Data Protection

This page provides resources for organisations looking for information, guidance or tools to help with data protection - including GDPR, information security and ePrivacy.

We will continue to develop this page and update it with new resources. Please do let us know of any resources we should add to the page, or share any feedback with us.

The information on this page was initially published in March 2018 to support organisations with their efforts to be compliant with the new General Data Protection Regulation (GDPR). The GDPR forms part of the data protection regime in the UK, together with the new Data Protection Act 2018 (DPA 2018). The main provisions of this apply, like the GDPR, from 25 May 2018.

Legislation
Data Protection Act 2018 - PDF of full legislation (Added 25 May 2018)
General Data Protection Regulation
ePrivacy Directive
Proposal for new ePrivacy Regulation
Factsheet on the new ePrivacy Regulations being developed
Network and Information Security Directive

Data Protection
Scottish Charity Regulator's Guidance on Reporting Notifiable Events
Conducting Privacy Impact Assessments Code of Practice (not yet updated for GDPR but a good starting point)
Guidance on data security breach management
Privacy Notices under GDPR
GDPR Self-Assessment Toolkit - includes a range of toolkits for things like ePrivacy, information security, direct marketing, CCTV and more
Directory of Social Change and Paul Ticher's Guide to GDPR
Institute of Fundraising's guidance on GDPR
Charity Finance Group's guide to GDPR for charities
New ICO guidance on Legitimate Interests under GDPR
Royal Mail's Guide to GDPR
ICO's guidance on GDPR and children (Added 25 May 2018)
ICO's detailed guidance on Consent (Added 25 May 2018)

Press Coverage/Breaches
Oxfam forgot to redact personal details from report given to journalists

ePrivacy
Guide to Privacy and Electronic Communications Regulation
Privacy Notices Code

Information Security
EC site on Network and Information Security Directive
Cyber Essentials Certification Scheme
Cyber security guide for small charities
Cyber security for charities poster
10 Steps to Cyber Security

This page was last updated on 25 May 2018.
Suggest an update/report an error/enquire about this page

Specific Advice and Support

Specific advice will be tricky due to the complexity and uniqueness of data processing of each organisation. Legal advice from a specialist solicitor is the safest bet. Expect to pay in the region of £250-350 per hour for advice.

Guidance is available on the website links elsewhere on this page. Guidance and a degree of advice is available from Fife Voluntary Action. Square Peg HR (who co-delivered the GDPR training with FVA) can provide templates and specific advice in relation to employee, volunteer and job applicant processing. You can contact Frances McAulay of Square Peg HR by e-mail.

HR software

Breathe HR is free for registered charities with less than 250 employees. It's GDPR compliant and Square Peg HR are partners and can provide support to use it (you can use it directly without having to go through Square Peg). Find out more about Breathe HR on their website.

Fife Voluntary Action is a Registered Company in Scotland No. SC203613 and Registered Scottish Charity No. SC028457. Registered Office: Caledonia House, Pentland Park, Saltire Centre, Glenrothes, KY6 2AL. Legal, Privacy and Cookie Information
Core funding provided by:

Data Protection

Legislation

Data Protection

Press Coverage/Breaches

ePrivacy

Information Security

Specific Advice and Support

HR software