Data Protection Policy

Draft v2 — published temporarily while this policy is pending Board adoption.

The internal governance framework showing how UYN complies with UK GDPR and the Data Protection Act 2018. For trustees, staff, mentors and volunteers; distinct from the public-facing Privacy Policy.

Document Control

Status	Draft — pending Board adoption (target: 30 November 2026)
Adopted / Adapted / UYN’s own	UYN’s own. Section structure and appendices adapted from a school-sector model data protection policy; school-specific content removed or replaced.
Review period	Annually (the first review at six months after adoption)
Responsible lead	Board of Trustees (owner); Data Protection Lead (day-to-day)
Statutory	Statutory and legal
Required on website	Yes
Ratified by Board on	[date — to be completed on adoption]
Review due	[date — to be completed on adoption]
Chair of Trustees’ signature	[signature — to be added on adoption]

Change History

Version	Date	Amendment or no change
1	September 2026	Created (UYN Governance & Compliance Policies Pack, first draft)
2	October 2026	Updated and expanded for UYN: document control, numbered sections, appendices and detail added; stale references removed. Registered office address and contact email addresses confirmed (12 October 2026).

Website History

Version	Date on website	Notes
—	[not yet published]	[to be completed when the policy is published on darksalmon-gnu-318413.hostingersite.com]

Contents

1. Aims 2. Legislation and guidance 3. Definitions 4. The data controller 5. Roles and responsibilities 6. Data protection principles 7. Collecting personal data 8. Sharing personal data 9. Subject access requests and other rights of individuals 10. Requests from parents and guardians for information about a member 11. Photographs, videos and case studies 12. Surveillance and recording

13. Artificial intelligence 14. Data protection by design and default 15. Data security and storage of records 16. Disposal of records 17. Personal data breaches 18. Training 19. Monitoring arrangements 20. Links with other policies Appendix 1: Personal data breach procedure Appendix 2: Retention schedule Appendix 3: Appropriate Policy Document Appendix 4: Processors and sharing arrangements

1. Aims

UYN aims to ensure that all personal data collected about members, parents and guardians, mentors, volunteers, trustees, staff, employers, partners, donors and website visitors is collected, stored and processed in accordance with UK data protection law.

This policy applies to all personal data, whether in paper or electronic format, and to everyone acting on UYN’s behalf.

2. Legislation and guidance

This policy meets the requirements of:

• the UK General Data Protection Regulation (UK GDPR);
• the Data Protection Act 2018 (DPA 2018), as amended, including by the Data (Use and Access) Act 2025;
• the Privacy and Electronic Communications Regulations 2003 (PECR).

It is based on guidance published by the Information Commissioner’s Office (ICO), including its guidance on lawful basis, children’s data, data protection by design, personal data breaches and the Age Appropriate Design Code (“Children’s Code”) as a benchmark, and on Charity Commission guidance on safeguarding and data. It should be read with the Safeguarding Policy and the Children’s Data Provisions.

Note: some provisions of the Data (Use and Access) Act 2025 are being brought into force in stages. The Data Protection Lead should check the current commencement position with the ICO’s guidance at each review.

3. Definitions

Term	Definition
Personal data	Any information relating to an identified or identifiable living individual: name (including initials), identification number, location data, an online identifier such as a username, or factors specific to a person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Special categories of personal data	More sensitive data needing more protection: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data used for identification; health (physical or mental); sex life or sexual orientation. UYN also treats housing situation, care-leaver status and similar information as sensitive in practice, even where it is not legally a special category.
Criminal offence data	Data about criminal convictions, offences and related security measures, including the outcome of DBS checks.
Processing	Anything done to personal data: collecting, recording, organising, storing, adapting, retrieving, using, sharing, erasing or destroying. It can be manual or automated.
Data subject	The identified or identifiable individual whose personal data is held or processed.
Data controller	A person or organisation that determines the purposes and means of processing personal data. UYN is a data controller.
Data processor	A person or body, other than an employee of the controller, that processes personal data on the controller’s behalf (for example a cloud database provider).
Personal data breach	A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Child	For this policy, a person under 18. Members aged 16–17 are children in law and receive the extra protections in the Children’s Data Provisions.

4. The data controller

UYN processes personal data relating to members, parents and guardians, mentors, volunteers, trustees, staff, partners and others, and is therefore a data controller.

UYN will pay the ICO data protection fee and register as a controller, and renew annually. Registration is planned by 30 November 2026, before UYN processes members’ data at scale; the registration number will be recorded in the Privacy Policy once confirmed.

5. Roles and responsibilities

This policy applies to all trustees, staff, mentors and volunteers, and to external organisations or individuals working on UYN’s behalf. Anyone who does not comply may face action under UYN’s procedures, which for volunteers and mentors may include ending their role.

5.1 Board of Trustees

The Board has overall responsibility for ensuring that UYN complies with all relevant data protection obligations, approves this policy, and receives a report from the Data Protection Lead at least annually and after any significant breach.

5.2 Data Protection Lead

UYN is a small organisation and does not currently meet the threshold requiring a statutory Data Protection Officer. The Board has instead designated a Data Protection Lead as good practice. The Data Protection Lead oversees implementation of this policy, monitors compliance, keeps the record of processing activities, coordinates subject access requests, leads breach response, advises on data protection impact assessments, and arranges training. They report to the Board at least annually. They are the first point of contact for individuals and for the ICO.

Data Protection Lead	[name — to be designated by the Board]
Email	privacy@darksalmon-gnu-318413.hostingersite.com
Post	71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom

The Board will review at least annually whether UYN’s activities (for example, large-scale processing of sensitive data) mean a statutory DPO has become necessary.

5.3 CEO / Programme Manager

The CEO acts as the representative of the data controller on a day-to-day basis, ensures systems and processes support this policy, and makes sure the Data Protection Lead has time and resources to carry out the role.

5.4 Safeguarding Lead

The Safeguarding Lead handles data shared for safeguarding purposes in line with the Safeguarding Policy and works with the Data Protection Lead on any overlap, including decisions to share information without consent.

5.5 All trustees, staff, mentors and volunteers

Everyone is responsible for:

• collecting, storing and processing personal data in accordance with this policy;
• telling UYN of changes to their own personal data, such as a change of address;
• contacting the Data Protection Lead:

• with any questions about this policy, data protection law, retaining personal data or keeping it secure;
• if they have any concerns that this policy is not being followed;
• if they are unsure whether they have a lawful basis to use personal data in a particular way;
• if they need to rely on or capture consent, draft a privacy notice, deal with a rights request, or transfer personal data outside the UK;
• if there has been a data breach (immediately — see Appendix 1);
• whenever they are starting a new activity that may affect individuals’ privacy; and
• if they need help with a contract or with sharing personal data with third parties.

5.6 Examples of good practice

• Use only UYN-approved storage and accounts for personal data. Do not save members’ data on personal devices or personal cloud accounts, and do not use USB sticks.
• Use UYN email and the approved messaging channels with members — not personal social media accounts.
• Avoid unknown or public Wi-Fi for work involving personal data, or use a VPN.
• Do not open unexpected emails or attachments from unrecognised sources; if in doubt, verify by phone or delete.
• Use devices with up-to-date operating systems, screen locks and anti-virus software.
• Keep personal and non-personal data separate where practicable.
• Know the steps to follow if personal data is lost or sent to the wrong person.
• Practise what we preach: our members are young people building trust in organisations — we model good practice.

6. Data protection principles

The UK GDPR is based on data protection principles that UYN must comply with. Personal data must be:

• processed lawfully, fairly and in a transparent manner;
• collected for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and, where necessary, kept up to date;
• kept for no longer than is necessary;
• processed in a way that ensures appropriate security.

In addition, UYN is accountable: the Board must be able to demonstrate compliance with all of the above.

7. Collecting personal data

7.1 Lawfulness, fairness and transparency

We will only process personal data where we have one of the lawful bases under data protection law:

• Consent — the individual (or, where required, their parent or guardian) has freely given clear consent;
• Contract — processing is necessary to fulfil a contract with the individual, or to take steps they have asked for before a contract;
• Legal obligation — processing is necessary to comply with the law;
• Vital interests — processing is necessary to protect someone’s life;
• Legitimate interests — processing is necessary for UYN’s or a third party’s legitimate interests, provided the individual’s rights and freedoms do not override them.

“Public task” is not available to UYN because it is not a public authority.

For special category data we will also meet one of the conditions in UK GDPR Article 9. The conditions we expect to use are:

• explicit consent;
• employment, social security and social protection law (for staff data);
• vital interests, where the individual cannot give consent;
• establishment, exercise or defence of legal claims;
• substantial public interest, with a DPA 2018 Schedule 1 condition — in particular equality of opportunity or treatment (paragraph 8) and safeguarding of children and individuals at risk (paragraph 18);
• the not-for-profit condition (Article 9(2)(d)) for member data — to be confirmed (see Appendix 3).

For criminal offence data (for example DBS outcomes) we will meet both a lawful basis and a Schedule 1 condition, typically preventing or detecting unlawful acts, protecting the public against dishonesty, or safeguarding, and will keep the Appropriate Policy Document in Appendix 3.

Whenever we first collect personal data directly from individuals, we will provide the information required by data protection law, through our privacy notices. We will always consider fairness: we will not handle personal data in ways individuals would not reasonably expect, or use it in ways that have unjustified adverse effects.

Where we offer online services directly to a child and rely on consent, we will take account of the child’s age and understanding. UK law sets the age at which a child can consent to online services at 13; UYN’s members are 16 and over, but we will still seek parent/guardian consent for participation for those aged 16–17 as set out in the Children’s Data Provisions.

7.2 Limitation, minimisation and accuracy

We will only collect personal data for specified, explicit and legitimate reasons and explain these reasons when we first collect it. If we want to use personal data for a different reason, we will tell the individuals concerned before we do so and seek consent where necessary.

People must only process personal data where it is necessary to do their role. We will keep data accurate and up to date, and correct or erase inaccurate data. When data is no longer needed, it must be deleted or anonymised in line with the retention schedule (Appendix 2).

7.3 Consent

• Consent must be freely given, specific, informed and unambiguous, by a clear affirmative action. Pre-ticked boxes are not used.
• Consent is requested separately for separate purposes (for example programme participation, photographs, sharing a profile with an employer, marketing).
• Consent records (who, when, what, how) are kept and can be withdrawn at any time, as easily as it was given.
• Withdrawal of consent for optional uses (photos, marketing, opportunity pairing) will never affect a member’s access to the core programme.

8. Sharing personal data

We will not normally share personal data with anyone else without consent, but there are circumstances where we may be required to or may need to. These include, but are not limited to, situations where:

• there is a safeguarding concern about a member or another person — information may be shared without consent where this is necessary to keep someone safe (see Safeguarding Policy);
• there is an issue that puts the safety of a mentor, volunteer or member of staff at risk;
• we need to liaise with other agencies — we will seek consent first where it is safe and appropriate to do so;
• a member asks us to introduce them to an employer, training provider or partner — we will share only what they have agreed;
• our suppliers or contractors need data to provide services to us, such as IT, database, payment or email providers. When doing this we will:

• only appoint suppliers that can provide sufficient guarantees that they comply with UK data protection law;
• put in place a written contract that meets UK GDPR Article 28;
• only share data the supplier needs to provide the service.

We will also share personal data with law enforcement and government bodies where legally required, and with emergency services and local authorities in an emergency. Where we transfer personal data outside the UK we will do so in line with UK data protection law (adequacy, International Data Transfer Agreement or Addendum, or another lawful safeguard). See Appendix 4 for the register of processors and sharing arrangements.

9. Subject access requests and other rights of individuals

9.1 Subject access requests

Individuals have a right to make a “subject access request” (SAR) to gain access to the personal information UYN holds about them. This includes:

• confirmation that their personal data is being processed;
• a copy of the data;
• the purposes of the processing and the categories of data concerned;
• who the data has been or will be shared with;
• how long it will be stored, or the criteria used to decide this;
• the rights to request rectification, erasure or restriction, or to object;
• the right to complain to the ICO;
• the source of the data, if not the individual;
• whether automated decision-making is applied, and its significance;
• the safeguards used if data is transferred internationally.

SARs can be made in any form, but we can respond more quickly if they are in writing and include: name; correspondence address; contact number and email; and details of the information requested. If anyone at UYN receives a SAR in any form, they must forward it to the Data Protection Lead immediately.

9.2 Children and subject access requests

Personal data about a child belongs to that child, not their parents or carers. UYN’s members are aged 16 or over. In England, young people aged 16–17 are generally presumed able to understand their rights and exercise them themselves. A parent or guardian may make a request on behalf of a member aged 16–17 only where the young person has given consent, or where we are satisfied that the young person does not have the understanding to make the request themselves — judged case by case by the Data Protection Lead, with advice from the Safeguarding Lead where relevant.

Open point: the Board should confirm this approach for 16–17-year-olds, and whether any request from a parent should always be discussed with the young person first.

9.3 Responding to subject access requests

When responding to requests we:

• may ask the individual to provide proof of identity, and may contact them to confirm the request was made;
• will respond without delay and within one month of receipt (or of receiving the information needed to confirm identity);
• will provide the information free of charge;
• may extend the time by up to two further months (three in total) where a request is complex or numerous, telling the individual within one month and explaining why;
• will carry out reasonable and proportionate searches for the information requested.

We will not disclose information if it:

• might cause serious harm to the physical or mental health of the individual or someone else;
• would reveal that a child is being or has been abused, or is at risk of abuse, where disclosure would not be in the child’s best interests;
• would include another person’s personal data that we cannot reasonably anonymise, and we do not have their consent and it would be unreasonable to proceed without it;
• is part of certain sensitive documents, such as those related to crime, immigration, legal proceedings or legal professional privilege, management forecasts, negotiations, or confidential references.

If a request is manifestly unfounded or excessive, we may refuse to act on it or charge a reasonable fee that takes account of administrative costs, considering whether the request is repetitive. When we refuse a request we will tell the individual why, and that they have the right to complain to the ICO or to seek to enforce their right through the courts.

9.4 Other data protection rights of the individual

In addition to the right of access, and to be given information when we collect their data (section 7), individuals have the right to:

• withdraw consent to processing at any time;
• ask us to rectify, erase or restrict processing of their personal data (in certain circumstances);
• prevent use of their personal data for direct marketing;
• object to processing based on legitimate interests;
• challenge decisions based solely on automated decision-making or profiling;
• be notified of a data breach in certain circumstances;
• make a complaint to the ICO;
• ask for their personal data to be transferred to a third party in a structured, commonly used, machine-readable format (in certain circumstances).

Requests to exercise these rights should be sent to the Data Protection Lead. If anyone else at UYN receives one they must forward it immediately.

9.5 Data protection complaints

Anyone who is unhappy with how UYN has handled their personal data can complain to the Data Protection Lead. We will acknowledge the complaint promptly, investigate without undue delay and tell the complainant the outcome. If they remain unhappy they can complain to the ICO. Data protection complaints are recorded and reported to the Board in the annual data protection report.

10. Requests from parents and guardians for information about a member

Unlike a school, UYN does not hold an “educational record” to which parents have a statutory right of access. Parent and guardian requests for information about a member aged 16–17 will be treated as set out in section 9.2: we will normally ask the young person first, share only what is appropriate, and will not share information where that would put the young person at risk or breach their reasonable expectation of confidentiality. Safeguarding information is shared only in line with the Safeguarding Policy.

11. Photographs, videos and case studies

As part of our activities we may take photographs and record images of members, mentors, volunteers and event attendees.

• We will obtain specific written consent for photographs, videos and case studies used for communication, marketing or fundraising — from the member, and additionally from a parent/guardian for those aged 16–17 — explaining where and how the material will be used and for how long.
• Uses may include: UYN’s website and social media; funder and partner reports; printed materials; and external media with prior agreement.
• Consent may be refused or withdrawn at any time. If consent is withdrawn we will stop using the image and remove it from our channels; we cannot recall material already shared by third parties.
• Photographs will not be accompanied by information that identifies a member beyond what they have agreed (for example first name only, or none).
• Case studies and testimonials are used only where they are real, and approved in writing by the person concerned.
• Photographs taken by attendees for their own purposes are not covered by data protection law; we will ask attendees not to share images of other members online without their consent.

12. Surveillance and recording

UYN does not operate CCTV or other surveillance. Sessions, calls and events are not recorded without prior notice to everyone taking part and a documented reason. If UYN ever uses a venue that operates CCTV, the venue is the controller of that footage. If UYN decides to introduce any form of surveillance or recording, a data protection impact assessment must be completed first and this policy updated.

13. Artificial intelligence

Artificial intelligence (AI) tools, including generative chatbots, are now widespread and easy to access. UYN recognises that AI can help our work but poses risks to personal and sensitive data.

• No one will enter personal or sensitive data about members, mentors, volunteers or others into any generative AI tool or chatbot that has not been approved by the Data Protection Lead.
• Approved tools must have appropriate contractual and security terms, and must not use our data to train public models.
• No decision about a person will be made solely by an AI tool.
• If personal or sensitive data is entered into an unauthorised AI tool, UYN will treat this as a personal data breach and follow the procedure in Appendix 1.

14. Data protection by design and default

We will put measures in place to show that we have integrated data protection into all of our processing activities, including:

• designating a suitably capable Data Protection Lead with the time and resources to fulfil the role;
• only processing personal data that is necessary for each specific purpose, in line with the principles in section 6;
• completing a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to individuals — for example introducing a new member database or matching tool, large-scale processing of children’s or sensitive data, new use of AI, or any surveillance;
• integrating data protection into policies, forms and privacy notices;
• training trustees, staff, mentors and volunteers, and keeping a record of attendance;
• regularly reviewing and auditing our privacy measures;
• putting safeguards in place for any transfer of personal data outside the UK;
• maintaining a record of processing activities (a data map) showing the type of data, data subjects, purposes, recipients, retention periods and security measures — and making privacy information available through our privacy notices.

15. Data security and storage of records

We will protect personal data and keep it safe from unauthorised or unlawful access, alteration, processing or disclosure, and against accidental or unlawful loss, destruction or damage. In particular:

• Paper records and portable devices containing personal data are kept locked away when not in use. UYN intends to hold as little paper as possible.
• Papers containing confidential personal data must not be left where others can see or access them.
• Where personal data needs to be taken off site on paper or on a device, it is recorded and kept secure at all times.
• Strong, unique passwords (at least 12 characters, or a passphrase) and multi-factor authentication are used on UYN accounts, and passwords are never shared.
• Encryption is used on portable devices and removable media, and cloud services are configured with encryption in transit and at rest.
• Access to member records is role-based; safeguarding and DBS records have tighter access than general programme data.
• Trustees, staff, mentors and volunteers who use personal devices for UYN work must follow the same security standards, and must not store UYN personal data locally.
• Where we share personal data with a third party we carry out due diligence and take reasonable steps to ensure it is stored securely (section 8).
• Mentor–member communications use UYN-approved channels so that records are held within UYN’s systems.

16. Disposal of records

Personal data that is no longer needed will be disposed of securely. Data that has become inaccurate or out of date will also be disposed of securely where we cannot or do not need to rectify or update it.

For example, we will shred paper records and securely delete or overwrite electronic files. If we use a third party to dispose of records on our behalf we will require it to provide sufficient guarantees that it complies with data protection law. Email and cloud accounts of leavers will be closed or transferred within 3 months of their leaving UYN.

17. Personal data breaches

UYN will make all reasonable endeavours to ensure there are no personal data breaches. In the event of a suspected breach we will follow the procedure in Appendix 1. When appropriate we will report the breach to the ICO within 72 hours of becoming aware of it. Examples of breaches in UYN’s context include:

• a spreadsheet of member names, housing situation or outcome data being emailed to the wrong person;
• safeguarding information being made available to an unauthorised person;
• the theft or loss of a laptop or phone holding unencrypted member data;
• a mentor’s or volunteer’s account being compromised, exposing member records;
• member data being entered into an unauthorised AI tool;
• a payment or database provider suffering a cyber attack.

18. Training

All trustees, staff, mentors and volunteers receive data protection training as part of their induction, before they have access to personal data. Data protection will also be refreshed at least annually and whenever law, guidance or UYN’s processes change.

19. Monitoring arrangements

The Data Protection Lead is responsible for monitoring and reviewing this policy. It will be reviewed annually and approved by the Board of Trustees. The Data Protection Lead will report to the Board at least annually on requests received, breaches, training and risks.

20. Links with other policies

This policy is linked to: Privacy Policy; Children’s Data Provisions; the privacy notices for members, applicants and staff, trustees and volunteers; Cookie Policy; Safeguarding Policy; Complaints Policy; and the Board Terms of Reference. Further policies planned for the full suite include a Social Media and Online Conduct Policy and an IT Acceptable Use Policy.

Appendix 1: Personal data breach procedure

This procedure is based on the ICO’s guidance on personal data breaches (https://ico.org.uk/for-organisations/report-a-breach/).

• On finding or causing a breach, or potential breach, the trustee, staff member, mentor, volunteer or processor must immediately notify the Data Protection Lead.
• The Data Protection Lead will investigate and determine whether a breach has occurred, considering whether personal data has been accidentally or unlawfully:

• lost;
• stolen;
• destroyed;
• altered;
• disclosed or made available where it should not have been; or
• made available to unauthorised people.

• The Data Protection Lead will alert the CEO and the Chair of Trustees (and the Safeguarding Lead if safeguarding data is involved).
• Everyone will co-operate with the investigation, including giving access to information and answering questions. The investigation is not treated as a disciplinary investigation.
• The Data Protection Lead will make all reasonable efforts to contain and minimise the impact of the breach, assisted by relevant people, and will take external advice (for example from IT providers) where needed. Actions relevant to specific data types are set out at the end of this procedure.
• They will assess the potential consequences — how serious they are and how likely they are to happen — before and after mitigation.
• They will work out whether the breach must be reported to the ICO and to the individuals affected, using the ICO’s self-assessment tool.
• They will document the decision (either way) in the breach log, in case it is later challenged by the ICO or an individual affected.
• Where the ICO must be notified, the Data Protection Lead will do so through the ICO’s “report a breach” page or its breach report line (0303 123 1113) within 72 hours of UYN becoming aware of the breach, setting out:

• the nature of the breach, including where possible the categories and approximate number of individuals and records concerned;
• the name and contact details of the Data Protection Lead;
• the likely consequences of the breach;
• the measures taken or proposed to deal with it and to mitigate adverse effects.

• If not all the details are known, the Data Protection Lead will report what they can within 72 hours, explain the delay and when further information is expected, and send the rest as soon as possible.
• Where UYN must tell the individuals affected (a high risk to their rights and freedoms), the Data Protection Lead will do so in writing and without undue delay, setting out the contact details, the likely consequences, and the measures taken or proposed — in plain language, and suitable for a young person where the person is under 18.
• The Data Protection Lead will consider whether to notify third parties who can help mitigate the loss to individuals — for example the police, insurers, banks or card companies.
• Where the breach involves safeguarding information or a serious risk to a beneficiary, the Safeguarding Lead and the Chair will consider whether it is also a reportable serious incident for the Charity Commission (if registered) and whether to inform local safeguarding partners.
• The Data Protection Lead will document every breach, whether or not it is reported to the ICO, recording: the facts and cause; the effects; and the action taken to contain it and prevent recurrence (for example more robust processes or further training).
• The Data Protection Lead and CEO will meet as soon as reasonably possible to review what happened and how to prevent it happening again, and will review the breach log regularly for trends. The Board will receive a summary of every breach at its next meeting.

Actions to minimise the impact of data breaches

The steps below set out what we might do to mitigate different types of breach, focusing on particularly risky or sensitive information. We will review their effectiveness and amend them after any breach.

Sensitive information disclosed by email (including safeguarding records)

• If special category data is accidentally sent to unauthorised individuals, the sender must attempt to recall the email as soon as they become aware of the error.
• Anyone who receives personal data sent in error must alert the sender and the Data Protection Lead immediately and must not forward, copy or use it.
• If the sender is unavailable or cannot recall the email, the Data Protection Lead will ask UYN’s IT provider to attempt to recall or remove it, keeping a copy as evidence if needed.
• Where recall is unsuccessful or cannot be confirmed, the Data Protection Lead will consider contacting the unauthorised recipients, explaining the information was sent in error, and asking them to delete it and not share, publish, save or replicate it.
• The Data Protection Lead will seek written confirmation from every recipient that they have complied.
• The Data Protection Lead will carry out an internet search to check that the information has not been made public; if it has, we will contact the publisher or site owner to request removal.
• If safeguarding information is compromised, the Data Protection Lead will inform the Safeguarding Lead and discuss whether to inform local safeguarding partners.

Other types of breach to plan for

• details of a named member’s housing situation, mental health or outcome data being published or shared in a report;
• non-anonymised outcome data or a participant list being shared with a funder or employer without consent;
• a laptop or phone holding unencrypted member data being stolen, hacked or lost;
• UYN’s payment or database provider being hacked and members’ details stolen;
• a mentor sharing a member’s details with someone outside UYN;
• a message or report sent to the wrong member or family.

Appendix 2: Retention schedule

Retention periods are drafted from general charity-sector and safeguarding good practice. They are proposals for the Board to confirm — particularly for safeguarding records and outcome data — ideally with advice from a solicitor, as the right period can depend on the circumstances of a case. Records are reviewed for deletion at least annually.

Data type	Proposed retention	Basis / notes
Member records (registration, programme, mentor notes)	Duration of engagement + 2 years	Legitimate interests; limitation period for claims
Member records for 16–17s	Safeguarding retention period (below) for any safeguarding content; otherwise as general member records	Additional duty of care owed to a young person’s data
Outcome data (registration, week 13, day 90) — identifiable	[period to be confirmed by the Board]	Needed for funder reporting and evaluation; consider converting to anonymised data after reporting is complete
Outcome and impact data — anonymised	No limit (not personal data once truly anonymised)	Checked for re-identification risk with small cohorts
Mentor, volunteer and trustee records	Duration of role + 6 years (or 2 years for volunteers with no safeguarding incident)	Safer recruitment evidence; limitation period
Safeguarding records and incident reports	Minimum 7 years from last contact; for records relating to a child, until the individual reaches age 25 at least, or longer if advised	Charity Commission safeguarding guidance; potential future disclosure need — confirm with solicitor
DBS check outcomes	Certificate reference, date and outcome only; the certificate itself is not retained (normally not beyond 6 months)	DBS Code of Practice
Applicants — unsuccessful	6 months from the decision (longer only with consent)	Defence of discrimination claims
Employment records (when staff are employed)	6 years after leaving	Limitation period; HMRC
Financial and transaction records	6 years from the end of the financial year	HMRC and Companies Act requirements
Governance records (minutes, registers)	Permanently or at least 10 years	Companies Act and good governance
Complaints records	6 years from closure (longer if linked to safeguarding)	Good practice; limitation period
Marketing consent records	Until consent is withdrawn, then suppression record retained to honour the opt-out	Accountability and PECR
Photo and video consent records	For as long as the material is in use, plus 6 years	Evidence of consent
Website analytics data	Up to 24 months	See Cookie Policy
Breach log and DPIAs	6 years	Accountability

Flagged for confirmation Retention periods, especially for outcome data and for safeguarding records relating to children, are not yet settled. The Board should confirm them before adoption.

Appendix 3: Appropriate Policy Document

This Appropriate Policy Document explains how UYN complies with the data protection principles when processing special category and criminal offence data in reliance on the conditions in Parts 1, 2 and 3 of Schedule 1 to the Data Protection Act 2018 that require one. It meets the requirement in Schedule 1, Part 4.

Processing	Condition(s) relied on	Why necessary
Equality monitoring of members, applicants and volunteers	Equality of opportunity or treatment (Sch 1, para 8)	To identify and promote equality of opportunity in our programme; reported only in anonymised form
Safeguarding records and referrals	Safeguarding of children and of individuals at risk (Sch 1, para 18)	To protect members under 18 and adults at risk from neglect or physical, mental or emotional harm
DBS outcomes for mentors, volunteers, staff and trustees	Preventing or detecting unlawful acts; protecting the public against dishonesty; safeguarding, as applicable	To decide suitability for roles with contact with young people
Staff health and absence data (when employed)	Employment, social security and social protection law (Sch 1, para 1)	To meet employment law duties
Optional sensitive information shared by members	Explicit consent (Art 9(2)(a))	To tailor support; shared with others only with specific consent

How we comply with the principles

• Lawfulness, fairness and transparency: we identify the lawful basis and condition before processing, and explain the use in our privacy notices.
• Purpose limitation: data is used only for the purpose it was collected for; we tell people if this changes.
• Data minimisation: we collect only what is necessary and make sensitive fields optional wherever possible.
• Accuracy: members and others can correct their information; inaccurate data is corrected or erased without delay.
• Storage limitation: data is kept in line with the retention schedule (Appendix 2) and then securely deleted or anonymised.
• Security: role-based access, encryption and the measures in section 15 protect sensitive data.
• Accountability: we keep the record of processing activities, this document, DPIAs and breach logs, and the Data Protection Lead reports to the Board.

This document will be retained for six months after the processing ends, reviewed with the Data Protection Policy, and made available to the ICO on request.

Open point The Article 9(2)(d) not-for-profit condition and the final list of Schedule 1 conditions should be confirmed with a solicitor before adoption. This document is a draft.

Appendix 4: Processors and sharing arrangements

This register is maintained by the Data Protection Lead and reviewed at least annually. Supplier names are to be completed once suppliers are appointed. No supplier is listed as appointed in this draft.

Category	Supplier	Data shared	Safeguards
Website hosting and domain (darksalmon-gnu-318413.hostingersite.com)	[to be completed]	Website visitor data, form submissions	Article 28 contract; UK/EU hosting preferred
Email, documents and cloud storage	[to be completed]	All categories, per role-based access	Article 28 contract; MFA; encryption
Member database / case-management	[to be completed]	Member, mentor and outcome data	Article 28 contract; DPIA before use
Payment provider	[to be completed]	Name, email, payment details (held by the provider)	PCI-compliant provider; UYN does not store card numbers
DBS umbrella body	[to be completed]	Applicant identity and DBS application data	Contract; DBS Code of Practice
Mailing / newsletter service	[to be completed]	Name, email, consent status	Article 28 contract; transfer safeguards if non-UK
Accountant / bookkeeper	[to be completed]	Financial and payroll data	Contract; confidentiality
Insurers and professional advisers	[to be completed]	As needed for claims or advice	Confidentiality
Employers / training providers	Case by case	Only what a member has consented to share	Specific consent; data sharing agreement where appropriate
Statutory bodies (ICO, Companies House, HMRC, Charity Commission if registered, police, local authority safeguarding)	n/a	As required by law	Legal obligation; recorded by the Data Protection Lead

Upsurge Youth Network · Data Protection Policy · Draft pending Board adoption  ·  Page