Contact us

Identify why you need personal data and how you use it

Once you have identified the personal data you collect you need to identify your ‘lawful basis’ for processing it.

There are six available lawful bases for processing personal data (see appendix 1 to see them all). None of them are stronger or more important than the others. The most appropriate basis to use will depend on the reason for processing the personal data and your relationship with the individual.

Many organisations will not have thought about their lawful basis for processing personal data. Under the current law this does not have many practical implications. However, this will be different under the GDPR because some individuals’ rights will be modified depending on your lawful basis for processing their personal data. The most obvious example is that people will have a stronger right to have their data deleted where you use consent as your lawful basis for processing.

In the majority of cases Legitimate interests will be the valid lawful basis why your Scout Group processes a person’s personal data. This means, (See below for more information about the lawful basis 'legitimate interests'.)

”the processing is necessary for the persons legitimate interests or the legitimate interests of your Scout Group unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests”

 

For example:

  • The collection of young people’s medical records is necessary for the protection of that young person whilst in the care of the scout group

  • The collection of young people’s religion is necessary to respect their beliefs with regards to activities, food and holidays

  • The collection of adult volunteers data is necessary for the purposes of disclosure checks and safeguarding

 

If you can’t justify the reason behind the gathering or use of a certain type of personal or sensitive personal data, then you shouldn’t request/collect it. This guidance will come from your executive committee - as the data controller.

You must keep a record of your lawful basis and update your privacy information (see our section on privacy notice). You will also have to explain your lawful basis if a person asks for a copy of all the information you have about them (see our section on right to access).

Click here to download our lawful bases processing register