District, the Scout District should align a retention period for the data they receive. For example, the personal data is required to contact the young people or their parents/carers to inform them of the Explorer Scout programme. If the young person or their parent/carer do not respond or are not interested then the data should be deleted after a defined period. If the young person is enrolled for Explorer Scouts then this is a separate processing activity and susceptible to the Scout District\u2019s retention policy.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ETransparency\u003C/strong\u003E - is it clear to the data subject what is happening with their personal data? In all cases where data is being shared with another party the data subject should be informed of this. This should be added as part of your Privacy Policy (usually on your website or in paper form) or via a Privacy Notice on the form the young person or parent/carer completed, further guidance can be found here.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAgreement\u003C/strong\u003E - do we have an agreement between us? The detail captured as part of the review of the GDPR principles should form the basis of the agreement between the two parties.\u003C/li\u003E\n\u003C/ul\u003E","label":"Full guidance"}]},{"gridType":"RichTextBlock","content":"\u003Cp\u003E\u00A0\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/egbnma2i/template-third-party-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Third Party Register template\u0022\u003EThird Party Register template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/n3umcwxn/template-legitimate-interest-assessment.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Legitimate Interest template\u0022\u003ELegitimate Interest Assessment tool\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/jkzb1sno/template-dpia.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Privacy Impact Assessment template\u0022\u003EData Privacy Impact Assessment template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 9","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","id":47226,"nodeName":"Step 9: Third parties","title":"Step 9: Third parties","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 9: Third parties","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyNiJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThis resource aims to provide local Scout Units with guidance on the creation of a data protection policy. A data protection policy is a document that explains to the data subject your data privacy stance, and is sometimes referred to as a privacy notice or privacy policy.\u003C/p\u003E\n\u003Cp\u003EA privacy statement, or just in time notice, is a paragraph appended to the data capture source (such as a form) that provides transparent detail on the data processing, this is covered in \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/\u0022 title=\u0022Step 5: Gathering data\u0022\u003EStep 5 \u2013 Gathering Data\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EA data protection policy breaks down into a number of statements that are answers to the questions around what data you process in Scouting, how you do it and why you need it. This should be made available to anyone who your local Scout Unit collects and processes data on. It can be a page on your local website if you have one and should be easy to find, such as a link from the front page or printed copies made available if you do not have a local website or for those without internet access. The core principle in action here is transparency.\u003C/p\u003E\n\u003Cp\u003EWe have provided a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk//media/gw5esqec/guidance-template-for-creating-a-data-protection-policy.doc\u0022 target=\u0022_blank\u0022 title=\u0022Guidance Template For Creating A Data Protection Policy\u0022\u003EGuidance Template for Creating a Data Protection Policy\u003C/a\u003E. By using the wording within the resource, you should be able to construct your own data protection policy specific to your local Scout Unit. You will be required to add information specific to your local circumstances as well as removing some of the information which is not relevant to your local Scout Unit.\u003C/p\u003E\n\u003Cp\u003EInformation about how we process personal data at UK HQ can be found in \u003Ca href=\u0022/about-us/policy/data-protection-policy/\u0022 title=\u0022Data Protection Policy\u0022\u003EThe Scout Association\u0027s Data Protection Policy\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/gw5esqec/guidance-template-for-creating-a-data-protection-policy.doc\u0022 target=\u0022_blank\u0022 title=\u0022Guidance template for creating a data protection policy\u0022\u003EGuidance template for creating a data protection policy\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 10","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","id":47227,"nodeName":"Step 10: Publish your privacy stance","title":"Step 10: Publish your privacy stance","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 10: Publish your privacy stance","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyNyJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThe key principle behind the GDPR and DPA 2018 is Accountability. This means that the data entrusted to you by the data subjects will need to be processed and protected in the way they expect you to.\u003C/p\u003E\n\u003Cp\u003EPart of this obligation is to retain only the data you need and for only as long as you need it. At the point this period expires you should securely destroy/delete this data, this aligns to the principle of Storage Limitation.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EHow long to keep data\u003C/h4\u003E\n\u003Cp\u003EThis question is important and should be asked before the data is gathered. There are a number of reasons that can justify maintaining personal data and in some cases these will be easy to define, such as data required for tax purposes. In other cases the judgement of the Trustee Board collectively needs to be used to justify the retention period, this is best done using evidence or past experience. To assist, we have created a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk//media/bufdptx1/data-retention-policy-template.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Retention Policy Template\u0022\u003ETemplate Data Retention Policy\u003C/a\u003E, which contains real scouting examples. This has been created using a combination of the UK HQ Data Retention Policy and examples from local Scouting. This template can be used by a local Scout Unit but may need tailoring to suit local processing activities.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EData lifecycle\u003C/h4\u003E\n\u003Cp\u003EData is useful and necessary for many things; however, it doesn\u2019t always need to contain personally identifiable information (name, address, email etc\u2026). For example, maintaining the details of numbers of attendees for an event is great insight into the success of that event, in this case you don\u2019t require the names of those who attended.\u003C/p\u003E\n\u003Cp\u003EThe best practice way to manage the life cycle of data is as follows:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EOnly retain personal data that is necessary\u003C/li\u003E\n\u003Cli\u003EAnonymise the personal data as soon as possible so it doesn\u2019t contain anything personally identifiable (for example removing names and personal data relating to a Nights Away event, but keeping the number of young people in attendance for statistical purposes at a later date)\u003C/li\u003E\n\u003Cli\u003EDelete/destroy the data when it is no longer required\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThere are a number of ways that data can have the personally identifiable elements removed. The most common is simply delete the records that contain these elements, but there is also tooling that can reduce the admin burden of manually\u00A0deleted records. These tools use techniques such as anonymising.\u003C/p\u003E\n\u003Cp\u003EAnonymising is a technique of data cleansing that uses an irreversible program to scramble the data, or delete parts of the data making it no longer possible to identify individuals. With anonymisation the result is a data set that can be retained without requiring a lawful justification and can be used for gaining historical insights or analysis from the data.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EDelete/destroy\u003C/h4\u003E\n\u003Cp\u003ECare should be taken when deleting or destroying all personal data. When destroying physical documents this should be done using a shredder or secure paper waste bins that only allow access to the authorised disposer. Digital destruction of documents should be completed in line with the retention periods specified in the retention policy. Most delete capabilities that exist today for digital data do come with a recycle bin concept. This means that the data is not deleted straight away and allows the user some time to restore before permanent deletion, care should be taken to ensure the data is fully deleted.\u003C/p\u003E\n\u003Cp\u003EThe ICO have published \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-the-public/online/deleting-your-data-from-computers-laptops-and-other-devices/\u0022 target=\u0022_blank\u0022 title=\u0022ICO destroying data guidance\u0022\u003Eguidance on the secure destruction of data\u003C/a\u003E, this pre dates the GDPR and DPA 2018 but the advice is still relevant.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"Download the template Data Retention Policy","body":"","link":{"name":"Data Retention Policy Template","id":null,"url":"https://prod-cms.scouts.org.uk//media/bufdptx1/data-retention-policy-template.docx","newWindow":false,"target":"_blank"},"colour":"#f1f1f1","title":"Useful resources for Step 11","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","id":47228,"nodeName":"Step 11: Delete and destroy","title":"Step 11: Delete and destroy","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 11: Delete and destroy","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyOCJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThe Trustee Board is responsible for the security, integrity and confidentiality of all the data it holds. The Trustee Board is also obliged under GDPR to keep personal data safe and secure and respond promptly and appropriately to any data security breaches. Although all adult volunteers have a responsibility for the information they generate, manage, transmit and use in line with GDPR, it is the Trustee Board\u2019s legal duty to secure personal and confidential data at all times.\u003C/p\u003E\n\u003Cp\u003EAny person who knows or suspects that a breach of data security has occurred should report the breach immediately according to their Scout Unit\u2019s Data Breach Response Plan. We have included some concepts that you may wish to include in your Local Data Breach Response Plan.\u003C/p\u003E\n\u003Cp\u003EIt\u0027s vital that prompt action is taken in the event of any actual, potential or suspected breach of data security or confidentiality to avoid the risk of harm to young people or adult volunteers, damage to the Scouts operations and severe financial, legal and reputational costs to the Movement as a whole.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhat is a personal Data Breach?\u003C/h4\u003E\n\u003Cp\u003EA data breach is any event that has the potential to affect the confidentiality, integrity or availability of personal data held by the Local Scout Unit in any format. Personal data security breaches can happen for a number of reasons, including:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe disclosure of confidential data to unauthorised individuals\u003C/li\u003E\n\u003Cli\u003EThe loss or theft of portable devices or equipment containing identifiable personal, confidential or sensitive data e.g. PCs, USB, mobile phones, laptops, disks etc\u003C/li\u003E\n\u003Cli\u003EThe loss or theft of paper records\u003C/li\u003E\n\u003Cli\u003EInappropriate access controls allowing unauthorised use of information\u003C/li\u003E\n\u003Cli\u003EA suspected breach of the IT security\u003C/li\u003E\n\u003Cli\u003EAttempts to gain unauthorised access to computer systems, e.g. hacking\u003C/li\u003E\n\u003Cli\u003ERecords altered or deleted without authorisation from the data \u2018owner\u2019\u003C/li\u003E\n\u003Cli\u003EViruses or other security attacks on IT equipment systems or networks\u003C/li\u003E\n\u003Cli\u003EBreaches of physical security e.g. forcing of doors or windows into secure room or filing cabinet containing confidential information\u003C/li\u003E\n\u003Cli\u003EConfidential information left unlocked in accessible areas\u003C/li\u003E\n\u003Cli\u003EThe insecure disposal of confidential paper waste\u003C/li\u003E\n\u003Cli\u003ELeaving IT equipment unattended when logged in to a user account without locking the screen to stop others accessing information\u003C/li\u003E\n\u003Cli\u003EThe publication of confidential data on the internet in error and accidental disclosure of passwords\u003C/li\u003E\n\u003Cli\u003EMisdirected emails or faxes containing identifiable personal, confidential or sensitive data\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EHow to respond to a data breach\u003C/h4\u003E\n\u003Cp\u003EIn line with best practice, these five steps should be followed when responding to a data breach:\u003C/p\u003E\n\u003Col\u003E\n\u003Cli\u003EIdentification and initial assessment\u003C/li\u003E\n\u003Cli\u003EContainment and recovery\u003C/li\u003E\n\u003Cli\u003ERisk Assessment\u003C/li\u003E\n\u003Cli\u003ENotification\u003C/li\u003E\n\u003Cli\u003EEvaluation and response\u003C/li\u003E\n\u003C/ol\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":true,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003ETo assist this process a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/lk3lygok/data-breach-notification-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Notification form\u0022\u003EData Breach Notification Form\u003C/a\u003E is available. This form will help the Trustee Board to conduct an initial assessment of the incident by establishing if a personal data breach has taken place, and if so:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWhat personal data is involved in the breach\u003C/li\u003E\n\u003Cli\u003EThe cause of the breach\u003C/li\u003E\n\u003Cli\u003EThe extent of the breach, i.e. how many individuals are affected\u003C/li\u003E\n\u003Cli\u003EThe harms to affected individuals that could potentially be caused by the breach\u003C/li\u003E\n\u003Cli\u003EHow the breach can be contained\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe Trustee Board can determine the severity of the incident using the reference to decide if the incident can be managed and controlled locally or if it is necessary to escalate the incident to the Information Commissioner\u2019s Office (ICO).\u003C/p\u003E","label":"1: Identification and initial assessment"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EOnce it has been established that a data breach has occurred, the Trustee Board needs to take immediate and appropriate action to limit the breach;\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EEstablish who within the Local Scout Unit needs to be made aware of the breach and inform them of what they are expected to do to contain the breach (for example finding a lost piece of equipment, requesting deletion and confirmation of an email from the wrong recipient, isolating/closing a compromised section of the network, etc)\u003C/li\u003E\n\u003Cli\u003EEstablish whether there is anything that can be done to recover any losses and limit the damage the breach can cause (for example physical recovery of equipment/records, the use of back-ups to restore lost/damaged data)\u003C/li\u003E\n\u003Cli\u003EEstablish if it is appropriate to notify affected individuals immediately (for example where there is a high level of risk of serious harm to individuals)\u003C/li\u003E\n\u003Cli\u003EWhere appropriate (for example in cases involving theft or other criminal activity), inform the police.\u003C/li\u003E\n\u003C/ul\u003E","label":"2: Containment and recovery"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EIn assessing the risk arising from a data breach, the relevant Trustee Board are required to consider the potential adverse consequences for individuals, i.e. how likely are adverse consequences to materialise and, if so, how serious or substantial are they likely to be. The information provided on the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/lk3lygok/data-breach-notification-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Notification form\u0022\u003EData Breach Notification Form\u003C/a\u003E will help with this stage.\u003C/p\u003E\n\u003Cp\u003EThe Trustee Board should review the incident report to:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EAssess the risks and consequences of the breach.\u003C/li\u003E\n\u003Cli\u003ERisks for individuals.\u003C/li\u003E\n\u003Cli\u003EWhat are the potential adverse consequences for individuals?\u003C/li\u003E\n\u003Cli\u003EHow serious or substantial are these consequences?\u003C/li\u003E\n\u003Cli\u003EHow likely are they to happen?\u003C/li\u003E\n\u003Cli\u003ERisks for the Local Scout Unit or Country.\n\u003Cul\u003E\n\u003Cli\u003EStrategic and operational.\u003C/li\u003E\n\u003Cli\u003ECompliance/legal.\u003C/li\u003E\n\u003Cli\u003EFinancial.\u003C/li\u003E\n\u003Cli\u003EReputational.\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EConsider what type of data is involved, how sensitive is it? Were there any protections such as encryption? What has happened to the data? If data has been stolen it could be used for purposes which are harmful to the individuals to whom the data relate; if it has been damaged this poses a different type and level of risk.\u003C/li\u003E\n\u003Cli\u003EConsider how many individuals\u2019 personal data are affected by the breach. It is not necessarily the case that the bigger risks will accrue from the loss of large amounts of data but is certainly an important determining factor in the overall risk assessment.\u003C/li\u003E\n\u003Cli\u003EConsider the individuals whose data has been breached. Whether they are young people or adult volunteers will to some extent determine the level of risk posed by the breach and therefore, the actions in attempting to mitigate those risks.\u003C/li\u003E\n\u003Cli\u003EConsider what harm can come to the affected individuals. Are there risks of physical safety or reputation, of financial loss or a combination?\u003C/li\u003E\n\u003Cli\u003EConsider if there are wider consequences to consider such as a loss of public confidence in Scouting as a whole.\u003C/li\u003E\n\u003Cli\u003EDetermine, where appropriate, what further remedial action should be taken on the basis of the incident report to mitigate the impact of the breach and prevent repetition.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe Trustee Board should prepare an incident report setting out (where applicable):\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EA summary of the security breach\u003C/li\u003E\n\u003Cli\u003EThe people involved in the security breach (such as young people, adult volunteers)\u003C/li\u003E\n\u003Cli\u003EDetails of the information, IT systems, equipment or devices involved in the security breach and any information lost or compromised as a result of the incident\u003C/li\u003E\n\u003Cli\u003EHow the breach occurred\u003C/li\u003E\n\u003Cli\u003EActions taken to resolve the breach\u003C/li\u003E\n\u003Cli\u003EImpact of the security breach\u003C/li\u003E\n\u003Cli\u003EUnrealised, potential consequences of the security breach\u003C/li\u003E\n\u003Cli\u003EPossible courses of action to prevent a repetition of the security breach\u003C/li\u003E\n\u003Cli\u003ESide effects, if any, of those courses of action\u003C/li\u003E\n\u003Cli\u003ERecommendations for future actions and improvements in data protection as relevant to the incident\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe incident report will then be used to update the risk registers at the appropriate levels where necessary. Any significant risks will be reported and managed via the Risk Register.\u003C/p\u003E\n\u003Cp\u003EWe have provided a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r2nhpvr0/template-risk-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Risk Register template\u0022\u003Etemplate Risk Register\u003C/a\u003E.\u003C/p\u003E","label":"3: Risk assessment"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EOn the basis of the evaluation of risks and consequences the Trustee Board, and others involved in the incident as appropriate, will determine whether it is necessary to notify the breach to others outside the Local Scout Unit. For example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EParents\u003C/li\u003E\n\u003Cli\u003EIndividuals (data subjects) affected by the breach\u003C/li\u003E\n\u003Cli\u003EThe Information Commissioner\u2019s Office\u003C/li\u003E\n\u003Cli\u003EPolice\u003C/li\u003E\n\u003Cli\u003EThe press/media via the UK HQ media team\u003C/li\u003E\n\u003Cli\u003EInsurers\u003C/li\u003E\n\u003Cli\u003EBank or credit card companies\u003C/li\u003E\n\u003Cli\u003EExternal legal advisers\u003C/li\u003E\n\u003Cli\u003EOther regulatory bodies such as the Charity Commission\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAs well as deciding who to notify, the Trustee Board must consider:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWhat is the message that needs to be communicated?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIn each case, the notification should include as a minimum:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EA description of how and when the breach occurred;\u003C/li\u003E\n\u003Cli\u003EWhat data was involved; and\u003C/li\u003E\n\u003Cli\u003EWhat action has been taken to respond to the risks posed by the breach.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhen notifying individuals, the Trustee Board should give specific and clear advice on what steps they can take to protect themselves, what the Local Scout Unit is willing to do to assist them and details of how they can contact the Trustee Board for further information.\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EHow to communicate the message?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhat is the most appropriate method of notification (for example are there large numbers of people involved? Does the breach involve sensitive data? Is it necessary to write to each individual affected? Is it necessary to seek legal advice on the wording of the communication?)\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWhy are we notifying?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003ENotification should have a clear purpose, for example to enable individuals who may have been affected to take steps to protect themselves (e.g. by cancelling a credit card or changing a password), to allow regulatory bodies to perform their functions, provide advice and deal with complaints, etc.\u003C/p\u003E\n\u003Cp\u003EThe Information Commissioner\u2019s Office (ICO) expects that serious breaches should be brought to their attention within 72 hours of knowing about the breach. Serious breaches are not defined but \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/\u0022 target=\u0022_blank\u0022 title=\u0022ICO data breach reporting guidance\u0022\u003Eguidance is available from the ICO\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EAny contact with the ICO should be made through the Trustee Board. Initial contact with the ICO should be made by the Trustee Board, outlining the circumstances surrounding the incident through submission of the Breach Notification Form and the Breach Severity Form. The ICO will make a determination regarding the need for a detailed report and/or subsequent investigation based on the nature of the incident and the presence or otherwise of appropriate physical or technological security measures to protect the data. In cases where the decision is made by the Trustee Board not to report a breach, a brief summary of the incident with an explanation of the basis for not informing the ICO will be retained by the Trustee Board.\u003C/p\u003E\n\u003Cp\u003EWhen the personal data breach is likely to result in a high risk to the rights and freedoms of those affected, the Trustee Board shall communicate the personal data breach to the data subject without undue delay.\u003C/p\u003E\n\u003Cp\u003EThe communication to the data subject referred to in paragraph one shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to above.\u003C/p\u003E\n\u003Cp\u003EThe communication to the data subject shall not be required if any of the following conditions are met:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe Trustee Board has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption\u003C/li\u003E\n\u003Cli\u003EThe Trustee Board has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise\u003C/li\u003E\n\u003Cli\u003EIt would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf the Trustee Board has not already communicated the personal data breach to the data subject, the ICO, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to are met.\u003C/p\u003E\n\u003Cp\u003EIn addition, the completed \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/lk3lygok/data-breach-notification-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Notification Form\u0022\u003EData Breach Notification Form\u003C/a\u003E should be passed to the Scouts UK headquarters via the following email address \u003Ca href=\u0022mailto:dpa.alert@scouts.org.uk\u0022\u003Edpa.alert@scouts.org.uk\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003ENOTE \u2013 This email address is only for reporting a breach and there will be no remediation guidance as a direct result. The information will be used by the Scouts to monitor any trends in breaches being reported and update the Scout Unit Data protection Toolkit with further guidance.\u003C/p\u003E","label":"4: Notification"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003ESubsequent to a data breach, the Trustee Board will conduct a review to ensure that the steps taken during the incident were appropriate and to identify areas that may need to be improved.\u003C/p\u003E\n\u003Cp\u003EThe Trustee Board will compile a central record of incidents. To assist with this we have produced a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r4ghmdbe/template-data-breach-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Register template\u0022\u003ETemplate Data Breach Register\u003C/a\u003E. The Trustee Board will report on incidents to the adult volunteers in order to identify lessons to be learned, patterns of incidents and evidence of weakness and exposures that need to be addressed.\u003C/p\u003E\n\u003Cp\u003EFor each serious incident, the Trustee Board will conduct a review and report:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWhat action needs to be taken to reduce the risk of future breaches and minimise their impact\u003C/li\u003E\n\u003Cli\u003EWhether policies procedures or reporting lines need to be improved to increase the effectiveness of the response to the breach\u003C/li\u003E\n\u003Cli\u003EIf there are any weak points in security controls that need to be strengthened\u003C/li\u003E\n\u003Cli\u003EIf users of services are aware of their responsibilities for information security and adequately trained\u003C/li\u003E\n\u003Cli\u003EIf additional investment is required to reduce exposure and if so what are the resource implications?\u003C/li\u003E\n\u003C/ul\u003E","label":"5: Evaluation and response"}]},{"gridType":"RichTextBlock","content":"\u003Cp\u003E\u00A0\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/lk3lygok/data-breach-notification-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Notification form\u0022\u003EData\u00A0Breach Notification form\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r4ghmdbe/template-data-breach-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Register template\u0022\u003EData Breach Register template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r2nhpvr0/template-risk-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Risk Register template\u0022\u003ERisk Register template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 12","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","id":47229,"nodeName":"Step 12: Responding to a breach","title":"Step 12: Responding to a breach","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 12: Responding to a breach","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyOSJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/"},{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EFrom 19 June 2026 all organisations are required to have a process in place for handling data protection complaints.\u003C/p\u003E\n\u003Cp\u003EData protection complaints can happen when someone is unhappy with how their data has been used, how long it has been kept, its accuracy, how securely it has been stored, or how their rights requests (such as subject access requests) have been handled. They may also complain if they have been affected by a data breach.\u003C/p\u003E\n\u003Cp\u003EComplaints could come from parents, young people, adult members and anyone else whose data has been processed by your Scout Unit.\u003C/p\u003E\n\u003Cp\u003EBelow we run through how to manage data protection complaints.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EProvide a clear way for people to complain\u003C/h4\u003E\n\u003Cp\u003EYou must give individuals a straightforward way to raise data protection concerns directly with your Scout Unit. You should also tell people they can raise a complaint, and a good way to do this is to include it in your Data Protection Policy and your website.\u003C/p\u003E\n\u003Cp\u003EYou should provide a dedicated email address or contact point alongside a simple explanation of what information they should provide. This should be easily accessible so people know how they can raise a data protection complaint. \u0026nbsp;Data protection complaints can be from adults or from young people, and so any mechanisms you have should be suitable for all.\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhat to do if you receive a data protection complaint\u003C/h4\u003E\n\u003Cp\u003E\u003Cstrong\u003E1 Acknowledge the complaint\u003C/strong\u003E\u003Cbr\u003EWhen a complaint is received you should acknowledge it promptly. The law says it should be acknowledged within 30 days but you should plan to acknowledge it much sooner than that. You will need to confirm the complainant\u2019s identity. If you have any doubts, you should ask them for proof of ID. \u0026nbsp;If someone is making a complaint on behalf of someone else you should check that they have the authority to do so.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E2 Investigate\u003C/strong\u003E\u003Cbr\u003EYou need to ensure the correct people are aware of the complaint, and are allocated to investigate. In most cases this will be Lead Volunteer or Data Lead. You should also ensure the Trustee Board are made aware. You should be sensitive to who the complaint is about, and who is involved or connected to those involved. \u0026nbsp;\u003C/p\u003E\n\u003Cp\u003EWhere a data protection complaint also includes other matters of complaint, consideration should be given as to whether to investigate them together or to separate them.\u003C/p\u003E\n\u003Cp\u003EYour investigation should be proportionate and timely. This should include a review of the data processing involved, and whether it was done in line with your policies and data protection law. If you determine that there has been a problem, then you should consider the volume and type of data involved, and the level of risk associated with it. If you believe that there has been a data breach you should follow \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/\u0022 title=\u0022Step 12: Responding to a breach\u0022\u003EStep 12: Responding to a breach.\u003C/a\u003E\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E3. Keep the complainant updated\u003C/strong\u003E\u003Cbr\u003EThe complainant should be kept informed of the progress of the investigation. They should be given a timescale in which you will respond. We recommend responding to complaints within one calendar month, or if it is complex you can extend by a further two months. Where there are delays you should ensure you keep the complainant informed.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E4. Keep a record\u003C/strong\u003E\u003Cbr\u003EYou should keep a record of all data protection complaints. This should include the date it was received, when you acknowledged it and responded to it. You should also retain records of communication and any actions taken. It is possible that the Information Commissioner could request to see your complaint log. Something like an excel spreadsheet is an ideal tool for a complaint log. The log must be stored securely and access only given to those who need it.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E5. Respond to the Complaint\u0026nbsp;\u003C/strong\u003E\u003Cbr\u003EThe most common route for responding to a complaint is via email, though they can also be responded to via a letter or a conversation. The response should include:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EAn explanation of your findings\u003C/li\u003E\n\u003Cli\u003EAny actions you have taken or will take\u003C/li\u003E\n\u003Cli\u003EDetails of how you have complied with data protection law\u003C/li\u003E\n\u003Cli\u003EDetails of how to complain to the Information Commissioners Office \u0026nbsp;\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf a complaint is from a young person you should respond in plain, clear language they can understand.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E5. Learn from complaints\u003C/strong\u003E\u003Cbr\u003EComplaints are an opportunity to improve. After closing a complaint, you should look to see if there is any learning to be had from it. This might include updating processes or policies, providing further training or reminding volunteers about best practice. Learning should be recorded in your complaint log.\u003C/p\u003E\n\u003Cp\u003EFurther guidance on managing data protection complaints \u003Ca href=\u0022https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/\u0022\u003Ecan be found on the ICO website\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},"next":null,"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","id":89282,"nodeName":"Step 13: Have a Complaints Process","title":"Step 13: Have a Complaints Process","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 13: Have a Complaints Process","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC84OTI4MiJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/"}],"id":47215,"nodeName":"GDPR Toolkit","title":"GDPR Toolkit","type":"codex","image":{"url":"/media/12108/fdl-hp.jpg?width=800\u0026height=450\u0026v=1dab8e1b20252a0","caption":"Scouts purple logo","type":"jpg","size":93039,"width":1268,"height":664,"altText":"An image of a purple background showing the white Scouts logo"},"assets":null,"headerOptions":{"headerTitle":"Scout Unit Data Protection Toolkit","headerSubTitle":"Data protection is a key responsibility for anybody that has access to the personal data of \nindividuals","headerCta":"","headerCtaText":"","headerCtaLink":"","headerBackgroundColour":"0061ce","showSEOImage":false,"headerBackgroundImage":null,"quickLinks":[{"caption":"","title":"Subject Access Requests","url":"/volunteers/running-things-locally/subject-access-requests/","newWindow":false}]},"searchDescription":"This guidance material has been designed to help you understand the legislation applicable for data protection.","subHeader":"This guidance material has been designed to help you understand the legislation applicable for data protection.","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxNSJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/"}