Data Protection

If you are working with people, it is almost inevitable that you will be collecting data about people. Some of this data may be personal, and some of it – notably, that related to protected characteristics such as disability or sexual orientation – could be highly sensitive.

Aim to collect only the personal data needed in order to undertake and evaluate your community engagement activities and only keep it as long as you need to. Collecting more data than you need or hanging onto it ‘just in case’ exposes you and the person affected to unnecessary risk.

Be transparent when collecting people’s data. Let them know that you are taking it and what you will be using for. Also make sure that they are giving this information freely and let them know who to contact if they change their mind.

Make sure all personal data is held securely, and that only the people who need it have access to it. If you and another organisation both need access to personal data obtained as part of community engagement activity, you may need to ensure you have a data sharing agreement in place.

Measures to take

In practice, measures you might take are:

• Before taking someone’s photograph, get them to sign a release form that says what you will do with the image. Make sure they also get a copy of this form so they remember what they have signed up to. Make sure there are contact details on their copy in case they want you to stop using their image at a later date.

  • For young people, parental or guardian consent is required. However, it is still good practice to check verbally with the young person that they are happy to have their photo taken, and not to do so if they are not, even if their parent or guardian consented.
• When emailing a group of local community members on their personal email addresses, use the BCC field unless they have all agreed to share their email addresses with one another.
• If you are going to publish an evaluation of your community engagement activity online, consider whether any of the people involved can be identified from the information you give about them, even if you do not use their name. If they can, were they aware their involvement might be made public?

Useful links:

• University data protection pages