{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EWhen it comes to the protection of data you first need to understand what data you have and where it is.\u003C/p\u003E\n\u003Cp\u003EAs part of local Scouting, sensitive personal data (also known as special category data) is gathered, processed and transferred frequently. For example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ENew joiner details for either an adult volunteer or a young person\u003C/li\u003E\n\u003Cli\u003EProcessing of this data for the purposes of events, awards, moving on\u003C/li\u003E\n\u003Cli\u003EAnnual reviews of this data through Census (even though this is provided to UK HQ anonymously) or further data gathering to update medical records\u003C/li\u003E\n\u003Cli\u003EManagement of safeguarding incidents where data needs to be transferred to UK HQ for assistance\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EConsideration needs to be made when collecting, managing and transferring the data required to operate Scouting locally.\u003C/p\u003E\n\u003Cp\u003EThis can be broken down into simple questions to ask yourself:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhat?\u003C/h4\u003E\n\u003Cp\u003EWhat data am I collecting on the adult volunteers and youth members? Do I know the details I am asking the individuals to give me? This could be details such as:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EName\u003C/li\u003E\n\u003Cli\u003EAddress\u003C/li\u003E\n\u003Cli\u003EEmail address\u003C/li\u003E\n\u003Cli\u003EDate of birth\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThese data types are known as personal data, this becomes sensitive personal data when you add information such as:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ERace\u003C/li\u003E\n\u003Cli\u003EEthnic origin\u003C/li\u003E\n\u003Cli\u003EReligion\u003C/li\u003E\n\u003Cli\u003EHealth conditions\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe data being gathered and processed should only be the data necessary and be as minimal as possible. Asking for something you don\u2019t need is not justified.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhy?\u003C/h4\u003E\n\u003Cp\u003EWhy am I collecting the data? Can I determine a reason for this data collection and use, and does that align with the lawful purposes as defined by the GDPR? For example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe collection of young people\u2019s medical records is necessary for the protection of that young person whilst in the care of the Scout Group giving a legitimate reason to do so, but medical records are sensitive personal data (special category) and if they are required to be passed to a third party then they should only be gathered using consent, or if someone\u2019s life is at risk.\u003C/li\u003E\n\u003Cli\u003EThe collection of young people\u2019s religion may be necessary to respect their beliefs in regard to activities, food and holidays, but ethnicity and religious records are sensitive personal data (special category).\u003C/li\u003E\n\u003Cli\u003EThe collection of adult volunteers\u2019 personal data is necessary for the purposes of disclosure checks and safeguarding.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf you can\u2019t justify the reason behind the gathering or use of a certain type of personal or sensitive personal data (special category), then you shouldn\u2019t. This guidance will come from your Trustee Board.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EHow?\u003C/h4\u003E\n\u003Cp\u003EThere are many means by which you can gather and use data, this is explored further in \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/\u0022 title=\u0022Step 7: Keep a record\u0022\u003EStep 7: Keep a record\u003C/a\u003E. However the key question is; how am I collecting the data and how am I using it?\u003C/p\u003E\n\u003Cp\u003EThe consideration needs to be whether you can demonstrate that you have thought the process through and used all means available to collect, process and store data in the most appropriate way.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhen?\u003C/h4\u003E\n\u003Cp\u003EWhen should I delete the data I hold? Whilst the use of the data is required for the provision of local Scouting operations, the longer-term retention needs to be justified. For example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe young person\u2019s awards records are retained for a defined period when they leave in case they wanted to return and continue.\u003C/li\u003E\n\u003Cli\u003EAdult volunteer data is retained for a defined period post leaving for the purposes of ongoing handover of the appointment.\u003C/li\u003E\n\u003Cli\u003EGift Aid data needs to be retained for seven years to meet audit requirements by HMRC.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf justification cannot be made for the retention of data, then it should be securely deleted at the point it is no longer required. More information on this can be found in \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/\u0022 title=\u0022Step 11: Delete and destroy\u0022\u003EStep 11: Delete and destroy\u003C/a\u003E, which provides further guidance on retention periods and the secure destruction of data.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWho?\u003C/h4\u003E\n\u003Cp\u003EWho can access the data? This access could be via memberships systems, paper records or via email. In all cases the access to this data needs to be minimised to only who needs it and, if possible, only the subset of data they need, for example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe Group Scout Leader and Section Leader will require access to data for the young people and adult volunteers in their Group.\u003C/li\u003E\n\u003Cli\u003EAdult volunteers may require access to the data of the young people but potentially not to the other adult volunteers in their Scout Group.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf any of the above are in doubt, then please refer to your Trustee Board for guidance. The questions above should be asked to assist in the protection of personal and sensitive personal data, in the case of local Scouting, this is young people\u2019s data and duty of care should be considered.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhere?\u003C/h4\u003E\n\u003Cp\u003EThere are many places this data can be stored, and these will normally be chosen based on ease of use or what you are used to using. Where do you store the data you have for local Scouting? Consideration needs to be made as to where the data is stored such as:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIs the storage system secure and safe?\u003C/li\u003E\n\u003Cli\u003EWho needs access to the system and can we easily collaborate?\u003C/li\u003E\n\u003Cli\u003ECan I trace access to the storage location and minimise where necessary?\u003C/li\u003E\n\u003Cli\u003EIs there a reputable system available today that I can use, such as secure cloud storage or an online membership system?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAll of the above questions help in constructing an appropriate data protection policy where you are capturing data. \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/\u0022 title=\u0022Step 10: Publish your privacy stance\u0022\u003EStep 10: Publish your privacy stance\u003C/a\u003E explores this further.\u003C/p\u003E","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","id":47223,"nodeName":"Step 6: Data discovery","title":"Step 6: Data discovery","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 6: Data discovery","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyMyJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/"}