Volunteers may be involved in collecting or managing other people’s personal data. They should be aware of GDPR, their obligations and internal processes to handle data correctly, accurately, and securely. Making sure cyber security is adequate will also be a priority.
Your organisation also processes volunteers’ personal data and has the same duties in lawfully processing that data and deleting or updating it on request.
Ensure your volunteer policy or handbook includes data management procedures if volunteers are handling beneficiaries’ personal data, for example, so that they adhere to GDPR. Your agreement could also state how you process the data of your volunteers.
- Assess what you need to comply with using ICO’s self-assessment tool
- Appoint a Data Protection Officer if required for your organisation
- Communicate how volunteer’s personal data is handled
- Explain the processes volunteers should follow when handling the personal data of others
- Follow cyber security fundamentals- Write and update a privacy policy
- Audit your data handling, security and processes
- Adhere to DBS rules on the retention of DBS reports and records