{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EToday\u2019s technology age means that there are many tools available to us all when it comes to the management of our day-to-day jobs and activities.\u003C/p\u003E\n\u003Cp\u003EThis situation exists within local Scouting and in most cases, you will opt to use the tooling you are familiar with or makes your operation as easy as possible. The below guidance draws out these technologies and provides guidance on the security measures that should be considered:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EPaper\u003C/h4\u003E\n\u003Cp\u003EWhilst not strictly a technology, paper is still used to capture and retain data. This is the case within Scouting and as such needs to be considered, for example paper-based records could exist for the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ENew joiners form\u003C/li\u003E\n\u003Cli\u003ENew joiners waiting lists\u003C/li\u003E\n\u003Cli\u003EEvents consent from parents\u003C/li\u003E\n\u003Cli\u003EAnnual health records updates\u003C/li\u003E\n\u003Cli\u003EEvents coordination with events companies\u003C/li\u003E\n\u003Cli\u003EAward notifications/nominations\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe following should be considered when using paper:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ENot digitally searchable \u2013 not easy to find specific information\u003C/li\u003E\n\u003Cli\u003EIf lost or damaged it\u2019s not recoverable\u003C/li\u003E\n\u003Cli\u003ENot easy to transfer\u003C/li\u003E\n\u003Cli\u003EProne to error or misinterpretation\u003C/li\u003E\n\u003Cli\u003ERequires physical storage and security\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIn some cases, paper-based records are justified or are the only means of data capture, where this is the case then duty of care needs to be considered, such as:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EMinimise the use of paper to only what is required.\u003C/li\u003E\n\u003Cli\u003ETransfer of paper is secure, such as physical hand-to-hand transfer or registered post.\u003C/li\u003E\n\u003Cli\u003EPaper forms are securely destroyed after use, if possible.\u003C/li\u003E\n\u003Cli\u003ESecure destruction should be through a shredding machine.\u003C/li\u003E\n\u003Cli\u003EKeep the paper records secure always, especially when in transit, consider using:\n\u003Cul\u003E\n\u003Cli\u003EA lockable brief case.\u003C/li\u003E\n\u003Cli\u003EA lockable filing cabinet if long term stored.\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EIf transferred to somebody, audit that they return them when complete.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EPaper should be considered transient wherever possible and not for longer-term storage, meaning that the data should ideally be transferred as soon as possible to a digital system and then the paper medium securely destroyed.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EDigital forms\u003C/h4\u003E\n\u003Cp\u003EDigital forms offer the ability to capture data in a digital means via a website link. The form is presented to the person entering the details as designed by yourself.\u003C/p\u003E\n\u003Cp\u003EThe following should be considered when using web forms/online surveys:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EDigital forms can be from your own website, online survey tool or a membership database.\u003C/li\u003E\n\u003Cli\u003EDigital forms are widely used and accepted as means of gathering data.\u003C/li\u003E\n\u003Cli\u003EThey need to be carefully created to capture only the data required and offer a clear capture flow, see \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/\u0022 title=\u0022Step 5: Gathering data\u0022\u003EStep 5: Gathering data\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003EDigital forms reduce mistakes of data capture.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhere web forms or digital surveys are being used the following best practices should be considered:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe presentation of the form is easy to understand and follow.\u003C/li\u003E\n\u003Cli\u003EThe form itself is using a secure transfer mechanism, the link to it should start with \u2018HTTPS://\u2019.\u003C/li\u003E\n\u003Cli\u003EYou understand how the data is used after the form is completed, is it emailed to yourself, is it retained within a database where the form is located?\u003C/li\u003E\n\u003Cli\u003EIf the detail is emailed to yourself post it being completed, this email should be treated with care and deleted when not required any further.\u003C/li\u003E\n\u003Cli\u003EIf the data is retained in a forms database, then ensure access to this database is protected by a strong username and password and the access to it is limited to only those that require the data.\u003C/li\u003E\n\u003Cli\u003EDelete any data that is not needed from the locations it is stored.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EDigital forms are a good way to gather accurate data in a secure way.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EE-Mail\u003C/h4\u003E\n\u003Cp\u003EThe most common communication tool used today is e-mail. This can be either personal or corporate e-mail from a large variety of providers. E-mail is used commonly to transfer all types of data and can be used to transfer documents with information in or the data directly in the body of the e-mail itself. It is worth being aware that 85% of all reported data breaches in the UK come from sending e-mail to the wrong recipient.\u003C/p\u003E\n\u003Cp\u003EThe following should be considered when using e-mail to gather or transfer data:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EE-mails are sent in clear text, this means that if they are intercepted the contents can be read.\u003C/li\u003E\n\u003Cli\u003EMost e-mail systems retain lots of copies of the data sent and received, for example in:\n\u003Cul\u003E\n\u003Cli\u003EInbox folder\u003C/li\u003E\n\u003Cli\u003ESent items folder\u003C/li\u003E\n\u003Cli\u003EDeleted folder\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EIt is easy to mistype an e-mail address or select an incorrect pre-populated address.\u003C/li\u003E\n\u003Cli\u003EThe security of an e-mail system varies depending on the service provided.\u003C/li\u003E\n\u003Cli\u003EE-mails can be stored locally on your laptop/desktop.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhere e-mail is being used the following best practices should be considered:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EFree e-mail services generally lack a level of security appropriate for sending lots of sensitive personal data.\u003C/li\u003E\n\u003Cli\u003EReview the e-mail service you have; good service add-ons include:\n\u003Cul\u003E\n\u003Cli\u003EAnti-virus scanning\u003C/li\u003E\n\u003Cli\u003EAnti-malware scanning\u003C/li\u003E\n\u003Cli\u003EEncrypted e-mail\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EDelete e-mails when they are no longer required, especially if they contain data within attachments, this should be from the folders highlighted above.\u003C/li\u003E\n\u003Cli\u003EAdd a delay to the sending of your e-mails by 2 minutes. Most email clients allow this as a \u2018Rule\u2019, any mis-typed email can then be stopped before it leaves.\u003C/li\u003E\n\u003Cli\u003EDon\u2019t store your e-mails locally on your laptop/desktop to minimise the data you store.\u003C/li\u003E\n\u003Cli\u003EMinimise the use of e-mail to what is necessary when it comes to gathering or transferring data.\u003C/li\u003E\n\u003Cli\u003ETake care when replying to all in the email chain, you may not want all email participants to be part of any ongoing communications.\u003C/li\u003E\n\u003Cli\u003EIf you are looking to email multiple individuals and don\u2019t want everybody to see the email addresses on the distribution list, then simply add all of their email addresses to the \u2018BCC\u2019 field. You can then add your own email address in the \u2018TO\u2019 field, this will mask all addresses except yours.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAdditionally, e-mail mass mailers may be used to communicate with members for group updates, events and other operational means. When looking at a service like this you should consider the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIs the service with a reputable provider?\u003C/li\u003E\n\u003Cli\u003EDoes that provider align to the GDPR?\u003C/li\u003E\n\u003Cli\u003EIs the data set you are providing minimised to only what is required?\u003C/li\u003E\n\u003Cli\u003EDoes the data get stored with the provider, if so, can you delete it when finished with?\u003C/li\u003E\n\u003Cli\u003EE-mail is an effective way to communicate but can lead to lots of data across lots of folders.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003ELaptop/Desktop/Tablet\u003C/h4\u003E\n\u003Cp\u003ELaptops/desktops/tablets are common place in most households as well as in people\u2019s place of work. As volunteers within the Scouts you will probably have access to or be using this type of technology to manage the operations for local Scouting.\u003C/p\u003E\n\u003Cp\u003ESecurity of laptops/desktops/tablets is key when gathering/storing or transferring data, the security already in place for the physical device could vary depending on whether this is company or personal asset and your line of work.\u003C/p\u003E\n\u003Cp\u003EThe following should be considered when using a laptop/desktop/tablet to gather, store or transfer data:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIs the laptop/desktop/tablet a shared resource?\u003C/li\u003E\n\u003Cli\u003EWho owns the laptop/desktop/tablet and is ultimately responsible for it?\u003C/li\u003E\n\u003Cli\u003EHow is the laptop/desktop/tablet to be used?\u003C/li\u003E\n\u003Cli\u003EIs data stored locally on the device or is it located within an online system?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhere a laptop/desktop/tablet is being used, the following best practices should be considered:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe laptop/desktop/tablet is protected by a username and strong password, strong is defined as:\n\u003Cul\u003E\n\u003Cli\u003EConsists of at least eight characters.\u003C/li\u003E\n\u003Cli\u003ECombination of letters, numbers and symbols (@, #, $, %, etc.).\u003C/li\u003E\n\u003Cli\u003EContains letters in both uppercase and lowercase.\u003C/li\u003E\n\u003Cli\u003EDoes not include whole words that are unique to you.\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EThe laptop/desktop/tablet includes hard disk encryption \u2013 Check your operating system provider and search for options of hard disk encryption.\u003C/li\u003E\n\u003Cli\u003ESoftware packages such as anti-virus and anti-malware are included.\u003C/li\u003E\n\u003Cli\u003ESoftware on the laptop/desktop/tablet is up-to-date.\u003C/li\u003E\n\u003Cli\u003EImplement a digital password safe to store all passwords you must remember, there are many free tools available.\u003C/li\u003E\n\u003Cli\u003EStorage of data locally is minimised to only what is required.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003ELaptops especially are very useful for mobile management of local Scouting, but the mobile element introduces a loss or theft risk. Reduce the exposure by considering the measures above.\u003C/p\u003E\n\u003Cp\u003EIn addition to this guidance there is a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nlvjckjg/template-data-security-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Template Data Security Register\u0022\u003ETemplate Data Security Register\u003C/a\u003E that you can use to help maintain a list of the types of media used in local Scouting. This register can also act as a risk register for any media types that need to be reviewed or tracked as a risk.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/nlvjckjg/template-data-security-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Security template\u0022\u003EData Security Register template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 8","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","id":47225,"nodeName":"Step 8: Check your security","title":"Step 8: Check your security","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 8: Check your security","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyNSJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/"}