Personal data requests procedure
What do I do if I receive a request about a person’s personal data we are using?
We all, as individuals have rights when it comes to the personal data which organisations hold on us.
As a Girlguiding volunteer, you might receive a request from a person, wanting to exercise their rights about the data Girlguiding holds on or uses about that individual. You must deal with these requests properly, in line with data protection law and our own policies. This procedure explains how to do this.
Who must use this procedure?
As a Girlguiding volunteer over the age of 18, you must use this procedure. If you are supervising a young member or a volunteer who is under 18, you must make sure they know to report requests to you if they receive one.
Definition: An individual is any person aged 13 or over. Parents and carers can make personal data requests on behalf of children under 13.
What are the rights on personal data?
Data protection legislation gives individuals a number of rights over the personal data we hold and use about them. These six rights are:
- The right to be provided with copies of the data we hold about them (previously known as a Subject Access Request or SAR).
- The right to have the data we hold about them corrected if they believe it is wrong.
- The right to have the data we hold about them deleted.*
- The right to ask us to temporarily stop using the data we hold about them.*
- The right to question how we use the data we hold about them.*
- The right to be provided with copies of the data we hold about them in a format that can be used by another organisation.*
*These rights have exemptions allowing the Girlguiding to refuse the request if certain circumstances apply.
What type of request might I get?
You might be asked to:
- Provide copies of an individual’s data.
- Check or correct an individual’s data.
- Delete an individual’s data.
- Stop taking an action based on the information we hold about an individual.
Or you may receive requests like these:
- ‘I want to see and be provided with copies of the data you hold about me.’
- ‘The address you have for me is out of date, I want it corrected.’
- ‘I want you to delete my daughter’s data from your records.’
- ‘Why are you using my data? I haven’t given you permission to do that.’
- ‘Why am I getting emails about gifts from your on-line shop?’
- ‘Are you allowed to use my personal information for doing that.’
What do I do?
Girlguiding needs to respond as soon as possible. By law, Girlguiding HQ must respond to these types of requests within 30 days.
Sometimes you should sort the request yourself:
- If you’re asked to update information held in GO (ie a rectification request) this is a something which unit leaders are already responsible for doing, to maintain unit GO records accurately. A rectification request is simply a parent asking for an address to be updated, or asking you to record that someone has left your unit - you should do this yourself.
- You don’t need to inform HQ or the data protection team in these cases.
- Direct the person making the request to the personal data request forms which they can use to request their data.
- You should not make the request on their behalf.
- If they're not sure which form to fill in, or have more questions, then direct them to email [email protected] or call the data protection team on 020 7834 6242 ext. 3060.
We’re here to help
We want you to feel confident about how to direct these queries. By law Girlguiding HQ must respond to these types of requests within 30 days, so if you have any questions or concerns please contact: [email protected]
Or call the data protection team on 020 7834 6242 ext. 3060 for help.
Girlguiding policies and procedures are reviewed and updated from time to time as part of a review cycle.