GDPR for Girlguiding Leaders: What Data Can You Keep?
A plain-English guide to handling girls' and parents' personal data as a Girlguiding volunteer — including health information, starter forms and how long to keep records.
Running a unit means handling personal data: names, dates of birth, parents' contact details, medical information and photo permissions. UK GDPR applies to all of it, and because it relates to children, it deserves extra care.
The principles in plain English
- Only collect what you need. If you don't need a piece of information to run the unit safely, don't ask for it.
- Use it for the reason you collected it. Emergency contact details are for emergencies, not for unrelated mailing lists.
- Keep it accurate. Ask parents to update details at least once a year and whenever something changes.
- Don't keep it longer than necessary. Remove or destroy records when they are no longer needed, in line with Girlguiding's guidance.
- Keep it secure. Limit who can see it and protect it from loss or theft.
Health information needs extra protection
Medical conditions, allergies and medication are special category data under UK GDPR. Only the leaders who need this information should be able to see it, and it should travel securely on trips — not in an unlocked folder in a car or a hall cupboard.
Practical do's and don'ts
- Don't keep forms in a personal email inbox or a WhatsApp chat
- Don't store member spreadsheets on shared or family computers
- Do use a system with individual logins and access limited to your unit's leaders
- Do shred paper copies once the information has been transferred where it needs to be
- Do remove a girl's information when she leaves, following Girlguiding's retention guidance
Paper or digital starter forms?
Paper forms are easy to hand out but hard to keep secure and impossible to keep up to date. A digital form sends the information straight to an access-controlled inbox, and nothing sits in a bag or a car boot.
How UnitSolutions handles unit data
- UnitSolutions acts as a data processor; your unit remains responsible for the data it collects
- Parent-submitted starter forms are permanently deleted 30 days after submission, so transfer what you need into GO within that window
- Database access is restricted so leaders only see their own unit's records
- Data saved on a device for offline use is encrypted on that device
Girlguiding has its own data protection policy and guidance for volunteers, including what to record in GO and how long to keep records. Follow that guidance first. This article is general information, not legal advice.
Frequently Asked Questions
Is medical information on starter forms special category data?
Yes. Health information is special category data under UK GDPR, so access should be limited to the leaders who need it and it must be stored securely.
Can I keep members' details in a spreadsheet?
Only if it is stored securely with access limited to the leaders who need it. Spreadsheets on shared computers or emailed between leaders are a common cause of data breaches.
How long does UnitSolutions keep starter form submissions?
Parent-submitted starter forms are permanently deleted 30 days after submission. Leaders should transfer the information they need into GO within that time.