{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThe key principle behind the GDPR and DPA 2018 is Accountability. This means that the data entrusted to you by the data subjects will need to be processed and protected in the way they expect you to.\u003C/p\u003E\n\u003Cp\u003EPart of this obligation is to retain only the data you need and for only as long as you need it. At the point this period expires you should securely destroy/delete this data, this aligns to the principle of Storage Limitation.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EHow long to keep data\u003C/h4\u003E\n\u003Cp\u003EThis question is important and should be asked before the data is gathered. There are a number of reasons that can justify maintaining personal data and in some cases these will be easy to define, such as data required for tax purposes. In other cases the judgement of the Trustee Board collectively needs to be used to justify the retention period, this is best done using evidence or past experience. To assist, we have created a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk//media/bufdptx1/data-retention-policy-template.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Retention Policy Template\u0022\u003ETemplate Data Retention Policy\u003C/a\u003E, which contains real scouting examples. This has been created using a combination of the UK HQ Data Retention Policy and examples from local Scouting. This template can be used by a local Scout Unit but may need tailoring to suit local processing activities.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EData lifecycle\u003C/h4\u003E\n\u003Cp\u003EData is useful and necessary for many things; however, it doesn\u2019t always need to contain personally identifiable information (name, address, email etc\u2026). For example, maintaining the details of numbers of attendees for an event is great insight into the success of that event, in this case you don\u2019t require the names of those who attended.\u003C/p\u003E\n\u003Cp\u003EThe best practice way to manage the life cycle of data is as follows:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EOnly retain personal data that is necessary\u003C/li\u003E\n\u003Cli\u003EAnonymise the personal data as soon as possible so it doesn\u2019t contain anything personally identifiable (for example removing names and personal data relating to a Nights Away event, but keeping the number of young people in attendance for statistical purposes at a later date)\u003C/li\u003E\n\u003Cli\u003EDelete/destroy the data when it is no longer required\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThere are a number of ways that data can have the personally identifiable elements removed. The most common is simply delete the records that contain these elements, but there is also tooling that can reduce the admin burden of manually\u00A0deleted records. These tools use techniques such as anonymising.\u003C/p\u003E\n\u003Cp\u003EAnonymising is a technique of data cleansing that uses an irreversible program to scramble the data, or delete parts of the data making it no longer possible to identify individuals. With anonymisation the result is a data set that can be retained without requiring a lawful justification and can be used for gaining historical insights or analysis from the data.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EDelete/destroy\u003C/h4\u003E\n\u003Cp\u003ECare should be taken when deleting or destroying all personal data. When destroying physical documents this should be done using a shredder or secure paper waste bins that only allow access to the authorised disposer. Digital destruction of documents should be completed in line with the retention periods specified in the retention policy. Most delete capabilities that exist today for digital data do come with a recycle bin concept. This means that the data is not deleted straight away and allows the user some time to restore before permanent deletion, care should be taken to ensure the data is fully deleted.\u003C/p\u003E\n\u003Cp\u003EThe ICO have published \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-the-public/online/deleting-your-data-from-computers-laptops-and-other-devices/\u0022 target=\u0022_blank\u0022 title=\u0022ICO destroying data guidance\u0022\u003Eguidance on the secure destruction of data\u003C/a\u003E, this pre dates the GDPR and DPA 2018 but the advice is still relevant.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"Download the template Data Retention Policy","body":"","link":{"name":"Data Retention Policy Template","id":null,"url":"https://prod-cms.scouts.org.uk//media/bufdptx1/data-retention-policy-template.docx","newWindow":false,"target":"_blank"},"colour":"#f1f1f1","title":"Useful resources for Step 11","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","id":47228,"nodeName":"Step 11: Delete and destroy","title":"Step 11: Delete and destroy","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 11: Delete and destroy","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyOCJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/"}