{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EOnce the data in use and the processes for gathering the data are understood, there is a requirement to keep a record of these. The GDPR introduces a key principle for organisations to be accountable for their data processing activities. This means that it is essential to have this detail captured in a processing register.\u003C/p\u003E\n\u003Cp\u003EThe processing of personal data is the activity where you gather, transfer or do something with the data, such as events registration, passing this data to the event facility and contacting the registrants with detail of the event.\u003C/p\u003E\n\u003Cp\u003EThe \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Inventory template\u0022\u003ETemplate Data Inventory\u003C/a\u003E is available for use by Trustee Boards to capture this detail.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Data Inventory template","buttonLink":{"name":"Template Data Inventory","id":null,"url":"https://prod-cms.scouts.org.uk//media/nizfq205/template-data-inventory.xlsx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Cp\u003EWhen recording the processing activities, it is key to align each of these to a pre-defined justified purpose, known as the lawful basis for processing. There are 6 of these that align to personal data (name, address, email etc.) and eleven for sensitive (special category) data (ethic origin, medical conditions etc.).\u003C/p\u003E\n\u003Cp\u003EThere are a number of these, however it will usually materialise that only a few will be required. Here are some examples of these:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EPersonal data\u003C/h4\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EConsent of the data subject:\u003C/strong\u003E Should be used for communications preferences or consent for the use of photographic images (however legitimate interest may also be appropriate for photography, \u003Ca href=\u0022/volunteers/staying-safe-and-safeguarding/safeguarding-in-the-programme/recording-at-scout-events/\u0022 title=\u0022Photography, video and audio recording at Scout events\u0022\u003Echeck out further guidance\u003C/a\u003E).\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing is necessary for the performance of a contract:\u003C/strong\u003E Should be used for the personal data gathered and processed as part of a member joining.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing is necessary for compliance with a legal obligation:\u003C/strong\u003E Should be used for the retention of records as part of accident reporting.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ENecessary for the purposes of legitimate interests pursued by the controller or a third party:\u003C/strong\u003E Should be used for the passing of a waiting list from one local Scout Group to another, this is for personal data only (name, address, email etc.).\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing is necessary to protect the vital interests of the data subject or of another natural person:\u003C/strong\u003E Should be used when passing personal data of a Scout member to paramedics, or other healthcare professional, when they are administering care to them, such as their name and address. This should be used in conjunction with the special category condition for vital interests. When sensitive data is also required to be disclosed, consent is not required.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003ESensitive (special category data)\u003C/h4\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EExplicit consent of the data subject:\u003C/strong\u003E Should be used if you are required to transfer the data to a third party, such as for an event.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing is necessary to protect the vital interests of a data subject:\u003C/strong\u003E Should be used in an emergency situation where you need to pass data to a medical professional.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EProcessing carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided the processing relates only to members or former members:\u003C/strong\u003E Should be used for the sensitive (special category) data gathered and processed as part of a joining member or event registration, where the data is not passed on to a third party.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhen choosing the lawful basis behind the processing activity it is worth noting that consent allows the data subject to rescind their permission for the processing activity. In addition, if legitimate interest is chosen you should consider that the data subject can challenge your purpose and justification. It\u0027s good practice to offer a process for opting out of the activity, such as email communications. Check out the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/3lwkbh23/lawful-basis.pdf\u0022 target=\u0022_blank\u0022 title=\u0022Lawful basis\u0022\u003Efull list of lawful basis\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EIf legitimate interest is the chosen lawful basis for processing, then it is important to maintain a record of this activity. It is also important that the record shows how the decision was made and that the legitimate interest balances between the organisations purpose and the rights to freedom of the data subject. To assist, you can use our \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/n3umcwxn/template-legitimate-interest-assessment.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Legitimate Interest Assessment\u0022\u003ELegitimate Interest Assessment\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EPhotographs, film and audio recordings\u003C/h4\u003E\n\u003Cp\u003E\u003Ca href=\u0022/volunteers/staying-safe-and-safeguarding/safeguarding-in-the-programme/recording-at-scout-events/\u0022 title=\u0022Photography, video and audio recording at Scout events\u0022\u003ERead our guidance regarding the use of photographs, film and audio recordings\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nizfq205/template-data-inventory.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Inventory template\u0022\u003EData Inventory template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/3lwkbh23/lawful-basis.pdf\u0022 target=\u0022_blank\u0022 title=\u0022Lawful Basis\u0022\u003EList of Lawful Basis\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/n3umcwxn/template-legitimate-interest-assessment.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Legitimate Interest assessment tool\u0022\u003ELegitimate Interest Assessment Tool\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 7","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","id":47224,"nodeName":"Step 7: Keep a record","title":"Step 7: Keep a record","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 7: Keep a record","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyNCJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/"}