Handling a Subject Access Request

A parent emails to ask for everything you hold about their child. A former volunteer wants a copy of their record. That is a subject access request, and the law gives you one calendar month from the day it arrives to reply.

Until now the only record was an email thread and somebody's memory of when it landed. Scoutworks now logs the request, works out the deadline for you, and gathers the person's data into a single file so you are not hunting through the app by hand.

Where to find this#

Go to Settings → Governance, then find the Subject Access Requests panel.

Only Group Admins can see this panel. Leaders and parents cannot.

Logging a request#

Click Log request and fill in the form. The clock starts from the date you enter, not the date you log it — so if the email sat in an inbox for three days, put the real date in.

Click Log request to save. Scoutworks sets the deadline to one calendar month from the date received.

Keeping track of the deadline#

The list shows every request with its subject, who asked, the due date and the current status. Anything past its deadline is shaded red and marked Overdue, so a slipping request is hard to miss.

Open any row to see the full request. At the top you will see how long you have left:

• Green — more than a week to go
• Amber — a week or less
• Red — the deadline has passed, with the number of days you are over

Inside, you can update the status as you work through it:

The detail panel also shows the date received, the statutory deadline, the completion date once you mark it done, and the requester's email. Add progress notes as you go — who is handling it, what has been sent, anything you may need to justify later. Notes save when you click away from the box.

Exporting the person's data#

This is the part that used to take an afternoon.

Open a request that is linked to a member and click Export data as JSON. Scoutworks gathers what it holds about that person into one file and downloads it, named after the subject and today's date.

The file covers:

• Their profile — name, preferred name, date of birth, address, school, gender, ethnicity, religion, interests, emergency contact, medical information, dietary needs, disabilities and any special educational needs
• Group membership — the sections they belong to and their status
• Event attendance — every event, with their RSVP and whether they attended
• Badges — what they have been awarded and when, plus any evidence submitted
• Event consent answers — what was agreed to, by whom, and when
• Leader notes recorded against them
• A summary of their financial transactions

What the law asks of you#

Scoutworks tracks the request and gathers the data. The judgement calls stay with your group, because your group is the data controller. In short:

• You have one calendar month from receipt to respond.
• You normally cannot charge for it.
• You must check the requester is who they say they are before you send personal data.
• A parent asking for their own child's record is usually fine, but an older young person may have a say in it.

The Scouts GDPR toolkit walks through the full process, and the panel links straight to it.

What's next#

• Keeping Your Data Safe — how Scoutworks protects your group's information and the other data-protection controls built in.
• Editing Member Information — correct a record when someone asks you to.
• Managing Users and Roles — check who holds Group Admin, and therefore who can handle these requests.