{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EBy definition in the GDPR we are all known as data subjects. Data subjects have the right to object to how their personal data is processed.\u003C/p\u003E\n\u003Cp\u003EThey also have the right to request access, correct, sometimes delete and restrict the personal data being processed. In addition, they have a right to complain to you and to the Information Commissioner\u2019s Office (ICO). Details of how to complain to the ICO can be \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/make-a-complaint/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003Efound on their website\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EUnless subject to an exemption under the GDPR and DPA 2018, a data subject has the following rights with respect to their personal data:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to be informed\u003C/strong\u003E \u2013 they have the right to know how their data will be used by you, especially if this is changing\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to access their personal data\u003C/strong\u003E \u2013 they can ask you to share with them the data you have about them. This is a Subject Access Request and is explored further on this page.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to rectification\u003C/strong\u003E \u2013 this just means they can update their data if it\u2019s inaccurate or if something is missing. Adult members will be able to edit and update some information directly on the Adult Membership System.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to erasure\u003C/strong\u003E \u2013 this means that they have the right to request that you delete any personal data you have about them. You must consider these requests very carefully as so long as you have a sound legal basis for retaining the data you are unlikely to need to delete it, for example, some information will be processed for legal reasons.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to restrict processing\u003C/strong\u003E \u2013 if they think that you are not processing their data in line with your data protection policy then they have the right to request that you restrict any further use of that data until the issue is resolved.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to data portability\u003C/strong\u003E \u2013 this means that if they ask you to export their personal data then you will do so in a way that can be read digitally \u2013 such as a PDF. This makes it easier to share information with others.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to object\u003C/strong\u003E \u2013 they can object to the ways their data is being used.\u003C/li\u003E\n\u003Cli\u003ERights in relation to automated decision-making and profiling \u2013 this protects the data subject in cases where decisions are being made about them based entirely on automated processes rather than a human input. It\u2019s highly unlikely that this will be used by local Scouts.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch3\u003ESubject access requests\u003C/h3\u003E\n\u003Cp\u003EWith these extensive rights available to data subjects it is important that you have a process for responding to a request from the data subject on any of the above. By far the most common of these is a subject access request (SAR).\u003C/p\u003E\n\u003Cp\u003EThe response to the data subject needs to be within one month from receiving the request. This can be extended by up to two months, if the request is complex and cannot be completed in time, but notice must be given to the data subject on the extension and the reason why. Further information on this can be \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003Efound on the ICO website\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EThe following process can be used as guidance to manage such requests:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EApplication:\u003C/strong\u003E Data subject to provide request scope or complete \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/wchge450/template-subject-access-request-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Template Subject Access Request Form\u0022\u003ESAR Request Form.\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EIdentity Evidence:\u003C/strong\u003E You must be certain you are giving the data to the correct person. The best way to do this is to ask for identification such as current passport or driving licence.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ERequest Logged: \u003C/strong\u003EThe date by which the identification checks and the specification of the data sought must be recorded in a SAR Register.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EDiscovery:\u003C/strong\u003E The Trustee Board discovers all instances where the data subjects\u0027 personal data is present (within the scope of the request), the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Inventory template\u0022\u003EData Inventory\u003C/a\u003E will help guide this.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EResponse:\u003C/strong\u003E Trustee Board to respond to data subject in electronic format and response logged.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Data Inventory template","buttonLink":{"name":"Data Inventory template","id":null,"url":"https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EDiscovery\u003C/h4\u003E\n\u003Cp\u003EDiscovery will entail either:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ECollecting the data specified by the data subject as part of their defined scope, or\u003C/li\u003E\n\u003Cli\u003ESearching all databases and all relevant filing systems (manual files) in the Scout Unit.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIt is suggested that the Trustee Board maintains a data inventory that identifies where all data within the Scout Unit is stored to make it easier and quicker when undertaking searches.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EResponding to a Subject Access Request (SAR)\u003C/h4\u003E\n\u003Cp\u003EThe Trustee Board is responsible for reviewing all provided documents to identify whether any third parties are identified in it and for either omitting or redacting identifying third party information from the documentation or obtaining written consent from the third party for their identity to be revealed. Consideration must also be given to ensure that nobody is put at risk by disclosing information.\u003C/p\u003E\n\u003Cp\u003EThird party data that is commonly reviewed includes email exchanges and incident reports that involves multiple individuals. \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/advice-for-small-organisations/frequently-asked-questions/right-of-accesssubject-access-requests-and-other-rights/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003EDiscover further guidance from the ICO\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EAny data subject can request access to their personal data, including children. In the case of children\u2019s requests, it is important to assess the competency of that child to make this request. \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-of-access/#children\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022 data-anchor=\u0022#children\u0022\u003ECheck out further guidance on this\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EIf the requested data falls under one of the following exemptions, it does not have to be provided:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ECrime prevention and detection\u003C/li\u003E\n\u003Cli\u003ENegotiations with the requester\u003C/li\u003E\n\u003Cli\u003EInformation used for research, historical or statistical purposes\u003C/li\u003E\n\u003Cli\u003EInformation covered by legal professional privilege\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe information should be provided to the data subject in electronic format unless otherwise requested and all the items provided are listed on a schedule that shows the data subject\u2019s name and the date on which the information is delivered.\u003C/p\u003E\n\u003Cp\u003EIn all cases care should be taken to redact all personal data or confidential information that the data subject should not see.\u003C/p\u003E\n\u003Cp\u003ETo assist in maintaining a log of the Subject Rights Requests (SRR) received and manage their progress, an \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk//media/qb3a1gjy/template-subject-rights-request-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Subjects Rights Request Register\u0022\u003ESRR Register is available\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Subject Rights Request Register template","buttonLink":{"name":"Subject Rights Request Register template","id":null,"url":"https://prod-cms.scouts.org.uk/media/qb3a1gjy/template-subject-rights-request-register.xlsx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Cp\u003EIn addition to the register, the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/wchge450/template-subject-access-request-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Template Subject Access Request Form\u0022\u003ESAR Form\u003C/a\u003E can be used to formalise the SAR with the data subject. The template form can be amended for use with the other types of rights requests.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Subject Access Request Form template","buttonLink":{"name":"Template Subject Access Request Form","id":null,"url":"https://prod-cms.scouts.org.uk/media/wchge450/template-subject-access-request-form.docx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Inventory template\u0022\u003EData Inventory template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/qb3a1gjy/template-subject-rights-request-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Subject Rights Request Register template\u0022\u003ESubject Rights Request Register template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/wchge450/template-subject-access-request-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Subject Access Request Form template\u0022\u003ESubject Access Request Form template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 4","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","id":47220,"nodeName":"Step 4: Understanding data subjects\u0027 rights","title":"Step 4: Understanding data subjects\u0027 rights","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 4: Understanding data subjects\u0027 rights","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyMCJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/"}