Publish your privacy notices

The right to be informed covers some of the key transparency requirements of the GDPR. It is about providing people with clear and concise information about what you do with their personal data.

Using an effective approach to provide people with privacy information can help you to comply with other aspects of the GDPR, foster trust with individuals and obtain more useful information from them.

A privacy notice is information presented to your members (young people and adults), at the point they are disclosing their personal data to you. This could be through an online or paper form.

The concept behind the notice is that it is:

• concise
• transparent
• intelligible
• easily accessible
• written in clear and plain language
• free of charge.

You must actively provide privacy information to individuals. You can meet this requirement by putting the information on your website or information sheet, but you must make individuals aware of it and give them an easy way to access it. Your privacy notice must be given to individuals whenever you collect their personal data, both online and offline.

Children have the same rights as adults so, when you collect children’s personal data, you must take particular care to ensure that the information you provide them with is appropriately written, using clear and plain language and presented in a way that appeals to a young audience.

If you are relying upon parental consent as your lawful bases for processing it will be good practice to provide separate privacy notices aimed at both the child and the responsible adult.

• the name and contact details of your scout group
• The name (this can be the role title), and contact details of your data protection lead
• The purposes of the processing
• The lawful basis for the processing
• The legitimate interests for the processing
• The details of transfers of the personal data to any third parties (eg OSM)
• The retention periods for the personal data
• The rights available to individuals in respect of the processing
• The right to withdraw consent
• The right to lodge a complaint with a supervisory authority

Your information audit or data mapping exercise can help you find out what personal data you hold and what you do with it.

You should think about the intended audience for your privacy information and put yourself in their position.

There are a number of techniques you can use to provide people with privacy information. You can use:

• A layered approach – short notices containing key privacy information that have additional layers of more detailed information.
• Dashboards – preference management tools that inform people how their data is used and allow them to manage what happens with it.
• Just-in-time notices – relevant and focused privacy information delivered at the time individual pieces of information about people are collected.
• Icons – small, meaningful, symbols that indicate the existence of a particular type of data processing.
• Mobile and smart device functionalities – including pop-ups, voice alerts and mobile device gestures.

Taking a blended approach, using more than one of these techniques, is often the most effective way to provide privacy information.

It is good practice to carry out user testing on your draft privacy notice to get feedback on how easy it is to access and understand.

After it is finalised, undertake regular reviews to check it remains accurate and up to date.

If you plan to use personal data for any new purposes, you must update your privacy information and proactively bring any changes to people’s attention.

When you collect personal data from the individual it relates to, you must provide them with privacy information at the time you obtain their data.

When you obtain personal data from a source other than the individual it relates to, you need to provide the individual with privacy information:

• within a reasonable of period of obtaining the personal data and no later than one month;
• if the data is used to communicate with the individual, at the latest, when the first communication takes place
• if disclosure to someone else is envisaged, at the latest, when the data is disclosed.

You must actively provide privacy information to individuals. You can meet this requirement by putting the information on your website, but you must make individuals aware of it and give them an easy way to access it.

When collecting personal data from individuals, you do not need to provide them with any information that they already have.

When obtaining personal data from other sources, you do not need to provide individuals with privacy information if:

• the individual already has the information
• providing the information to the individual would be impossible
• providing the information to the individual would involve a disproportionate effort
• providing the information to the individual would render impossible or seriously impair the achievement of the objectives of the processing
• you are required by law to obtain or disclose the personal data
• you are subject to an obligation of professional secrecy regulated by law that covers the personal