{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThirty years ago, the world was a very different place. The reach of technology was limited, and the way organisations used and processed your personal data was very different to how they use it today.\u003C/p\u003E\n\u003Cp\u003EThe changes that have happened over the last two decades forced the European Union (EU) to review the old data legislation and bring it up to speed with the modern era. The EU\u2019s General Data Protection Regulation (GDPR) raised the standards for processing personal data, to strengthen and unify protection for individuals across the EU. The new legislation came into force in the UK on 25 May 2018.\u003C/p\u003E\n\u003Cp\u003ESince this date the UK has left the European Union as a Member State but has effectively adopted the GDPR as part of UK law. This has meant that the UK was subject to an adequacy review with the European Union to ensure that the residual Data Protection Act 2018 met the requirements of the GDPR. This was completed and the UK was granted Adequacy, meaning that the Data Protection Act 2018 was seen as an adequate legislation for EU data protection and the principles of the GDPR.\u003C/p\u003E\n\u003Cp\u003EScout Groups, Districts, Counties/Areas/Regions (Scotland), Countries (each known as \u2018Scout Units\u2019) and the Scouts UK Headquarters (\u2018UK HQ\u2019) collect and process lots of personal data on the young people, adult volunteers and staff. This could be anything from names, addresses, telephone numbers right through to more sensitive data such as religion, ethnicity and disabilities. As a result, it\u2019s important that all Scout Units and UK HQ are aware of the legislation and comply with it.\u003C/p\u003E\n\u003Cp\u003EThe Scout Unit Trustee Boards have responsibility for making sure that they comply with legal requirements, including data protection legislation.\u003C/p\u003E\n\u003Cp\u003ELocal Scout Units are generally exempt from having to register and pay for the ICO Data Protection Fee, this is due to each being a not-for-profit. However, if the local Scout Unit are using CCTV for crime prevention purposes, or is involved with personal data from outside the Scout Unit the registration and fee are applicable. \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee-self-assessment/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003ECheck out the assessment for measuring these criteria\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EThere are many key terms that are in the GDPR and used throughout this guidance:\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EPersonal data \u003C/strong\u003E\u2013 Any information that can be used to identify an individual. This information could be names, addresses, telephone numbers or more sensitive information such as religion, ethnicity and disabilities.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EData subject\u003C/strong\u003E \u2013 This is an individual. For Scout Units this could be young people, adult volunteers, parents and guardians and any staff employed locally.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EData controller\u003C/strong\u003E \u2013 This is the entity that determines the means and purpose of processing personal data. This is an organisation gathering, processing and retaining personal data, such as the local Scout Unit.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EData processor\u003C/strong\u003E \u2013 This is an organisation who processes the information on behalf of the data controller. This could be the provider of a membership platform, cloud service provider or event organiser.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003ELawful basis\u003C/strong\u003E \u2013 The legally justified reason for processing personal data, such as it being necessary to contact members about Scout affairs.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EProcessing activity\u003C/strong\u003E \u2013 Anything that you do with personal data, which may include the capture, storage, access, use, sharing and destruction.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003ESubject Rights Request (SRR)\u003C/strong\u003E \u2013 This is a request from an individual to the Scout Unit or UK HQ to find out what information you hold on them. They also have the right to request that you change or permanently remove any details that you hold on them.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EBreach\u003C/strong\u003E \u2013 This is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This could come from a hacker or physically losing files/folders.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EData Lead\u003C/strong\u003E \u2013 Accredited representative within a Scout Unit for data protection duties.\u003C/p\u003E\n\u003Cp\u003EAn \u003Ca href=\u0022/volunteers/learning-development-and-awards/learning/\u0022 title=\u0022Learning\u0022\u003EeLearning module\u003C/a\u003E is also available to support members.\u003C/p\u003E\n\u003Cp\u003EIn addition to the terms above the GDPR has a series of guiding principles at its core, these are as follows:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003ELawful\u003C/strong\u003E \u2013 the data processing is aligned to a lawful basis, such as legitimate interest, consent, performance of a contract etc.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EFairness\u003C/strong\u003E \u2013 would the data subject consider this processing activity fair?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ETransparency\u003C/strong\u003E \u2013 is it clear to the data subject what is happening with their personal data?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose\u003C/strong\u003E \u2013 can you explain the processing activity and is it justified?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimisation\u003C/strong\u003E \u2013 the data being processed is kept to the minimum required for the purpose\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EStorage limitation\u003C/strong\u003E - how long is the personal data required and can you justify this?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccuracy\u003C/strong\u003E \u2013 is the data accurate and up to date? Can it be updated going forward?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ESecure\u003C/strong\u003E \u2013 is the data secure in use, storage and transfer?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccountability\u003C/strong\u003E \u2013 the organisation that is subject to the GDPR needs to have systems in place to ensure compliance and be able to evidence it.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe below examples are scenarios that may exist at local Scouting level, these scenarios have been used to demonstrate some of the key terms in action:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":true,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EAdvertising for new members could include: events, email campaigns, canvassing.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EIt needs to be clear who you are marketing to and the lawful basis you are using as grounds to contact them. This needs to be evidenced as either:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EConsent \u2013 they opted-in\u003C/li\u003E\n\u003Cli\u003ENon-digital \u2013 physical event/canvassing\u003C/li\u003E\n\u003Cli\u003ELegitimate interest \u2013 your use of the data is necessary and is not overridden by their interests or fundamental rights. On balance, it\u2019s more positive for them than\u00A0\u003Cbr\u003Enegative.\u003C/li\u003E\n\u003Cli\u003EIt is important that the individual being contacted has an ability to opt out of the communication\u003C/li\u003E\n\u003C/ul\u003E","label":"Marketing"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EPotential new members and/or their parents or guardians communicate with you via:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EEmail or other electronic means\u003C/li\u003E\n\u003Cli\u003EFace-to-face\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EWhen communicating with a potential member, parent or guardian, they have usually enquired with you already giving you legitimate interest for the communications. Care needs to be taken to keep these communications private, especially when personal data is shared amongst groups.\u003C/p\u003E","label":"Want to join"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EThe Young Person/Adult Information Form is used to capture information about a young person or adult volunteer in order to begin the joining/appointment process, this could be via:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EEmail\u003C/li\u003E\n\u003Cli\u003EWeb form\u003C/li\u003E\n\u003Cli\u003EPaper form\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EThe Young Person/Adult Information Form may be the first data capture exercise for a new member.\u003C/p\u003E\n\u003Cp\u003EThe form must state:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe purpose\u003C/strong\u003E - What you are going to do with the form and the data.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ETimeframe\u003C/strong\u003E - How long you will hold onto the data (delete or securely destroy when\u00A0\u003Cbr\u003Eno longer required).\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe data collected must be:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimised\u003C/strong\u003E - It only includes what you need.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EKept secure\u003C/strong\u003E - Special care taken in storing.\u003C/li\u003E\n\u003C/ul\u003E","label":"Information forms"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EThe young person, parent/guardian or adult volunteer are now active within the\u0026nbsp;Scout Unit.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EThe young person, parent/guardian or volunteer\u2019s data will be stored in a filing system such as Excel sheets on local laptops, online record keeping systems and/or paper based records.\u003C/p\u003E\n\u003Cp\u003EDuring this period you need to consider:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThird parties that are holding data on your behalf, such as online record keeping systems or cloud storage systems.\u003C/li\u003E\n\u003Cli\u003EAccuracy of date. Is it kept up-to-date?\u003C/li\u003E\n\u003Cli\u003EData flows i.e. where is the data stored, how is it accessed and by who, and is the data\u0026nbsp;\u003Cbr\u003Eshared?\u003C/li\u003E\n\u003C/ul\u003E","label":"Active"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EScouting events are held frequently involving young people and adult volunteers.\u003C/p\u003E\n\u003Cp\u003EThese can be:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ESectional activities in a meeting place\u003C/li\u003E\n\u003Cli\u003EEvents or nights away\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThese events can require further data gathering, such as activity or nights away information and health forms completed by parents/guardians and adult volunteers.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EWhen further data gathering is being completed you need to consider:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose\u003C/strong\u003E \u2013 what are you going to do with it\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimisation\u003C/strong\u003E \u2013 it only includes what you need\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ERetention\u003C/strong\u003E \u2013 delete when no longer required\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ESecure\u003C/strong\u003E \u2013 special care taken in storing, and access only given to those who need it\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThis activity should consider what data you already have on file and only capture what is necessary.\u003C/p\u003E","label":"Events"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EYoung person and adult volunteer information may be collected as part of the joiners process. This may include:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EReligion\u003C/li\u003E\n\u003Cli\u003EEthnicity\u003C/li\u003E\n\u003Cli\u003EDisabilities\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003ECapturing and processing of personal data of any kind needs to be handled with care, especially with details considered sensitive, such as ethnicity, religion and disabilities.\u00A0\u003C/p\u003E\n\u003Cp\u003EIn all cases the purpose of the processing should be well understood and documented. The lawful basis required for processing special category data are different. Please view our\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/3lwkbh23/lawful-basis.pdf\u0022 target=\u0022_blank\u0022 title=\u0022Lawful basis guide\u0022\u003Eguide to Lawful Basis\u003C/a\u003E.\u003C/p\u003E","label":"Collection of sensitive (special category) data"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EAt every meeting or event, the leader in charge is obliged, for safety reasons to take a register of those attending the\u00A0session.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003ERegistration of those attending each meeting is good practice from a safety perspective.\u003C/p\u003E\n\u003Cp\u003EWhat this highlights is the importance of the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EAccurate data on members\u003C/li\u003E\n\u003Cli\u003EMaintaining a log of attendees but retaining a high level of data protection, such as the use of digital data as opposed to paper records and minimised data purely for attendance.\u003C/li\u003E\n\u003C/ul\u003E","label":"Register"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EA requirement of being an adult volunteer in Scouting is to keep young people, parents/guardians and other adult volunteers updated.\u003C/p\u003E\n\u003Cp\u003EThese are updates about weekly meetings, upcoming events and general Scout Unit news.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003ECommunication to the young people, parents/guardians or adult volunteers is essential for the effective operation of a Scout Unit. The GDPR recognises these types of communications and categorises them as necessary to fulfil your role.\u003C/p\u003E\n\u003Cp\u003EHowever, this communication should only be for the purposes of the Scout Unit and not for further advertising, unless the person receiving the communication has specifically opted-in.\u003C/p\u003E","label":"Communications"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EWhen a young person gets to a certain age, they go through the Moving On process to the next section. In most situations, they will have a new section leader. The young person can also leave Scouting at any point.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EWhen data is being transferred from one person (a Section Leader) to another, care needs to be taken in the transfer and receipt. In addition, the data being transferred needs to be accurate and minimised.\u003C/p\u003E\n\u003Cp\u003EIf at any time a young person wishes to leave Scouting, their data may need to be deleted fully if not required for further purposes.\u003C/p\u003E\n\u003Cp\u003EAll personal data should have a defined and appropriate retention period.\u003C/p\u003E","label":"Moving on"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EIt may occur that personal data is disclosed externally accidently or removed from the Scout Unit via malicious means.\u003C/p\u003E\n\u003Ch4\u003EWhat does this mean for GDPR?\u003C/h4\u003E\n\u003Cp\u003EIn the event of a breach, via malicious means or through accidental disclosure/loss etc, the data controller (the Scout Unit) is obligated to do the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ERemediate the breach\u003C/li\u003E\n\u003Cli\u003EReport the breach to the data subject if deemed severe enough\u003C/li\u003E\n\u003Cli\u003EReport the breach to the ICO if deemed serious enough and within 72 hours of becoming aware of the breach\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EFor more information see \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/\u0022 title=\u0022Step 12: Responding to a breach\u0022\u003EStep 12: Responding to a breach\u003C/a\u003E.\u003C/p\u003E","label":"Data breach"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EIn the event that a member or parent/guardian asks for their data to be deleted, updated or provided to them as a copy, the data controller has 30 days to respond to the request\u00A0unless there are justified grounds to extend by a further 30 days or an exemption applies.\u003C/p\u003E\n\u003Cp\u003EThis is covered further in \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/\u0022 title=\u0022Step 4: Understanding data subjects\u0022\u003EStep 4: Understanding data subjects\u2019 rights\u003C/a\u003E\u003C/p\u003E","label":"Subject Access Request"}]},{"gridType":"RichTextBlock","content":"\u003Cp\u003E\u0026nbsp;\u0026nbsp;\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022/volunteers/learning-development-and-awards/learning/\u0022 title=\u0022Learning\u0022\u003EGDPR eLearning module\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee-self-assessment/\u0022 target=\u0022_blank\u0022 title=\u0022Self assessment on ICO website\u0022\u003ECheck if you\u0027re exempt from the ICO Data Protection Fee\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/3lwkbh23/lawful-basis.pdf\u0022 target=\u0022_blank\u0022 title=\u0022Lawful Basis PDF\u0022\u003EGuide to Lawful Basis PDF\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 1","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","id":47217,"nodeName":"Step 1: What do I need to know about data protection?","title":"Step 1: What do I need to know about data protection?","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 1: What do I need to know about data protection?","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxNyJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/"}