{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EData protection is a key responsibility for anybody that has access to the personal data of individuals.\u003C/p\u003E\n\u003Cp\u003EThis guidance material has been designed to help you understand the legislation applicable for data protection and provide tooling for alignment to the legislation.\u003C/p\u003E\n\u003Cp\u003EFollowing feedback on the GDPR Toolkit, the Scouts UK Headquarters (UK HQ) have redesigned this guidance to be more step based with bite size materials that can be used in isolation. This includes the simplification of the previous GDPR Framework to line up with the new steps-based guidance.\u003C/p\u003E\n\u003Cp\u003EDuring this guidance material, local Scout Groups, Districts and Counties/Areas/Regions (Scotland) will be collectively referred to as \u2018Scout Units\u2019.\u003C/p\u003E\n\u003Cp\u003EThere are 12 steps as part of this guidance. To keep track of your progress through the material you can use the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/11791/gdpr-alignment-checklist.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR Alignment Checklist\u0022\u003EGDPR Alignment Checklist\u003C/a\u003E. As you are working through these 12 steps you may identify risks in the way you are operating. The \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/20753/gdpr-risk-register-2023.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR Risk Register\u0022\u003EGDPR Risk Register\u003C/a\u003E can be used to assist in tracking these risks.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EThe 12 steps in this guidance are broken down as below:\u003C/h4\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 1: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/\u0022 title=\u0022Step 1: What do I need to know about GDPR?\u0022\u003EWhat do I need to know about GDPR\u003C/a\u003E \u2013 Introduction to GDPR and key terms to be aware of\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 2: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/\u0022 title=\u0022Step 2: Who is responsible for what?\u0022\u003EWho is responsible for what\u003C/a\u003E \u2013 Exploration of the roles within GDPR and what they mean\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 3:\u003C/strong\u003E\u0026nbsp;\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/\u0022 title=\u0022Step 3: Appointing a data protection lead\u0022\u003EAppointing a Data Lead\u003C/a\u003E \u2013 The benefits of a Data Lead\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 4:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/\u0022 title=\u0022Step 4: Understanding data subjects\u0022\u003EUnderstanding data subjects\u2019 rights\u003C/a\u003E \u2013 Exploring the rights of data subjects and how to respond to these rights\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 5: \u003C/strong\u003E\u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/\u0022 title=\u0022Step 5: Gathering data\u0022\u003EGathering data\u003C/a\u003E \u2013 Examples and tooling for the creation of best practice surveys and forms\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 6:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/\u0022 title=\u0022Step 6: Data discovery\u0022\u003EData discovery\u003C/a\u003E \u2013 Exploring the data you have and how to look for it\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 7:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/\u0022 title=\u0022Step 7: Keep a record\u0022\u003EKeep a record\u003C/a\u003E \u2013 Recording the data you have and the processes you use to gather it\u0026nbsp;\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 8:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/\u0022 title=\u0022Step 8: Check your security\u0022\u003ECheck your security\u003C/a\u003E \u2013 Looking at the ways you can secure data and keeping a record of the security in place\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 9:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/\u0022 title=\u0022Step 9: Third parties\u0022\u003EThird parties\u003C/a\u003E \u2013 Discovering and recording the third parties you use\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 10:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/\u0022 title=\u0022Step 10: Publish your privacy stance\u0022\u003EPublish your privacy stance\u003C/a\u003E \u2013 Guidance on creating a data protection policy\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 11:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/\u0022 title=\u0022Step 11: Delete and destroy\u0022\u003EDelete and destroy\u003C/a\u003E \u2013 Making sure you only keep data as long as you need it and how you should get rid of it\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EStep 12:\u003C/strong\u003E \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/\u0022 title=\u0022Step 12: Responding to a breach\u0022\u003EResponding to a breach\u003C/a\u003E \u2013 Understanding what a breach is and how to deal with it\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/11791/gdpr-alignment-checklist.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR alignment checklist\u0022\u003EGDPR Alignment Checklist\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/20753/gdpr-risk-register-2023.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022GDPR risk register\u0022\u003EGDPR Risk Register\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":null,"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","id":47216,"nodeName":"Introduction","title":"Introduction","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Introduction","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxNiJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/introduction/"}