{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThe operation of a local Scout Group, District, County/Area/Region (Scotland) or Country (collectively known as \u2018Scout Units\u2019) will inevitably involve the services of other organisations or companies. In the case where these parties process the personal data you control on your behalf, they are known as third party data processors.\u003C/p\u003E\n\u003Cp\u003EIn the first instance you should discover all third parties your local Scout Unit Country are working with. During this process it is important to understand the type of relationship you have with the third party, these can be broken down as follows:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EData controller to data processor, whereby the data controller enlists the services of the data processor to process data on their behalf\u003C/li\u003E\n\u003Cli\u003EData controller to data controller, where both independently determine the purpose for processing but there is a transfer of data between them\u003C/li\u003E\n\u003Cli\u003EJoint data controllers would be acting together to decide the purposes and manner of data processing\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIn all cases it is advisable to have at least an agreement in place between you. The type of agreement is dependent on the relationship;\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EData controller to data processor \u2013 requires a formal data processing agreement \u2013 \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/\u0022 target=\u0022_blank\u0022 title=\u0022ICO contracts guidance\u0022\u003EICO guidance has more information\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003EData controller to data controller \u2013 it is advisable to have a documented agreement or arrangement between them. This could be based on both having GDPR aligned privacy notices\u003C/li\u003E\n\u003Cli\u003EJoint data controllers - required to have a documented agreement or arrangement between them that determines each other\u2019s responsibilities\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EHere are examples of Scouting scenarios:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EData controller to data processor \u2013 Local Scout Unit to third party platform provider, such as Google (Google Suite) or Microsoft (Office 365)\u003C/li\u003E\n\u003Cli\u003EData controller to data controller - Local Scout Unit to - an event organising company, that require participants data to manage event activities\u003C/li\u003E\n\u003Cli\u003EJoint data controllers \u2013 Unlikely to be used within Scouting, but an example could be a Scout Group working with another Scout Group on an event whereby both are equally responsible for administering a joint participant database.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIt is advisable to maintain a record of all third-party relationships and to demonstrate that relationships align with the controls of the GDPR.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EThird party due diligence\u003C/h4\u003E\n\u003Cp\u003EThe procurement of new services or renewing of existing services with third parties should be completed with an appropriate level of due diligence.\u003C/p\u003E\n\u003Cp\u003EWhen considering a third party for the provision of a service the following criteria can be used as a guideline to reduce the risk involved with using this third party:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe reputation of this third party\u003C/li\u003E\n\u003Cli\u003EThe location of the third party and their service (when the data is classified as personal data this should ideally be in the UK, the European Economic Area, or an adequate country. Alternatively, there must be an appropriate and EU Commission recognised safeguard in place, see the section below on Adequacy.\u003C/li\u003E\n\u003Cli\u003EThe standards the third party measure themselves by, such as:\n\u003Cul\u003E\n\u003Cli\u003EISO 27001\u003C/li\u003E\n\u003Cli\u003EISO 27018\u003C/li\u003E\n\u003Cli\u003EISO 27701\u003C/li\u003E\n\u003Cli\u003EISO 9001\u003C/li\u003E\n\u003Cli\u003EPCI DSS\u003C/li\u003E\n\u003Cli\u003ESOC II\u003C/li\u003E\n\u003Cli\u003ECyber Essentials Plus\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe above detail is best captured directly from the third party. We have provided a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/egbnma2i/template-third-party-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Third Party Register template\u0022\u003ETemplate Third Party Register\u003C/a\u003E to assist with collecting this information.\u003C/p\u003E\n\u003Cp\u003EWhere the service provider has the potential to introduce a data protection risk, this should be assessed further. A tool to assist with this assessment is the Data Protection Impact Assessment (DPIA), which helps guide you through an analysis of the services and the provider. The DPIA is a risk assessment tool that considers both data privacy and information security.\u003C/p\u003E\n\u003Cp\u003EWe have produced a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/jkzb1sno/template-dpia.docx\u0022 target=\u0022_blank\u0022 title=\u0022DPIA template\u0022\u003ETemplate DPIA\u003C/a\u003E which you can use for this.\u003C/p\u003E\n\u003Cp\u003EThe decision to progress with a third party and service should be based on the output of the above assessments and made by appropriate members of the local Scout Unit Trustee Board.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EContracts\u003C/h4\u003E\n\u003Cp\u003EYou should review any existing contracts you have with the third party and check for its alignment to the GDPR. At a high level the agreement should consider the\u00A0following when it is a data controller to data processor relations, this type of structure can also be used for other relationship agreements;\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":false,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cul\u003E\n\u003Cli\u003Ethe subject matter and duration of the processing;\u003C/li\u003E\n\u003Cli\u003Ethe nature and purpose of the processing;\u003C/li\u003E\n\u003Cli\u003Ethe type of personal data and categories of data subject; and\u003C/li\u003E\n\u003Cli\u003Ethe obligations and rights of the controller;\u003C/li\u003E\n\u003Cli\u003Ethe processor must only act on the written instructions of the controller (unless required by law to act without such instructions);\u003C/li\u003E\n\u003Cli\u003Ethe processor must ensure that people processing the data are subject to a duty of confidence;\u003C/li\u003E\n\u003Cli\u003Ethe processor must take appropriate measures to ensure the security of processing;\u003C/li\u003E\n\u003Cli\u003Ethe processor must only engage a sub-processor with the prior consent of the data controller and a written contract;\u003C/li\u003E\n\u003Cli\u003Ethe processor must assist the data controller in providing subject access and allowing data subjects to exercise their rights under the GDPR;\u003C/li\u003E\n\u003Cli\u003Ethe processor must assist the data controller in meeting its GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments;\u003C/li\u003E\n\u003Cli\u003Ethe processor must delete or return all personal data to the controller as requested at the end of the contract; and\u003C/li\u003E\n\u003Cli\u003Ethe processor must submit to audits and inspections, provide the controller with whatever information it needs to ensure that they are both meeting their Article 28 obligations, and tell the controller immediately if it is asked to do something infringing the GDPR or other data protection law of the EU or a member state.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe Information Commissioner\u2019s Office (ICO) have \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/\u0022 target=\u0022_blank\u0022 title=\u0022ICO contracts guidance\u0022\u003Eprovided comprehensive guidance on the structure of such an agreement\u003C/a\u003E.\u003C/p\u003E","label":"Compulsory"}]},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EAdequacy\u003C/h4\u003E\n\u003Cp\u003EIn addition to the contract structure it is important to assess the third party based on the data location. This is known as the adequacy and is specifically focused on ensuring the third party are in the UK or an EU country, and hence bound by the GDPR, or they are in a nation that offers the same levels of data protection.\u003C/p\u003E\n\u003Cp\u003EIn cases where a nation has been found to align to the GDPR a relationship is brokered between themselves and the UK, known as an adequacy agreement. It is then the responsibility of the third party to become a subscriber to the nation\u2019s agreement and be measured against it. An example is the EU Privacy Framework that exists between the United States and the EU. Companies and organisations that are in the US and processing data of EU and UK citizens should align to this framework. A list of adequate countries can be found \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/\u0022 target=\u0022_blank\u0022 title=\u0022ICO guide to international transfers\u0022\u003Eon the ICO Website\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EAs the majority of cloud based solution providers reside in the US its worth checking the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://www.dataprivacyframework.gov/s/\u0022 target=\u0022_blank\u0022 title=\u0022Data Privacy Framework\u0022\u003EData Privacy Framework register\u003C/a\u003E to see if the third party is part of the framework already.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EData sharing\u003C/h4\u003E\n\u003Cp\u003EFinally, consideration needs to be made when transferring data to a third party, specifically around the mechanism used to complete this transfer.\u003C/p\u003E\n\u003Cp\u003EA data transfer can be anything from a paper form sent via post or electronic transfer via email or directly through websites. In all cases care should be taken to secure the transfer. Basic techniques for securing these kinds of transfers would be the use of special delivery services from the postal service and encryption for electronic systems.\u003C/p\u003E\n\u003Cp\u003EOn occasion, data sharing may be required with ad-hoc third parties with whom there is no contract relationship, but the sharing is necessary for certain conditions. These conditions could include the referral of a safeguarding concern to UK HQ, a request for information from a police officer or request from a member\u2019s solicitor for data. Where these requests do not meet the criteria to be processed as a Subject Access Request they should be treated as followed:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ERequest for information \u2013 Where a request is made to you for information it is important to make sure the request is assessed and responded to appropriately. This should include identifying the requestor and ensuring their grounds for data sharing are appropriate. In most cases it is not appropriate or possible to gain the consent of the data subject, therefore another lawful basis needs to be aligned.\u003C/li\u003E\n\u003Cli\u003EDisclosure of information \u2013 There may be occasions where the Local Scout Unit are looking to make a voluntary disclosure of information, such as to UK HQ for a safeguarding concern with a young person. In this case consent of the data subject is not an appropriate lawful basis, therefore this disclosure should be assessed and captured.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIn both cases, where data is being disclosed or requested it is important that the assessment of the situation is expedient and balanced and should consider any safety to individuals first, the below are a series of guiding principles to consider with the sharing of data, specifically in safeguarding scenarios:\u003C/p\u003E\n\u003Cp\u003EThe sharing of information should be completed with justification and awareness. Please read the full guidance:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":false,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose\u003C/strong\u003E - can I explain the activity? The purpose of the sharing needs to be clear and easy to understand so that the data subject gets a good idea of what is happening with their personal data.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimisation\u003C/strong\u003E - what do I need? The personal data being shared should be limited to only what is required for the purpose defined.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ELawful\u003C/strong\u003E - The data sharing should be aligned to a lawful basis, such as legitimate interest, consent, performance of a contract etc. In most cases this would be legitimate interest, or consent from the young person or their parents/carer.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccurate\u003C/strong\u003E - is the data accurate and up to date? The personal data being shared should be accurate and up to date, this is an ongoing obligation.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ESecure\u003C/strong\u003E - is the personal data secure in transfer and at the target? The personal data should be appropriately secured with the receiving party and during transfer\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ERetention\u003C/strong\u003E - how long is the personal data required? The sharing of personal data is still bound by a requirement to align a retention period, this is the obligation of the receiving party. In the example of the Scout Group transferring personal data to the Scout District, the Scout District should align a retention period for the data they receive. For example, the personal data is required to contact the young people or their parents/carers to inform them of the Explorer Scout programme. If the young person or their parent/carer do not respond or are not interested then the data should be deleted after a defined period. If the young person is enrolled for Explorer Scouts then this is a separate processing activity and susceptible to the Scout District\u2019s retention policy.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ETransparency\u003C/strong\u003E - is it clear to the data subject what is happening with their personal data? In all cases where data is being shared with another party the data subject should be informed of this. This should be added as part of your Privacy Policy (usually on your website or in paper form) or via a Privacy Notice on the form the young person or parent/carer completed, further guidance can be found here.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAgreement\u003C/strong\u003E - do we have an agreement between us? The detail captured as part of the review of the GDPR principles should form the basis of the agreement between the two parties.\u003C/li\u003E\n\u003C/ul\u003E","label":"Full guidance"}]},{"gridType":"RichTextBlock","content":"\u003Cp\u003E\u00A0\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/egbnma2i/template-third-party-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Third Party Register template\u0022\u003EThird Party Register template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/n3umcwxn/template-legitimate-interest-assessment.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Legitimate Interest template\u0022\u003ELegitimate Interest Assessment tool\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/jkzb1sno/template-dpia.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Privacy Impact Assessment template\u0022\u003EData Privacy Impact Assessment template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 9","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","id":47226,"nodeName":"Step 9: Third parties","title":"Step 9: Third parties","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 9: Third parties","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyNiJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/"}