Wolds & Coast Scout DistrictData Retention Policy

1. Purpose

This is the Data Retention Policy of Wolds & Coast Scout District.

The purpose of this policy is to explain:

how long the District retains different categories of personal information;
why those retention periods have been selected;
when information must be reviewed, deleted, destroyed or anonymised; and
who is responsible for ensuring that this policy is followed.

This policy supports the Wolds & Coast Scout District Data Protection and Privacy Policy.

Wolds & Coast Scout District will only retain personal information for as long as it is reasonably necessary for the purpose for which it was collected, unless a longer period is required by law, Scouts policy, insurance requirements, a funding agreement or a potential legal claim.

2. Scope

This policy applies to all personal information held or controlled by Wolds & Coast Scout District, regardless of:

whether it is held digitally or on paper;
where it is stored;
which District volunteer created or received it;
whether it relates to a young person, parent, guardian, volunteer, donor, supplier, contractor, supporter or member of the public; and
whether it was collected directly by the District or shared with the District by another Scout unit or organisation.

This includes personal information held in:

the Scouts Membership System;
Online Scout Manager;
Microsoft 365;
District email accounts;
Microsoft Forms;
spreadsheets;
shared drives;
event systems;
paper records;
volunteers’ authorised devices; and
other systems approved by the District.

Each Scout Group within Wolds & Coast Scout District is a separate data controller for the personal information it processes locally.

This policy does not determine how an individual Scout Group retains information under its own control.

However, where information about a Group member is received, copied or processed by the District for a District purpose, the copy held by the District is covered by this policy.

3. Policy statement

Personal information must be:

collected for a clear and lawful purpose;
adequate, relevant and limited to what is necessary;
accurate and kept up to date where required;
protected against unauthorised access, loss or disclosure;
retained for no longer than necessary; and
securely deleted, destroyed or anonymised when it is no longer required.

Personal information must not be retained indefinitely simply because it may be useful in the future.

Where information can be anonymised while retaining its statistical, historical or operational value, anonymisation should be considered instead of retaining identifiable information.

4. Responsibility

Accountability for data retention rests with the Wolds & Coast District Trustee Board.

The District Trustee Board must ensure that the District:

has a Data Lead;
publishes and maintains this policy;
maintains an appropriate retention schedule;
regularly reviews the personal information it holds;
keeps appropriate records demonstrating compliance;
securely disposes of information when retention periods expire; and
can explain and justify any departure from the standard retention periods.

The District Leadership Team, supported by the Data Lead, must ensure that volunteers understand and follow this policy.

Every adult volunteer who handles District personal information is responsible for:

following this policy;
storing information only in authorised systems;
avoiding unnecessary duplication;
reviewing information under their control;
securely deleting information when instructed; and
reporting any concern, loss or suspected data breach.

Questions about this policy should be sent to:

Email: dlv@woldsandcoastscouts.org.uk

5. Calculating retention periods

Unless the retention schedule states otherwise, a retention period begins when the relevant relationship, event, activity, enquiry, transaction or case has ended.

For example:

an event retention period begins on the date the event ends;
a volunteer retention period begins when the volunteer leaves the relevant role;
a complaint retention period begins when the complaint is closed;
a contract retention period begins when the contract ends; and
a young person’s membership retention period begins when they leave the District provision concerned.

Where the same information is required for more than one purpose, it may be retained for the longest applicable period.

At the end of the retention period, the information must be:

securely deleted;
securely destroyed;
irreversibly anonymised; or
reviewed and formally authorised for further retention.

6. Exceptions to the retention schedule

Information may be retained for longer than the standard period where this is necessary because of:

an ongoing safeguarding concern;
a safety investigation;
a complaint;
a data subject rights request;
threatened or ongoing legal proceedings;
an insurance claim;
a police, local authority or regulatory investigation;
a requirement from Scouts UK Headquarters;
a requirement from Humberside County Scout Council;
a tax, accounting or governance requirement;
a grant or funding agreement;
a contractual obligation; or
another clearly documented legal or operational reason.

Where information is retained beyond its normal period, the reason, decision-maker and revised review date should be recorded.

Information must not be deleted where the District knows, or reasonably expects, that it may be required for an investigation, complaint, insurance claim or legal proceeding.

7. Consent and legitimate interests

Information processed on the basis of consent must not automatically be retained permanently.

Where consent is withdrawn, the relevant processing must stop and the information should be deleted unless:

another lawful basis applies;
the information is required to demonstrate that consent was previously given or withdrawn;
it is needed to establish, exercise or defend a legal claim; or
another legal or regulatory requirement applies.

Where information is processed on the basis of legitimate interests, the District must periodically review whether:

the information is still required;
the original purpose still applies;
the District’s interest remains valid;
the processing remains necessary and proportionate; and
the individual’s rights and interests continue to be appropriately protected.

Where someone unsubscribes from District marketing or newsletters, the District may retain a minimal suppression record to ensure that the person is not accidentally added back to the mailing list.

8. Data retention schedule

8.1 General enquiries and communications

General enquiries

Examples: Website enquiries, requests for information, general emails and messages.

Retention period:
Twelve months after the final response or last meaningful contact.

Reason:
To respond to follow-up questions and maintain an appropriate record of the enquiry.

Routine operational correspondence

Examples: General emails, meeting arrangements and routine administrative communications.

Retention period:
Two years after the matter is completed.

Reason:
To answer follow-up questions and maintain sufficient operational continuity.

Routine correspondence must be deleted sooner where it is no longer useful and does not form part of another record covered by a longer retention period.

Newsletter and general mailing lists

Retention period:
Until the individual unsubscribes, withdraws consent or there has been no meaningful interaction for two years, subject to review.

A minimal suppression record may be retained while the mailing service continues to operate.

Reason:
To provide requested District news and prevent someone who has opted out from being added again accidentally.

8.2 Joining, expressions of interest and waiting lists

Young person joining enquiries and District waiting lists

Retention period:
One year after the enquiry, or until the young person joins or is transferred to an appropriate Scout Group or District provision, whichever occurs first.

Reason:
To manage the enquiry and assist the young person in finding an appropriate place.

Prospective volunteer enquiries

Retention period:
One year after the last meaningful contact, or until the person joins, whichever occurs first.

Reason:
To support the person through the joining process and respond to follow-up enquiries.

Unsuccessful applications for a volunteer, trustee or paid role

Retention period:
Six months after the decision.

Where the applicant has expressly agreed to be considered for future opportunities, relevant information may be retained for up to two years.

Reason:
To respond to questions or complaints about the process and, where agreed, contact the individual about future opportunities.

8.3 Young people in District provision

This section applies where the District directly operates or administers provision for young people, including Explorer Scouts, Scout Network activity or District events.

Essential membership history

Examples: Name, membership number, dates of membership, section or unit, awards and basic participation records.

Retention period:
Ten years after the young person leaves the District provision, unless held on a Scouts system subject to a separate national retention period.

Reason:
To respond to membership enquiries and support someone who returns to Scouts.

Current contact, health, dietary and support information

Retention period:
While the young person is an active member and for no more than three months after leaving, unless the information is required for an incident, complaint, safeguarding matter or legal claim.

Reason:
Current information is needed to operate provision safely but should not be retained once it is no longer relevant.

Local copies or exports from membership systems

Retention period:
Delete within three months after the copy is no longer required.

Reason:
The current record should normally be maintained in the authorised membership system rather than in duplicate spreadsheets or downloaded files.

8.4 Parents, guardians and emergency contacts

Parent and guardian contact information

Retention period:
While the young person is involved with the District and for two years afterwards, unless included in an event, complaint, incident or safeguarding record with a different retention period.

Reason:
To communicate about the young person and respond to relevant follow-up enquiries.

Emergency contact information held specifically for an event

Retention period:
Delete as soon as reasonably practical after the event, normally within three months, unless required as part of an incident or complaint.

Reason:
Emergency information is usually only required while the event is taking place and for immediate follow-up administration.

8.5 Adult volunteers

Adult volunteer operational records

Examples: Local contact details, role information, handover records and routine management correspondence not held on the Scouts Membership System.

Retention period:
For the duration of the role and for two years after the person leaves.

Reason:
To support role handover, answer enquiries and maintain operational continuity.

Adult information and onboarding forms

Retention period:
Until the required approval checks and initial learning are completed, or for twelve months, whichever is sooner.

Reason:
To support the joining and appointment process.

Identity documents and identity-checking information

Retention period:
Only until the identity check and relevant vetting submission have been completed.

Copies of passports, driving licences or other identity documents must not normally be retained.

Reason:
Identity information is required to complete the check but is not needed afterwards.

Disclosure certificates

The District must not retain copies of Disclosure and Barring Service certificates.

Any temporary information received as part of the process must be handled in accordance with Scouts’ vetting procedures and securely destroyed when no longer required.

Learning, qualification and accreditation working records

Retention period:
Two years after the volunteer leaves or after the information has been accurately recorded on the Scouts Membership System, whichever is sooner.

Reason:
The official record should normally be held on the Scouts Membership System rather than duplicated locally.

8.6 Permits and assessments

Successful permit applications and assessment records

Retention period:
For the duration of the permit and for two years after its expiry.

Reason:
To evidence the assessment and decision, support reviews and respond to enquiries or complaints.

Unsuccessful or withdrawn permit applications

Retention period:
Two years after the final decision or withdrawal.

Reason:
To respond to questions, support a future application and evidence how the decision was reached.

Assessor notes and supporting evidence

Only information relevant to the assessment should be retained.

Personal working notes should be transferred into the formal assessment record or securely destroyed once they are no longer needed.

8.7 Events and activities

Unsuccessful, cancelled or withdrawn event applications

Retention period:
Three months after the event or cancellation.

Reason:
To complete refunds and respond to immediate administrative enquiries.

One-off or ad hoc District events

Retention period:
Twelve months after the event.

Reason:
To complete event administration, budgeting, evaluation and respond to enquiries.

Recurring annual District events

Retention period:
Eighteen months after the event.

Reason:
To allow the previous event’s records to support planning and evaluation of the following event.

International events and trips

Retention period:
Five years after the event.

Reason:
International events may involve more complex travel, insurance, funding and administrative requirements.

Medical, dietary, accessibility and support information collected for an event

Retention period:
Delete as soon as the information is no longer required, normally within three months after the event.

Where an incident, complaint or claim occurs, relevant information must be retained with that record for the applicable longer period.

Reason:
Special-category information should not be retained after its immediate operational purpose has ended.

Event attendance records

Retention period:
The basic attendance record may be retained for up to two years unless it is held on an authorised Scouts system with a separate retention period.

Detailed contact, medical and consent information must be removed sooner in accordance with this policy.

Reason:
To confirm attendance and respond to reasonable enquiries without retaining unnecessary detailed information.

Nights Away Notifications, activity notifications and District approval records

Retention period:
Three years after the activity ends where no incident, complaint or insurance matter has occurred.

Reason:
To evidence that the notification or approval process was completed and respond to later operational enquiries.

Risk assessments and activity plans containing personal information

Retention period:
Three years after the activity ends where no incident has occurred.

Where an incident occurs, relevant records must be retained with the incident record for the applicable longer period.

Reason:
To evidence planning and decision-making and assist with the review of any later concern.

8.8 Accidents, incidents and safeguarding

Formal safety incidents involving an adult

Retention period:
Twenty years after the incident.

Reason:
To support insurance, legal and safety investigations and identify trends.

Formal safety incidents involving a young person

Retention period:
Twenty years after the young person turns 18.

Reason:
To support insurance, legal and safety investigations and identify trends.

Accident and first-aid records

Where an accident is reportable to Scouts UK Headquarters or an insurer, the District must follow the required reporting process and retain only the local information necessary.

The applicable formal safety-incident retention period should be used where the accident is recorded as a formal incident.

Safeguarding concerns

Safeguarding concerns must be reported and managed in accordance with Scouts’ safeguarding procedures.

The District must not create or retain unnecessary duplicate safeguarding case files.

Local information should only be retained:

where required to make the report;
where specifically instructed by the Scouts Safeguarding Team;
where necessary to protect a person from immediate harm; or
where another legal requirement applies.

Any retained safeguarding information must be kept strictly confidential, access-controlled and reviewed in accordance with instructions from the Scouts Safeguarding Team.

8.9 Finance, donations and Gift Aid

Accounting records

Examples: Invoices, receipts, expense claims, payment records, bank records and accounting working papers.

Retention period:
Six years after the end of the financial year or accounting period to which they relate.

Reason:
To meet accounting, audit, tax and governance requirements.

Gift Aid declarations and transaction records

Retention period:
Six years after the end of the financial year or accounting period containing the relevant donation or claim.

Reason:
To meet HM Revenue and Customs audit requirements.

Donation records

Retention period:
Six years after the end of the financial year in which the donation was received.

General donor contact information used for fundraising communications must be reviewed separately and should not automatically be retained for the full financial retention period.

Direct Debit mandates

Retention period:
Six years after the end of the financial year containing the final Direct Debit payment.

Reason:
To evidence the instruction and respond to claims or financial enquiries.

Grant applications

Retention period:
Three years after the final grant decision or, for successful grants, the period required by the funding agreement if longer.

Anonymised information about grants may be retained for longer for reporting and statistical purposes.

Reason:
To administer the grant, meet funding conditions and respond to queries or complaints.

8.10 Contracts, suppliers and property

Standard contracts and supplier agreements

Retention period:
Six years after the contract ends.

Reason:
To respond to contractual claims and enquiries.

Contracts executed as a deed

Retention period:
Twelve years after the deed or contractual obligation ends.

Reason:
To reflect the longer limitation period applying to deeds.

Property deeds, ownership records and permanent legal documents

Retention period:
Permanent.

Reason:
To demonstrate ownership, rights and legal obligations.

Supplier contact information

Retention period:
For the duration of the relationship and for two years afterwards, unless included in financial or contractual records subject to a longer period.

Reason:
To manage the relationship and respond to follow-up enquiries.

8.11 Governance and Trustee Board records

Signed Trustee Board minutes and Annual General Meeting minutes

Retention period:
Permanent.

Reason:
These form part of the District’s formal governance record.

Annual reports and approved annual accounts

Retention period:
Permanent.

Reason:
These form part of the District’s financial and governance history.

Governing documents, registrations and key policies

Retention period:
Permanent, with superseded policies clearly marked as archived.

Reason:
To maintain an accurate history of the District’s governance arrangements.

Trustee registers, declarations of interest and eligibility records

Retention period:
For the duration of the trustee’s appointment and for six years afterwards.

Reason:
To evidence proper governance and respond to later enquiries.

Trustee Board working papers

Retention period:
Six years after the relevant decision or meeting, unless the information has been incorporated into the permanent formal minutes and is no longer required.

Reason:
To evidence significant decisions while avoiding permanent retention of unnecessary working material.

8.12 Awards and recognition

Unsuccessful award nominations

Retention period:
One year after the final decision.

Reason:
To respond to questions and support any appropriate reconsideration.

Successful award nominations

Retention period:
Local supporting information should normally be deleted one year after the award is confirmed.

The formal award record may be retained on the Scouts Membership System or by Scouts UK Headquarters under their applicable retention policy.

Reason:
The central system should provide the permanent record, avoiding unnecessary local duplication.

Local District awards

Retention period:
Basic details of successful awards may be retained permanently as part of the District’s historical record.

Detailed citations and special-category information should be reviewed and removed when no longer required.

8.13 Complaints, concerns and whistleblowing

Formal complaints

Retention period:
Six years after the final recorded communication or closure of the complaint.

Reason:
To respond to follow-up enquiries and establish, exercise or defend legal claims.

Whistleblowing records

Retention period:
Six years after the final recorded communication or closure of the case.

Where the matter was raised anonymously, the period begins when the case is concluded.

Reason:
To evidence how the matter was considered and respond to legal or regulatory enquiries.

Informal concerns resolved without a formal complaint

Retention period:
Two years after resolution.

Where an informal concern develops into a formal complaint, safeguarding concern, safety incident or legal matter, the relevant longer retention period applies.

8.14 Data subject rights and data-protection records

Subject access requests and other data-rights requests

Retention period:
Seven years after the request is closed, or seven years after the individual turns 18 where that date is later.

Identity documents provided to verify the requester must be deleted once identity has been confirmed.

Reason:
To evidence how the request was handled and respond to later complaints or legal claims.

Data-protection complaints

Retention period:
Six years after the complaint is closed.

Reason:
To evidence how the complaint was investigated and resolved.

Personal-data breach records

Retention period:
Six years after the breach investigation is closed.

Where the breach relates to a safeguarding matter, safety incident or legal claim, the longer applicable retention period must be used.

Reason:
To demonstrate accountability, identify trends and respond to regulatory or legal enquiries.

Records of consent

Retention period:
For as long as the District relies on that consent and for up to six years afterwards where necessary to demonstrate that valid consent existed.

Only the minimum information needed to evidence the consent should be retained.

Suppression and opt-out records

Retention period:
For as long as the relevant mailing list, marketing activity or communication service continues.

Reason:
To respect the individual’s request not to receive further communications.

8.15 Employees and paid workers

This section applies only where the District employs staff or engages paid workers.

Unsuccessful recruitment records

Retention period:
Six months after the recruitment decision, unless the applicant has agreed that their details may be retained for future opportunities.

Personnel files

Retention period:
Six years after employment or engagement ends.

Payroll, salary, tax and National Insurance records

Retention period:
Six years after the end of the relevant tax year.

Working-time records

Retention period:
Two years from the date the record was created.

Family leave and statutory payment records

Retention period:
For the period required by applicable employment and tax legislation, normally at least three years after the end of the relevant tax year.

8.16 Photographs, video and audio recordings

Photographs and recordings of identifiable individuals

Retention period:
For as long as they remain suitable, accurate and necessary for the stated purpose, subject to a review at least every two years.

Reason:
Images may remain useful for publicity and historical purposes, but their continued use must be regularly reconsidered.

Images used for current publicity

Images should be removed from active publicity where:

consent is withdrawn and consent is the lawful basis;
an objection is upheld;
a safeguarding or privacy concern arises;
the image is no longer appropriate;
the image has become misleading or significantly out of date; or
the District no longer has a lawful reason to use it.

Historical archive photographs

Selected photographs may be retained permanently for genuine historical or archival purposes.

The District should retain only appropriate images and should document why permanent retention is justified.

8.17 Website, forms and digital systems

Online form submissions

Retention period:
According to the underlying purpose of the form.

Where the information has been transferred to the appropriate authorised record, duplicate form submissions and downloaded spreadsheets should be deleted within three months.

Website analytics

Retention period:
In accordance with the website’s Cookie Notice and the settings of the relevant analytics service.

Identifiable analytics information should not be retained longer than necessary.

System access and security logs

Retention period:
Up to two years, unless a longer period is needed to investigate a security concern or data breach.

Reason:
To maintain security and investigate suspected misuse.

Deleted items and recycle bins

Volunteers must not rely on recycle bins or deleted-item folders as permanent storage.

Information scheduled for deletion must be permanently removed when the relevant system permits.

Backups

Information may remain temporarily within secure system backups after deletion from active systems.

Backups must be protected, subject to the service provider’s normal backup cycle and not restored solely to recover information that has reached the end of its retention period.

9. Secure deletion and destruction

Digital information must be securely deleted from:

active folders;
shared drives;
personal devices;
downloaded files;
email folders;
recycle bins;
removable media; and
any other locations under the District’s control.

Paper information must be destroyed using:

a cross-cut shredder;
a confidential waste service; or
another secure destruction method approved by the District.

Sensitive or special-category information must not be placed in ordinary household or office waste.

Where equipment is being sold, donated, returned or disposed of, all District information must be securely erased before the equipment leaves the District’s control.

10. Anonymisation

Where information is useful for statistics, evaluation, census comparison or historical reporting, identifiable information should be removed where possible.

Anonymisation must be irreversible.

Removing a person’s name alone may not be sufficient where they could still be identified from:

their role;
Scout Group;
age;
event;
circumstances;
location; or
other information contained in the record.

Once information has been properly anonymised so that no individual can reasonably be identified, it is no longer personal information and may be retained for longer.

11. Requests for deletion

Individuals may ask the District to delete personal information held about them.

Requests should be sent to:

Email: dlv@woldsandcoastscouts.org.uk

The right to erasure is not absolute.

The District may need to retain some information where it is required for:

a legal obligation;
safeguarding;
safety;
insurance;
financial or tax records;
the establishment, exercise or defence of legal claims;
the handling of a complaint; or
another lawful purpose.

Where a deletion request is completed, the District may retain a minimal record showing:

that the request was received;
the date it was completed;
the categories of information deleted; and
any information that had to be retained and the reason.

12. Regular review

The District Data Lead will coordinate a review of retained personal information at least annually.

The review should include:

shared Microsoft 365 folders;
District email accounts;
Microsoft Forms;
downloaded spreadsheets;
Online Scout Manager exports;
event registration information;
Trustee Board working papers;
financial records;
volunteer records;
paper files; and
records held by volunteers on authorised devices.

The review should identify information which:

has reached the end of its retention period;
is duplicated;
is inaccurate;
no longer serves a clear purpose;
should be anonymised;
should be archived; or
requires a documented extension.

13. Departures from this policy

A retention period may only be extended where there is a clear and documented reason.

The record should state:

what information is being retained;
why additional retention is necessary;
the lawful basis;
who authorised the decision;
any access restrictions; and
the new review or deletion date.

A volunteer must not extend a retention period solely for convenience or because the information might be useful at an unspecified future date.

14. Contacting us

Questions about this policy, retention decisions or requests for deletion should be sent to:

Wolds & Coast Scout District
Email: dlv@woldsandcoastscouts.org.uk
Website: woldsandcoastscouts.org.uk

15. Policy approval and review

Version: Draft 1.0

Prepared: 27 July 2026

Approved by the District Trustee Board:

Next review: 27 July 2027

This policy will be reviewed earlier where there are significant changes to:

data protection legislation;
Scouts policies or procedures;
the District’s activities;
the systems used by the District;
insurance or legal requirements; or
the categories of personal information processed by the District.