Data Protection
This page provides resources for organisations looking for information, guidance or tools to help with data protection - including GDPR, information security and ePrivacy.
We will continue to develop this page and update it with new resources. Please do let us know of any resources we should add to the page, or .
The information on this page was initially published in March 2018 to support organisations with their efforts to be compliant with the new General Data Protection Regulation (GDPR). The GDPR forms part of the data protection regime in the UK, together with the new Data Protection Act 2018 (DPA 2018). The main provisions of this apply, like the GDPR, from 25 May 2018.
Legislation
Data Protection Act 2018 - PDF of full legislation (Added 25 May 2018)
General Data Protection Regulation
Proposal for new ePrivacy Regulation
Factsheet on the new ePrivacy Regulations being developed
Network and Information Security Directive
Data Protection
Scottish Charity Regulator's Guidance on Reporting Notifiable Events
Conducting Privacy Impact Assessments Code of Practice (not yet updated for GDPR but a good starting point)
Guidance on data security breach management
GDPR Self-Assessment Toolkit - includes a range of toolkits for things like ePrivacy, information security, direct marketing, CCTV and more
Directory of Social Change and Paul Ticher's Guide to GDPR
Institute of Fundraising's guidance on GDPR
Charity Finance Group's guide to GDPR for charities
New ICO guidance on Legitimate Interests under GDPR
ICO's guidance on GDPR and children (Added 25 May 2018)
ICO's detailed guidance on Consent (Added 25 May 2018)
Press Coverage/Breaches
Oxfam forgot to redact personal details from report given to journalists
ePrivacy
Guide to Privacy and Electronic Communications Regulation
Information Security
EC site on Network and Information Security Directive
Cyber Essentials Certification Scheme
Cyber security guide for small charities
Cyber security for charities poster
Specific Advice and Support
Specific advice will be tricky due to the complexity and uniqueness of data processing of each organisation. Legal advice from a specialist solicitor is the safest bet. Expect to pay in the region of £250-350 per hour for advice.
Guidance is available on the website links elsewhere on this page. Guidance and a degree of advice is available from Fife Voluntary Action. Square Peg HR (who co-delivered the GDPR training with FVA) can provide templates and specific advice in relation to employee, volunteer and job applicant processing. You can contact Frances McAulay of Square Peg HR by e-mail.
HR software
Breathe HR is free for registered charities with less than 250 employees. It's GDPR compliant and Square Peg HR are partners and can provide support to use it (you can use it directly without having to go through Square Peg). Find out more about Breathe HR on their website.
Get in touch
Governance, funding, policies, legal structures and anything else about starting or running an organisation.
E-mail [email protected]
Telephone 0800 389 6046
