{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EScout Groups, Districts, Counties/Areas/Regions (Scotland) (each known as \u2018Scout Units\u2019)\u00A0are separate charities as is the Scouts UK Headquarters (\u2018UK HQ\u2019), as a national charity, with each accountable for their own compliance with the GDPR.\u003C/p\u003E\n\u003Cp\u003EResponsibility to be compliant with the GDPR rests with the respective Trustee Boards, and it\u2019s UK HQ\u2019s\u00A0intention to sign-post appropriate resources to support local Scout Units in fulfilling their\u00A0responsibility.\u003C/p\u003E\n\u003Cp\u003EEach adult member and associate member must also ensure that they\u00A0comply with data protection law when handling any personal data.\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch3\u003EData Controllers\u003C/h3\u003E\n\u003Cp\u003EA data controller is defined as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. This will be the local Scout Unit with accountability sitting with the Trustee Board.\u003C/p\u003E\n\u003Cp\u003EWith regard to personal data stored on the Adult Membership System, UK HQ and the Scout Units are independent Data Controllers. Independent Data Controllers may each use and access a shared database but each remains responsible for the personal data within its own control and capacity.\u003C/p\u003E\n\u003Cp\u003EAccordingly, Scout Units remain responsible for ensuring that their handling of personal data locally is in compliance with the GDPR and \u003Ca href=\u0022/por/\u0022 title=\u0022POR Rule Book\u0022\u003EPolicy, Organisation \u0026amp; Rules (POR)\u003C/a\u003E (which includes uploading and maintaining such data onto The Adult Membership System) and the UK HQ remains responsible for ensuring that its handling of personal data nationally is also in compliance with the GDPR and POR\u0026nbsp;(including its particular responsibilities for data held on the Adult Membership System).\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch3\u003EData Processors\u003C/h3\u003E\n\u003Cp\u003EA Data Processor is defined as a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.\u003C/p\u003E\n\u003Cp\u003EThis means that any service provider or third party that has access to personal data and processes it on behalf of the Data Controller, is a Data Processor.\u00A0This Data Processor could also be a third-party system used for data storage, such as an online youth membership system.\u003C/p\u003E\n\u003Cp\u003EIn summary a Data Processor is responsible for processing personal data on behalf of a controller, but the controller determines the reasons for the processing.\u003C/p\u003E","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","id":47218,"nodeName":"Step 2: Who is responsible for what?","title":"Step 2: Who is responsible for what?","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 2: Who is responsible for what?","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxOCJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/"}