Delete/destroy data you no longer need

Individuals have the right to be forgotten and can request that you erases their personal data when:

• it is no longer necessary in relation to the purpose for which it was originally collected/processed

• the individual withdraws consent

• the individual objects to the processing and there is no overriding legitimate interest for continuing the processing

• it was unlawfully processed (ie otherwise in breach of the GDPR)

• it has to be erased in order to comply with a legal obligation

• it is processed in relation to the offer of information society services to a child

These requests will be received initially by the data controller however, if the data in question is also processed or stored by you, then you will need to have the appropriate procedures in place in order to ensure the data is erased permanently.

Whilst the use of the data is required for the provision of local Scouting operations, the longer-term retention needs to be justified.

For example:

• The young person’s awards records are retained for a defined period when they leave in case they wanted to return and continue

• Adult volunteer data is retained for a defined period post leaving for the purposes of ongoing handover of the appointment

• Gift aid data needs to be retained for 7 years to meet audit requirements by HMRC

• If justification cannot be made for the retention of data, then it should be securely deleted at the point it is no longer required

In short - if you don't need it delete or destroy (shred) it!