Subject access and other rights requests
How to make a personal data request, and what to do if you receive one
Page last updated 1 October 2025.
See change log for recent updates to this webpage.
Find out what's changed and why in the most recent updates to this procedure.
This page is part of our managing information procedure.
This procedure explains how to follow the managing information policy, and how to make and respond to data subject rights requests.
This procedure is for volunteers. Girlguiding employees must use the staff procedure on the intranet.
Making a data request
Who can make a data request?
Data protection law allows people to control the data held about them by organisations. This means they can ask for a copy of this data, or for the data to be corrected or removed. You can find out more about your personal data rights on the Information Commissioner’s Office website.
If you’re a volunteer, young member over the age of 14, or a parent or carer you can make a personal data request to Girlguiding. Parents and carers of young members under the age of 14 can make a request on behalf of their child.
Correcting and updating your personal data
Before making a request to correct or update your data, check whether you or your local guiding team can resolve any issues first.
- If you’re a volunteer, young member over the age of 14, or a parent or carer you can check and update personal data on Girlguiding’s online platforms yourself.
- Speak to your unit leader or local commissioner about updating any other records.
How to make a data request
There are 2 types of data request you can make – an individual rights request, and a subject access request.
Complete the individual rights request form (Word, 234 KB) if you want to:
- Correct your personal data.
- Delete your personal data.
- Object to the further processing of your personal data.
- Be provided with copies of the data we hold on you in a format another organisation can use.
Complete the subject access request form (Word, 233 KB) if you want to request a copy of the information Girlguiding holds about you.
Once you’ve completed the form, email it to the HQ data protection team at [email protected]. You can also send the form to the data protection team at Girlguiding, 17-19 Buckingham Palace Road, London, SW1W 0PT.
If you have any questions or issues, get in touch emailing [email protected], or call us on +44 (0)20 7834 6242 ext. 3060.
What happens next?
You’ll hear from us within 30 days.
The processes for individual rights requests and subject access requests are different, and you can find out more about them on each of the forms.
There are some exemptions under data protection law which allow Girlguiding to refuse personal data requests in certain circumstances. If an exemption applies, we’ll let you know why we can’t complete your request.
If you’ve made a subject access request, the information you receive may be redacted to protect data related to other people.
Receiving and responding to data requests
As a Girlguiding volunteer you might receive a data request from someone else involved in Girlguiding. These requests must be responded to. They can either be dealt with locally, if appropriate, or forwarded on to the HQ data protection team. You must not make a request on someone else’s behalf.
You might be asked to:
- Provide copies of someone’s data.
- Check or correct someone’s data.
- Delete someone’s data.
- Stop taking an action based on the data we hold about someone.
Or you may receive questions like:
- ‘I want to see and be provided with copies of the information you hold about me.’
- ‘I want you to delete my daughter’s information from your records.’
- ‘Why are you using my data? I haven’t given you permission to do that.’
- ‘Are you allowed to use my personal data to do that?’
If the query is about updating personal details, you can do this locally. Volunteers, young members over the age of 14, and parents or carers can log in to GO and update their details themselves. It’s important you support others to update their details, or make the updates for them. You don’t need to let the HQ data protection team know about updating details on our online platforms.
If you receive a request for information from a non-Girlguiding member, including the police, an embassy or another agency, direct them to contact the HQ data protection team.
We’ll make sure their request is legitimate. If necessary, we may come back to you for any relevant information you hold.
What happens next?
By law Girlguiding must respond to data requests within 30 days. Your help is important so we can meet this deadline.
Once the team at HQ has reviewed a data request, we may get in touch to find out what information you have locally.
Commissioners may need to help gather information held about the person at a local level. This includes any mention of the person in emails or social media communications. If this is needed, the HQ data protection team will let you know exactly what you need to do and whether this can be delegated to someone else with the same level of access to personal data as you.
We may ask volunteers to review and share information from any email accounts used in their Girlguiding role if they hold relevant personal data. The HQ data protection team will support you with this.
