{"text_format":"1","workbook":"xlsx","n_sheets":13,"sheets":["1.Cover","2.GDPR Alignment Checklist","3.Athletes - Parents","4.Coach - Club Officials","5.Data Inventory","6.Data Security","7.Lawful Processing Records","8.Third Party Processors","9.Risk Register","10.Privacy Notice Register","LIA Register","Breach Register","SAR Register"],"not_rendered":{"charts":2,"images":30,"macros":1,"external_links":0,"defined_names":22,"comments":5,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"1.Cover","index":0,"n_rows":38,"n_cols":10,"rows_kept":38,"cut":false,"hidden":false,"merged":[[24,9,29,10],[31,9,34,10]]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,"GDPR Framework Register"]
[]
[]
[]
[]
[null,null,null,"This Spreadsheet includes"]
[null,null,null,null,null,null,null,null,null,"Follow the guidance on each sheet in the yellow boxes, follow the tabs in order."]
[null,null,2,"GDPR Alignment Checklist"]
[null,null,3,"Athletes - Parents Journey Map"]
[null,null,4,"Coach - Club Officials Journey Map"]
[null,null,5,"Data Inventory"]
[null,null,6,"Data Security"]
[null,null,7,"Lawful Processing Records"]
[null,null,8,"Third Party Processors",null,null,null,null,null,"Please watch this video in advance of completing this sheet."]
[null,null,9,"Risk Register"]
[null,null,10,"Privacy Notice Register"]
[null,null,11,"Legitimate Interest Assessment Register"]
[null,null,12,"Breach Register"]
[null,null,13,"Subject Access Request Register"]
[null,null,null,"Version 1.0"]

{"sheet":"2.GDPR Alignment Checklist","index":1,"n_rows":21,"n_cols":9,"rows_kept":21,"cut":false,"hidden":false,"merged":[[3,8,9,9],[14,8,17,9]]}
[]
[null,null,"GDPR ALIGNMENT CHECKLIST"]
[]
[null,null,"CATEGORY","TASK","ASSIGNED","NAME","COMPLETE",null,"PURPOSE : The purpose of this form is to manage the assignment and completion of the core areas for GDPR Alignment of your club. Please complete all tasks highlighted"]
[null,null,"Compliance Plan","Review the What is GDPR document",0,"OWNER NAME",0]
[null,null,"Impact Assessment","Select/Define Example Data Journey Map",0,"OWNER NAME",0]
[null,null,"Impact Assessment","Complete Data Inventory of all Personal Data sources",0,"OWNER NAME",0]
[null,null,"Impact Assessment","Complete table of all Data Security in place for Personal Data protection",0,"OWNER NAME",0]
[null,null,"Impact Assessment","Complete Lawful Processing Records tab",0,"OWNER NAME",0]
[null,null,"Impact Assessment","Document all Third Party Processors used today",0,"OWNER NAME",0]
[null,null,"Impact Assessment","Create risk mitigation plan",0,"OWNER NAME",0]
[null,null,"Consent","Establish baseline of required Privacy Notices in the Privacy Notice Register",0,"OWNER NAME",0]
[null,null,"Legitimate Interest","Where Legitimate Interest is used confirm balance test carried out and register this",0,"OWNER NAME",0]
[null,null,"Staff Awareness","Reviewed and distributed Breach Notification Process and Form",0,"OWNER NAME",0]
[null,null,"Staff Awareness","Reviewed and distributed Subject Access Request Process",0,"OWNER NAME",0,null,"Please watch this video in advance of completing this sheet."]
[null,null,"Data Protection Office","Communicate to coaches where to report breaches and subject access requests",0,"OWNER NAME",0]
[null,null,"Compliance Plan","Complete risk assessment - This register",0,"OWNER NAME",0]
[]
[null,{"$f":"COUNTIF(G5:G19,\">0\")/COUNTA(C5:C19)","v":0}]
[null,{"$f":"COUNTIF(E5:E19,\">0\")/COUNTA(C5:C19)","v":0}]
[null,{"$f":"COUNTIF($G$5:$G$19,\"<1\")/COUNTA($C5:$C20)","v":1}]

{"sheet":"3.Athletes - Parents","index":2,"n_rows":36,"n_cols":20,"rows_kept":36,"cut":false,"hidden":false,"merged":[[33,16,38,17],[1,16,4,17],[1,19,4,20],[7,16,11,17],[13,16,15,17],[17,16,23,17],[25,16,31,17]]}
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"PURPOSE : The purpose of this form is to capture the data processes for athletes and parents that exist within your club for visual representation",null,null,"Please watch this video in advance of completing this sheet."]
[]
[null,null,null,null,"Athletes and Parents Journey"]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"This is for the collection of personal data from athletes and parents, usually when they first join the club or events and competitions "]
[]
[null,"Personal Data"]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"How is the personal data on the athletes and parents collected, deselect all that do not apply to leave your capture methods. If there are other systems add the detail to the Data Inventory Tab"]
[null,"Collection method \n"]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Once collected where is this personal data long term stored for further use, deselect all that do not apply to leave your storage methods. If there are other systems add the detail to the Data Inventory Tab"]
[]
[]
[null,"Data Storage"]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"For any outbound communications you make that contains the athletes and parents personal data, what do you use, deselect all that do not apply to leave your transfer methods. If there are other systems add the detail to the Data Inventory Tab"]
[]
[]
[null,"Onward Communications"]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Which third parties do you pass the athlete and parents personal data onto, deselect all that do not apply to leave your third parties. If there are other systems add the detail to the Data Inventory Tab"]
[]
[null,"Third Party Recipients"]

{"sheet":"4.Coach - Club Officials","index":3,"n_rows":36,"n_cols":20,"rows_kept":36,"cut":false,"hidden":false,"merged":[[33,16,38,17],[1,16,4,17],[1,19,4,20],[7,16,11,17],[13,16,15,17],[17,16,23,17],[25,16,31,17]]}
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"PURPOSE : The purpose of this form is to capture the data processes for coaches and club officials that exist within your club for visual representation",null,null,"Please watch this video in advance of completing this sheet."]
[]
[null,null,null,null,"Coach/ Club Official Journey"]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"This is for the collection of personal data from coaches and club officials, usually when they first join the club, or their personal details change or they leave"]
[]
[null,"Personal Data"]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"How is the data on the coach or club official collected, deselect all that do not apply to leave your capture methods. If there are other systems add the detail to the Data Inventory Tab"]
[null,"Collection method \n"]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Once collected where is this data long term stored for further use, deselect all that do not apply to leave your storage methods. If there are other systems add the detail to the Data Inventory Tab"]
[]
[]
[null,"Data Storage"]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"For any outbound communications you make that contains the coaches or club officials data, what do you use, deselect all that do not apply to leave your transfer methods. If there are other systems add the detail to the Data Inventory Tab"]
[]
[]
[null,"Onward Communications"]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Which third parties do you pass the coaches and club officials data onto, deselect all that do not apply to leave your third parties. If there are other systems add the detail to the Data Inventory Tab"]
[]
[null,"Third Party Recipients"]

{"sheet":"5.Data Inventory","index":4,"n_rows":62,"n_cols":16,"rows_kept":62,"cut":false,"hidden":false,"merged":[[11,2,13,3],[1,2,7,3],[9,2,9,3]]}
[]
[null,null,"PURPOSE : The purpose of this form is to capture the data processes that exist within your club and evidence what you are doing with that data"]
[null,null,null,null,null,null,null,null,null,"DATA INVENTORY"]
[]
[]
[null,null,null,null,null,"PROCESS","DIRECTION","OWNER","DESCRIPTION","WHAT","WHO","HOW","WHERE","WHY","WHEN","COMMENTS"]
[null,null,null,null,null,"Data ","Receive or Transfer","Data owner","What is the Process activity","Personal or Sensitive","Who can access the data","How is this data received/transferred","Where is this data stored","Purpose for Process","How long is data kept","Comment"]
[null,null,null,null,null,"This is the process where personal data is gathered or transferred, these are examples to be used if applicable to your club","Is the direction of the personal data movement inbound to the club or outbound","Who is gathering or transferring the personal data","A description of the process with as much detail as possible","Is the data in this process personal or sensitive. Personal data is name, d.o.b, address etc.. And sensitive data is health records, religion etc..","During this process who has access to this data, select all that apply. If other is selected add further detail to the comments column","As part of this process how is the data received or transferred, select all that apply. If other is selected add further detail to the comments column","As part of this process where is the data stored, select all that apply. If other is selected add further detail to the comments column\n","What is the reason for the process, give as much detail as possible to demonstrate there is a justified reason to gather/transfer personal data","It is important to understand and document how long you will keep personal data as part of this process, this needs to be justified. The below are examples for the process","Where other has been selected or further detail is required for this process, add it here. It is good to add as much detail as possible to justify the process"]
[null,null,null,null,null,"Club Affiliation","Outbound","Club Official","A new club is being affiliated and as part of this affiliation you gather personal data of the Club Officials, volunteers and coaches who will run the new club","PERSONAL",null,null,null,"This process is required to enable the creation of a new club and to have it affiliated with England Athletics","Personal Data of the Club Officials and volunteers will be kept for 6 years post leaving the club, this is guidance from the Sports and Recreation Alliance."]
[null,null,"Please watch this video in advance of completing this sheet.",null,null,"New club official joining","Inbound","Club Official","The process for onboarding a new club official includes the collection of the officials personal data.","PERSONAL",null,null,null,"As part of ongoing club management this process allows the joining of new club officials. The individuals personal data is required administer their contract with us and to ensure they are suitable for the role","Personal Data of the Club Officials and volunteers will be kept for 6 years post leaving the club, this is guidance from the Sports and Recreation Alliance.","Social photography, publishing themselves and others on that channel"]
[null,null,null,null,null,"New athlete joining and registering with England Athletics","Inbound","Club Official","A new athlete joining completes a joiners form (INSERT NAME OF FORM) and this information is passed to the Club Officials. This contains detail of the athlete and the parents if under 18. The club official then registers this data with England Athletics using the Club Secretary Portal.","PERSONAL",null,null,null,"When a new athlete joins they are required to provide their personal data to administer any membership they have with us and managing our relationship with them, including dealing with payments and any support, service or product enquiries made by them. \n \nThis information is transferred to England Athletics for the purposes of affiliation and to attend registered events.","Personal data of the athlete and parent will be kept for 4 years after they have left the club.","Add detail as to why personal and reflect legal basis. Spilt process in 2 for sensitive and personal"]
[null,null,"This form is fully open for edits. If the examples don’t match with how you operate then edit as appropriate or delete all data in the row. You can add further processes to the bottom of the sheet",null,null,"New athlete joining without registering with England Athletics","Inbound","Club Official","A new athlete joining completes a joiners form (INSERT NAME OF FORM) and this information is passed to the Club Officials. This contains detail of the athlete and the parents if under 18.","PERSONAL",null,null,null,"When a new athlete joins they are required to provide their personal data to administer any membership they have with us and managing our relationship with them, including dealing with payments and any support, service or product enquiries made by them. ","Personal data of the athlete and parent will be kept for 4 years after they have left the club."]
[null,null,null,null,null,"New Athlete joining - health records gathering","Inbound","Club Official","In addition to the Personal Data above health care records are captured as the Athlete joins.","SENSITIVE PERSONAL",null,null,null,"When a new athlete joins they are required to provide their sensitive data health records to be able to provide them coaching that is appropriate for their needs and so that the coaching staff are aware of any existing medical consitions."]
[null,null,null,null,null,"Coach training","Outbound","Coach","Coaches receive personal data of athletes they are training as well as sensitive data which allows them to tailor their sessions and provide any extra support.","SENSITIVE PERSONAL",null,null,null,"The athletes sensitive data will be transferred to the coach delivering the training for the purposes of tailoring the session to their needs and for registration of the individuals participation.","A coach will hold sensitive personal data for the period they are training the athlete for and then delete this data when they are no longer training this individual","NOTE FROM EDITOR - There is the potential to reduce the sensitive data retained at the club by having the coach request details on existing health conditions as part of the session."]
[null,null,null,null,null,"Coach Register","Inbound","Coach","The coach will gather personal data on the individuals attending a session and record this on a register.","PERSONAL",null,null,null,"The coach will collect personal data from the athletes at the point of registering for a session or competition.","The personal data gathered as part of a session register will be deleted at the end of the session with the coach"]
[null,null,null,null,null,"Competition entry","Outbound","Club Official or Coach","The coach or club official will gather personal data on the individuals entering the competition.","SENSITIVE PERSONAL",null,null,null,"The athletes personal and sensitive data will be passed to the competition event provider for the purposes of registration and catering for any health and safety or disability concerns. ","The registration detail gathered for competition entry will be transferred to the athletes training record and retained as part of the personal data above. The competition provider will retain this detail for (ADD DETAIL HERE OF COMPETITION PROVIDER RETENTION)"]
[null,null,null,null,null,"Annual club survey","Outbound","Club Official","The club sends out a annual survey to the members over 18 and the parents for the younger members. The survey uses the email contact details of the targets and then requests them to provide more personal data as part of the survey.","PERSONAL",null,null,null,"The personal data of the parents will be captured as part of an annual survey on how the club is performing, this information will be used for trending performance of the club and introducing improvements.","The personal data will be kept for the period of 1 year and then deleted. This data is then anonymised and retained for an indefinate period for statistical analysis. "]
[null,null,null,null,null,"Transfer of athlete/coach/club official data beween committee members","Outbound","Club Official","The committee members receive personal and sensitive data on the athletes and the services being delivered on an annual basis. This information is used to understand the membership status and to evaluate the effectiveness of the club.","SENSITIVE PERSONAL",null,null,null,"Committee members will be in receipt of athletes, adult volunteers and club official personal and sensitive data for the purpose of reporting the clubs performance. This information is used to recognise areas the club can improve upon and what impact they are having on the athletes.","The personal and sensitive data used is the same as gathered during the joining process and as such is susceptible to the same 4 year retention period."]
[null,null,null,null,null,"Newsletter communications","Outbound","Club Official","Newsletters are sent to the parents and older athletes on a (ENTER FREQUENCY) basis. This is via emails using {a third party mass mailer}{email account}. This newsletter contains information about upcoming events, competition results and fundraising initiatives relating to membership with the club.","PERSONAL",null,null,null,"Personal data is {transferred to a third party mass mailer provider (ENTERNAME)}{,via email used} for the purposes of sending a club newsletter to the parents and athletes.","{The personal data is held with the third party provider of mass mailing until the individual leaves the club. It is then deleted}\n{The personal data is the same as gathered during the joining process and as such is susceptible to the same 4 year retention period.}"]
[null,null,null,null,null,"Marketing promotions","Outbound","Club Official","The club has a number of partner organisations that offer relevant services and discounts. The club informs parents and athletes of these through {email mass mailers.}{direct email.}","PERSONAL",null,null,null,"Personal data is {transferred to a third party mass mailer provider (ENTERNAME)}{,via email used} for the purposes of sending a club newsletter to the parents and athletes.","{The personal data is held with the third party provider of mass mailing until the individual leaves the club. It is then deleted}\n{The personal data is the same as gathered during the joining process and as such is susceptible to the same 4 year retention period.}"]
[null,null,null,null,null,"Social media","Inbound","Club Official","Parents and athletes are connected to the clubs social channels. As part of this channel we share personal data with the group and wider social platform, such as photographs and names.","PERSONAL",null,null,null,"The club social channels are used to promote the club, inform our members of events, competitions and news along with publicising members achievements","The personal data shared on our social channels is kept within the social platform until an individual requests it be removed "]
[null,null,null,null,null,"Fundraising individuals","Inbound","Club Official","The club has a number of individual givers who donate to the club on a regular basis through direct debits.","PERSONAL",null,null,null,"Personal data is collected from individual givers who donate on a regular basis to the club, this is for the purposes of gift aid claims","Personal data on the individual giver will be deleted 7 years post the last contribution for the purposes of Gift Aid claims"]
[null,null,null,null,null,"Fundraising  events","Inbound","Club Official","Fundraising events are held throughout the year to attract donations for the club to help with equipment purchases and general club administration.","PERSONAL",null,null,null,"Personal data is gathered from fund raising events of donors or potential donors who are funding the club. This data is required to contact these individuals and to complete gift aid claims","Personal data on the individual giver will be deleted 7 years post the last contribution for the purposes of Gift Aid claims"]
[null,null,null,null,null,"Social Events","Inbound","Club Official","The club organise and manage a number of social events throughout the year for the club officials, coaches, parents and athletes.","PERSONAL",null,null,null,"Personal data is gathered as part of organising attendees to social events. This data will be used for event registration and capacity planning","Personal data gathered for the purposes of event participation will be deleted 1 month after the event to allow for any queries that may arise post the event"]
[null,null,null,null,null,"Digital Imagery","Inbound","Club Official","At competitions, sessions and events, the club capture digital imagery of the athletes, coaches and parents for use on the media channels.","PERSONAL",null,null,null,"Digital imagery of athletes and parents is captured at competitions and training sessions to be used as part of the clubs digital presence, this includes the website, social channels and newsletters","Data imagery is used as a records of an athletes involvement in a particular competition, on team sheets, on results pages or in sports reports, photography or video coverage may be held indefinitely both by us, sports governing organisations and our partners in order to maintain a record of the sport.  \nWhere this data is published or broadcast it will no longer be subject to our control. Consent will be used to justify the images being taken in the first instance.","Guidance on photos, groups shots, social, existing images in library and on site, consent on registration"]
[null,null,null,null,null,"Athlete leaver","Outbound","Club Official","There is a defined process for when an athlete leaves the club to make sure their data is secure and retained only as long as necessary.","PERSONAL",null,null,null,"As part of an athlete leaving the personal and sensitive data held on this individual is maintained for 4 years post leaving. This allows an individual to re-join and maintain their history with us.","As part of an athlete leaving the personal and sensitive data held on this individual is maintained for 4 years post leaving. It is then deleted. 4 years is the average time an individual re-joins based on England Athletics analytics."]
[null,null,null,null,null,"Club Official Leaver","Outbound","Club Official","There is a defined process for when a club official leaves the club to make sure their data is secure and retained only as long as necessary.","PERSONAL",null,null,null,"As part of a club official leaving their personal data is maintained for 1 year for any queries they have for us or us with them.","Personal data on a club official is deleted 1 year  after they leave to allow for us to communicate with them for any final queries that may arise."]
[null,null,null,null,null,"Waiting lists","Inbound","Club Official","The club maintains a waiting list of potential athletes wanting to join the club. This list contains contact details of the athlete and their parents so they can be contacted when a space is available.","PERSONAL",null,null,null,"Waiting lists are maintained of athletes waiting to join the club. This contains personal data of the athlete and parent for the purposes of understanding what kind of place they require and how to contact them","Personal data of athletes and their parents is maintained on waiting lists for 2 years or until they are accepted into a club as a member, whichever is shorter."]
[null,null,null,null,null,"Results and club stats","Outbound","Club Official","Records of your involvement in a particular competition, on team sheets, on results pages. We will  data to maintain records of performances, including competitions and match reports, and club team competitions.","PERSONAL",null,null,null,"The publication of results is intrinsic to the activity concerned – athletics and running competition itself, by its nature, requires a result and for those involved to understand who has participated and beaten each other.","Keep indefinitely: The right to erasure does not apply if processing is necessary for statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing. "]
[]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,null,"NA"]

{"sheet":"6.Data Security","index":5,"n_rows":22,"n_cols":11,"rows_kept":22,"cut":false,"hidden":false,"merged":[[1,1,7,2],[11,1,12,2],[9,1,9,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the security provisions that exist for the data capture/transfer and storage used today within your club"]
[null,null,null,null,null,null,"DATA SECURITY"]
[]
[]
[null,null,null,null,"DATA PROCESS MEDIA","DATA STORAGE","SECURITY","VENDOR","DESCRIPTION","RISKS"]
[]
[null,null,null,null,"This is the data process media used for capture/transfer or storage of personal data","Data Storage is where the data is stored for further use","Add as much detail as possible as to the security measures in place for the protection of the personal data for this media","Who is the vendor of this media process if applicable","Give a good description as the use of this media the considerations made for alternatives and justify why it is the right choice","Highlight any risks you can see that the use of this media brings. If they are significant and need to be tracked then add them to the risk register also"]
[null,null,null,null,"Paper Form","Paper based forms are stored in the club officials home filing cabinet ","Filing cabinet is locked and can only be accessed by the club official","NA","Paper records are gathered as part of the joining process for athletes and coaches. This detail is retained on paper and stored at the residential premises of the club official. These papers come with the club official to competitions and events.","Significant risk of loss or theft of Sensitive Data. The ability to update is also limited"]
[null,"Please watch this video in advance of completing this sheet.",null,null,"Web Form","Data is captured by the online form and stored in the website database","The web form is protected by front end encryption (SSL) and the database is encrypted","The website is hosted by {INSERT VENDOR} and is a {ENTER TYPE OF WEBSITE, E.G. WORDPRESS} site","The website is hosted by {INSERT VENDOR} and is a {ENTER TYPE OF WEBSITE, E.G. WORDPRESS} site and form. The data held in this website is in an encrypted database that limited and named individuals have access to.","The database is an aggregated source of Sensitive Data and as such is a threat target. Care should be taken to secure this"]
[null,null,null,null,"E-Mail","Data is sent in via email as part of the joiners process. This is retained in my email","The email requires a username and password, it is also stored locally on my laptop that is encrypted and requires local logon with a Strong password","Microsoft Office365 (Exchange)","The joiners process requires the athlete/parent to email me Sensitive Personal Data. This data is retained within my email system, which is managed by a Third Party Processor in the cloud. I also store my emails locally and don’t delete them.","Email is an unsecure mechanism for sending plain text details. It should also only be retained for the period of transfer and added to a Membership Management System as early as possible"]
[null,"This form is fully open for edits. If the examples don’t match with how you operate then edit as appropriate or add further media process to the bottom of the sheet",null,null,"Membership Management Database (ADD NAME OF DATABASE)","(ADD NAME OF DATA BASE) is used to collect the Sensitive Personal Data.","(ADD NAME OF DATABASE) requires a username and password to access and uses a secure transfer mechanism (SSL)","{Clubspark}, {Sport Technology Group}, {Sport 80} etc..","(ENTER NAME OF DATABASE) is a Membership Management tool by a Third Party Processor. It requires user credentials to logon and uses SSL based encryption when I have access to data","(ENTER NAME OF DATABASE) is a Third Party Processor and is subject to the GDPR Checklist for alignment to the GDPR"]
[null,null,null,null,"Club Secretaries Portal/ MyAthletics Portal","Portals is used to collect the Sensitive Personal Data of athletes and coaches.","Portals requires a username and password to access and uses a secure transfer mechanism (SSL)","England Athletics","The portals are a Membership Management tool controlled by England Athletics. It requires user credentials to logon and uses SSL based encryption when I have access to data","England Athletics is a Joint Data Controller with the Club Officials when it comes to athletes and coaches sensitive and personal data. Joint Data Controller puts obligations on both parties that they should both be very clear about"]
[null,null,null,null,"Google Suite","Data is captured as part of an electronic G-Suite document","The Google Doc is filled in directly within my Google Drive. This requires me to invite the recipient to edit the file, it also uses SSL based encryption","Google","The Google Doc is the capture mechanism for data gathering. It works by sending a link to the recipient which is unique to them. They then use this link (encrypted) to complete the required detail. This is then stored directly into my Google Drive","The database is an aggregated source of Sensitive Data and as such is a threat target. Safeguards need to be provided by the vendor that data privacy is aligned to the GDPR"]
[null,null,null,null,"Microsoft Office","Data is captured via a Microsoft Word Document","The Word Doc is filled in directly by the recipient and emailed back to me. This communication is direct between the sender and recipient","Microsoft  ","The Word Doc is the capture mechanism for data gathering. This is via an email exchange and stored locally on my laptop.","The local laptop becomes an aggregated source of Sensitive Data. The security and continuity of this device needs to be considered"]
[null,null,null,null,"Microsoft Office 365","Data is stored in Microsoft Office 365 storage in both SharePoint and OneDrive","The Microsoft Office documents are created locally and on the web and stored in Office 365. This requires me to invite the recipient to edit the file, it also uses SSL based encryption","Microsoft","The Microsoft documents are the capture mechanism for data gathering. These are stored in Office 365. For sharing documents it works by sending a link to the recipient which is unique to them. They then use this link (encrypted) to complete the required detail. This is then stored directly into my Office 365 storage","The database is an aggregated source of Sensitive Data and as such is a threat target. Safeguards need to be provided by the vendor that data privacy is aligned to the GDPR"]
[null,null,null,null,"Social Media","Social media is used to share the Personal Data from the athlete or parent post a connection request","The social media platform has a requirement for username and password, it also uses SSL for encryption and all messages are Direct Messaging which is private","Social Media Provider","Social media is used to connect with the athletes and parents of the athletes. Personal Data is shared as part of club publicity within the platform","Social media platforms have large amounts of aggregated data and as such are targets. In addition, the platform is now a Third Party Processor and care should be taken to understand their stance on GDPR and data privacy."]
[null,null,null,null,"Mail Chimp","Mail Chimp is used to communicate with Parents, athletes and coaches for the purposes of newsletters and club information. Personal Data is stored in the Mail Chimp Database","Mail Chimp requires a username and password for access with a Strong password policy.","Mail Chimp","Mail Chimp is used to communicate with Parents, athletes and coaches for the purposes of newsletters and club information. ","Mail Chimp is a Third Party Processor and is subject to the GDPR Checklist for alignment to the GDPR"]
[null,null,null,null,"SurveyMonkey","SurveyMonkey is used to communicate with Parents, athletes and coaches for the purposes of completing online surveys on club matters. The personal data gathered is stored in the SurveyMonkey database","SurveyMonkey requires a username and password for access with a Strong password policy.","SurveyMonkey","SurveyMonkey is used to communicate with Parents, athletes and coaches for the purposes of completing online surveys on club matters.","SurveyMonkey is a Third Party Processor and is subject to the GDPR Checklist for alignment to the GDPR","`"]
[null,null,null,null,"SurveyGizmo","SurveyGizmo is used to communicate with Parents, athletes and coaches for the purposes of completing online surveys on club matters. The personal data gathered is stored in the SurveyGizmo database","SurveyGizmo requires a username and password for access with a Strong password policy.","SurveyGizmo","SurveyGizmo is used to communicate with Parents, athletes and coaches for the purposes of completing online surveys on club matters.","SurveyGizmo is a Third Party Processor and is subject to the GDPR Checklist for alignment to the GDPR"]
[null,null,null,null,"DotMailer","DotMailer is used to communicate with Parents, athletes and coaches for the purposes of newsletters and club information. Personal Data is stored in the DotMailer Database","DotMailer requires a username and password for access with a Strong password policy.","DotMailer","DotMailer is used to communicate with Parents, athletes and coaches for the purposes of newsletters and club information. ","DotMailer is a Third Party Processor and is subject to the GDPR Checklist for alignment to the GDPR"]
[null,null,null,null,"(ENTER NAME OF EVENTS ORGANISER)","EVENT ORGANISER is used to organise events with Parents, athletes and coaches . The personal data gathered is stored in the EVENT ORGANISER database","EVENT ORGANISER requires a username and password for access with a Strong password policy.","EVENT ORGANISER","EVENT ORGANISER is used to organise events with Parents, athletes and coaches .","EVENT ORAGNISER is a Third Party Processor and is subject to the GDPR Checklist for alignment to the GDPR"]

{"sheet":"7.Lawful Processing Records","index":6,"n_rows":37,"n_cols":20,"rows_kept":37,"cut":false,"hidden":false,"merged":[[1,1,5,2],[9,1,10,2],[7,1,7,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the lawful reason you are relying on for the data you are capturing / storing / transferring."]
[null,null,null,null,null,null,null,"GDPR PROCESSING RECORDS"]
[]
[]
[null,null,null,null,"SYSTEM OR PROCESS","The name of the data owner","The purposes of the processing; ","A description of the categories of data subjects and of the categories of personal data; ","Examples of the data captured that drives the data categorisation","Where possible, the envisaged time limits for erasure of the different categories of data; ","Lawful Process Article","Lawful Process Description","Approved by and when","Comments",null,null,"Data Type","Lawful Process Article","Lawful Process Description","General Description and example"]
[null,null,null,null,"This is the system or process as identified in the Data Inventory Tab.","This will be the top level of the club, usually, club official","This is the purpose for the processing as identified in the Data Inventory Tab","This is classification of the data in the process as identified in the Data Inventory Tab","Add the types of personal data involved in this process, add all that apply","This is the retention period for the data in this process as defined in the Data Inventory Tab","The Lawful Process is the justification for the data process. This needs to be selected to match the applicable description in the table to the right","The description that matches the Lawful Process Article will be auto populated when you select the appropriate article ID","Add the approver of this Lawful process from the club officials and date of approval",null,null,null,"Personal Data","6(1)(a)","Consent of the data subject","The individual who's personal data is in question has given you consent to carry out the process"]
[null,"Please watch this video in advance of completing this sheet.",null,null,{"$f":"'5.Data Inventory'!F9","v":"Club Affiliation"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I9","v":"A new club is being affiliated and as part of this affiliation you gather personal data of the Club Officials, volunteers and coaches who will run the new club"},{"$f":"'5.Data Inventory'!J9","v":"PERSONAL"},"Name, DOB, Address, e-mail address, phone number",{"$f":"'5.Data Inventory'!O9","v":"Personal Data of the Club Officials and volunteers will be kept for 6 years post leaving the club, this is guidance from the Sports and Recreation Alliance."}," 6(1)(b)",{"$f":"VLOOKUP(K8,$R$7:$S$22,2,FALSE)","v":"Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract"},"TBA",null,null,null,"Personal Data"," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract","The personal data on the individual is necessary for a contract purpose, such as data required to fulfil a warranty when purchasing an item"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F10","v":"New club official joining"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I10","v":"The process for onboarding a new club official includes the collection of the officials personal data."},{"$f":"'5.Data Inventory'!J10","v":"PERSONAL"},"Name, DOB, Address, e-mail address, phone number",{"$f":"'5.Data Inventory'!O10","v":"Personal Data of the Club Officials and volunteers will be kept for 6 years post leaving the club, this is guidance from the Sports and Recreation Alliance."}," 6(1)(b)",{"$f":"VLOOKUP(K9,$R$7:$S$22,2,FALSE)","v":"Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract"},"TBA",null,null,null,"Personal Data"," 6(1)(c)","Processing is necessary for compliance with a legal obligation","Legal obligations supersede GDPR where appropriate, this could include things such as DBS checks"]
[null,"This form is mostly pre populated from the Data Inventory tab, these fields are in bold italics. All other fields are editable and require completing",null,null,{"$f":"'5.Data Inventory'!F11","v":"New athlete joining and registering with England Athletics"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I11","v":"A new athlete joining completes a joiners form (INSERT NAME OF FORM) and this information is passed to the Club Officials. This contains detail of the athlete and the parents if under 18. The club official then registers this data with England Athletics using the Club Secretary Portal."},{"$f":"'5.Data Inventory'!J11","v":"PERSONAL"},"Name, DOB, Address, e-mail address, phone number",{"$f":"'5.Data Inventory'!O11","v":"Personal data of the athlete and parent will be kept for 4 years after they have left the club."}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract","TBA",null,null,null,"Personal Data","6(1)(d)","Processing is  necessary to protect the vital interests of a data subject or another person","An example of vital interests would be retaining somebodies details post a purchase in case of product recall"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F12","v":"New athlete joining without registering with England Athletics"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I12","v":"A new athlete joining completes a joiners form (INSERT NAME OF FORM) and this information is passed to the Club Officials. This contains detail of the athlete and the parents if under 18."},{"$f":"'5.Data Inventory'!J12","v":"PERSONAL"},"Name, DOB, Address, e-mail address, phone number",{"$f":"'5.Data Inventory'!O12","v":"Personal data of the athlete and parent will be kept for 4 years after they have left the club."}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract","TBA",null,null,null,"Personal Data"," 6(1)(e)","Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller","The data held is required to perform duties of public interest, such as reporting crimes"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F13","v":"New Athlete joining - health records gathering"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I13","v":"In addition to the Personal Data above health care records are captured as the Athlete joins."},{"$f":"'5.Data Inventory'!J13","v":"SENSITIVE PERSONAL"},"Name, Address, e-mail address, phone number, disabilities, health data",{"$f":"'5.Data Inventory'!O13","v":0},"9(2)(a)","Explicit consent of the data subject, unless reliance on consent is prohibited by EU or Member State law","TBA",null,null,null,"Personal Data"," 6(1)(f )","Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject","Legitimate interest is where your requirement to have data overrides objections from the data subject, such as data pertaining to safeguarding"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F14","v":"Coach training"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I14","v":"Coaches receive personal data of athletes they are training as well as sensitive data which allows them to tailor their sessions and provide any extra support."},{"$f":"'5.Data Inventory'!J14","v":"SENSITIVE PERSONAL"},"Name, Address, e-mail address, phone number, disabilities, health data",{"$f":"'5.Data Inventory'!O14","v":"A coach will hold sensitive personal data for the period they are training the athlete for and then delete this data when they are no longer training this individual"},"9(2)(a)","Explicit consent of the data subject, unless reliance on consent is prohibited by EU or Member State law","TBA",null,null,null,"Sensitive Personal","9(2)(a)","Explicit consent of the data subject, unless reliance on consent is prohibited by EU or Member State law","Where sensitive data is involved explicit consent is required from the data subject or parental guardian, such as medical records"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F15","v":"Coach Register"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I15","v":"The coach will gather personal data on the individuals attending a session and record this on a register."},{"$f":"'5.Data Inventory'!J15","v":"PERSONAL"},"Name, e-mail address, phone number",{"$f":"'5.Data Inventory'!O15","v":"The personal data gathered as part of a session register will be deleted at the end of the session with the coach"}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract","TBA",null,null,null,"Sensitive Personal","9(2)(b)","Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement","Where sensitive data is required to fulfil an obligation with an employee, such as health details for a pension"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F16","v":"Competition entry"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I16","v":"The coach or club official will gather personal data on the individuals entering the competition."},{"$f":"'5.Data Inventory'!J16","v":"SENSITIVE PERSONAL"},"Name, Address, e-mail address, phone number, disabilities, health data",{"$f":"'5.Data Inventory'!O16","v":"The registration detail gathered for competition entry will be transferred to the athletes training record and retained as part of the personal data above. The competition provider will retain this detail for (ADD DETAIL HERE OF COMPETITION PROVIDER RETENTION)"},"9(2)(a)","Explicit consent of the data subject, unless reliance on consent is prohibited by EU or Member State law","TBA","Fulfilling duties, like membership enquiries etc.. Performance of a contract",null,null,"Sensitive Personal","9(2)(c)","Processing is  necessary to protect the vital interests of a data subject or another individual where the data subject is physically or legally incapable of giving consent","The vital interests of the subject require you to have this data, such as allergies for dietary requirements"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F17","v":"Annual club survey"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I17","v":"The club sends out a annual survey to the members over 18 and the parents for the younger members. The survey uses the email contact details of the targets and then requests them to provide more personal data as part of the survey."},{"$f":"'5.Data Inventory'!J17","v":"PERSONAL"},"Name, e-mail address, phone number",{"$f":"'5.Data Inventory'!O17","v":"The personal data will be kept for the period of 1 year and then deleted. This data is then anonymised and retained for an indefinate period for statistical analysis. "}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract","TBA",null,null,null,"Sensitive Personal","9(2)(d)","Processing carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided the processing relates only to members or former members (or those who have regular contact with it in connection with those purposes) and provided there is no disclosure to a third party without consent","Necessary for the processing of data as part of a Not For Profit organisation based on a philosophical, religious, political trade union aim"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F18","v":"Transfer of athlete/coach/club official data beween committee members"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I18","v":"The committee members receive personal and sensitive data on the athletes and the services being delivered on an annual basis. This information is used to understand the membership status and to evaluate the effectiveness of the club."},{"$f":"'5.Data Inventory'!J18","v":"SENSITIVE PERSONAL"},"Name, e-mail address, phone number",{"$f":"'5.Data Inventory'!O18","v":"The personal and sensitive data used is the same as gathered during the joining process and as such is susceptible to the same 4 year retention period."},"6(1)(a)","Consent of the data subject",null,null,null,null,"Sensitive Personal","9(2)(e)","Processing relates to personal data manifestly made public by the data subject","This information is already in the public domain and published by the data subject"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F19","v":"Newsletter communications"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I19","v":"Newsletters are sent to the parents and older athletes on a (ENTER FREQUENCY) basis. This is via emails using {a third party mass mailer}{email account}. This newsletter contains information about upcoming events, competition results and fundraising initiatives relating to membership with the club."},{"$f":"'5.Data Inventory'!J19","v":"PERSONAL"},"Name, e-mail address",{"$f":"'5.Data Inventory'!O19","v":"{The personal data is held with the third party provider of mass mailing until the individual leaves the club. It is then deleted}\n{The personal data is the same as gathered during the joining process and as such is susceptible to the same 4 year retention period.}"}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract",null,null,null,null,"Sensitive Personal","9(2)(f)","Processing is necessary for the establishment, exercise or defence of legal claims or where courts are acting in their judicial capacity","To fight legal claims on the data subjects behalf this information is required"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F20","v":"Marketing promotions"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I20","v":"The club has a number of partner organisations that offer relevant services and discounts. The club informs parents and athletes of these through {email mass mailers.}{direct email.}"},{"$f":"'5.Data Inventory'!J20","v":"PERSONAL"},"Name, e-mail address",{"$f":"'5.Data Inventory'!O20","v":"{The personal data is held with the third party provider of mass mailing until the individual leaves the club. It is then deleted}\n{The personal data is the same as gathered during the joining process and as such is susceptible to the same 4 year retention period.}"},"6(1)(a)","Consent of the data subject",null,null,null,null,"Sensitive Personal","9(2)(g)","Processing is necessary for reasons of substantial public interest on the basis of Union or Member State law which is proportionate to the aim pursued and which contains appropriate safeguards","Substantial public interest may be informing authorities of an individual that poses a threat."]
[null,null,null,null,{"$f":"'5.Data Inventory'!F21","v":"Social media"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I21","v":"Parents and athletes are connected to the clubs social channels. As part of this channel we share personal data with the group and wider social platform, such as photographs and names."},{"$f":"'5.Data Inventory'!J21","v":"PERSONAL"},"Name, Photograph",{"$f":"'5.Data Inventory'!O21","v":"The personal data shared on our social channels is kept within the social platform until an individual requests it be removed "},"6(1)(a)",{"$f":"VLOOKUP(K20,$R$7:$S$22,2,FALSE)","v":"Consent of the data subject"},null,null,null,null,"Sensitive Personal","9(2)(h)","Processing is necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of Union or Member State law or a contract with a health professional","The sensitive data is required to assess the individuals ability to carry out their duties and respond to their medical needs if necessary"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F22","v":"Fundraising individuals"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I22","v":"The club has a number of individual givers who donate to the club on a regular basis through direct debits."},{"$f":"'5.Data Inventory'!J22","v":"PERSONAL"},"Name, e-mail address, phone number, bank details",{"$f":"'5.Data Inventory'!O22","v":"Personal data on the individual giver will be deleted 7 years post the last contribution for the purposes of Gift Aid claims"}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract","Performance contract",null,null,null,"Sensitive Personal","9(2)(i)","Processing is  necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of healthcare and of medicinal products or medical devices","Substantial public interest may be informing authorities of an outbreak of a contagious disease, sensitive data will be required for this"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F23","v":"Fundraising  events"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I23","v":"Fundraising events are held throughout the year to attract donations for the club to help with equipment purchases and general club administration."},{"$f":"'5.Data Inventory'!J23","v":"PERSONAL"},"Name, e-mail address, phone number, bank details",{"$f":"'5.Data Inventory'!O23","v":"Personal data on the individual giver will be deleted 7 years post the last contribution for the purposes of Gift Aid claims"}," 6(1)(b)",{"$f":"VLOOKUP(K22,$R$7:$S$22,2,FALSE)","v":"Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract"},null,null,null,null,"Sensitive Personal","9(2)(j)","Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes in accordance with Article 89(1)","The sensitive data is required to maintain records that are required for research purposes and historical importance"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F24","v":"Social Events"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I24","v":"The club organise and manage a number of social events throughout the year for the club officials, coaches, parents and athletes."},{"$f":"'5.Data Inventory'!J24","v":"PERSONAL"},"Name, e-mail address, phone number",{"$f":"'5.Data Inventory'!O24","v":"Personal data gathered for the purposes of event participation will be deleted 1 month after the event to allow for any queries that may arise post the event"}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F25","v":"Digital Imagery"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I25","v":"At competitions, sessions and events, the club capture digital imagery of the athletes, coaches and parents for use on the media channels."},{"$f":"'5.Data Inventory'!J25","v":"PERSONAL"},"Name, Photograph",{"$f":"'5.Data Inventory'!O25","v":"Data imagery is used as a records of an athletes involvement in a particular competition, on team sheets, on results pages or in sports reports, photography or video coverage may be held indefinitely both by us, sports governing organisations and our partners in order to maintain a record of the sport.  \nWhere this data is published or broadcast it will no longer be subject to our control. Consent will be used to justify the images being taken in the first instance."},"6(1)(a)","Consent of the data subject"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F26","v":"Athlete leaver"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I26","v":"There is a defined process for when an athlete leaves the club to make sure their data is secure and retained only as long as necessary."},{"$f":"'5.Data Inventory'!J26","v":"PERSONAL"},"Name, DOB, Address, e-mail address, phone number",{"$f":"'5.Data Inventory'!O26","v":"As part of an athlete leaving the personal and sensitive data held on this individual is maintained for 4 years post leaving. It is then deleted. 4 years is the average time an individual re-joins based on England Athletics analytics."}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F27","v":"Club Official Leaver"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I27","v":"There is a defined process for when a club official leaves the club to make sure their data is secure and retained only as long as necessary."},{"$f":"'5.Data Inventory'!J27","v":"PERSONAL"},"Name, DOB, Address, e-mail address, phone number",{"$f":"'5.Data Inventory'!O27","v":"Personal data on a club official is deleted 1 year  after they leave to allow for us to communicate with them for any final queries that may arise."}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F28","v":"Waiting lists"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I28","v":"The club maintains a waiting list of potential athletes wanting to join the club. This list contains contact details of the athlete and their parents so they can be contacted when a space is available."},{"$f":"'5.Data Inventory'!J28","v":"PERSONAL"},"Name, DOB, Parents e-mail address, parents phone number",{"$f":"'5.Data Inventory'!O28","v":"Personal data of athletes and their parents is maintained on waiting lists for 2 years or until they are accepted into a club as a member, whichever is shorter."}," 6(1)(f )","Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F29","v":"Results and club stats"},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I29","v":"Records of your involvement in a particular competition, on team sheets, on results pages. We will  data to maintain records of performances, including competitions and match reports, and club team competitions."},{"$f":"'5.Data Inventory'!J29","v":"PERSONAL"},"Name, DOB",{"$f":"'5.Data Inventory'!O29","v":"Keep indefinitely: The right to erasure does not apply if processing is necessary for statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing. "}," 6(1)(b)","Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract"]
[null,null,null,null,{"$f":"'5.Data Inventory'!F30","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I30","v":0},{"$f":"'5.Data Inventory'!J30","v":0},null,{"$f":"'5.Data Inventory'!O30","v":0},null,{"$error":"#N/A"}]
[null,null,null,null,{"$f":"'5.Data Inventory'!F31","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I31","v":0},{"$f":"'5.Data Inventory'!J31","v":"NA"},null,{"$f":"'5.Data Inventory'!O31","v":0},null,{"$error":"#N/A"}]
[null,null,null,null,{"$f":"'5.Data Inventory'!F32","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I32","v":0},{"$f":"'5.Data Inventory'!J32","v":"NA"},null,{"$f":"'5.Data Inventory'!O32","v":0},null,{"$error":"#N/A"}]
[null,null,null,null,{"$f":"'5.Data Inventory'!F33","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I33","v":0},{"$f":"'5.Data Inventory'!J33","v":"NA"},null,{"$f":"'5.Data Inventory'!O33","v":0},null,{"$error":"#N/A"}]
[null,null,null,null,{"$f":"'5.Data Inventory'!F34","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I34","v":0},{"$f":"'5.Data Inventory'!J34","v":"NA"},null,{"$f":"'5.Data Inventory'!O34","v":0},null,{"$error":"#N/A"}]
[null,null,null,null,{"$f":"'5.Data Inventory'!F35","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I35","v":0},{"$f":"'5.Data Inventory'!J35","v":"NA"},null,{"$f":"'5.Data Inventory'!O35","v":0},null,{"$error":"#N/A"}]
[null,null,null,null,{"$f":"'5.Data Inventory'!F36","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I36","v":0},{"$f":"'5.Data Inventory'!J36","v":"NA"},null,{"$f":"'5.Data Inventory'!O36","v":0},null,{"$error":"#N/A"}]
[null,null,null,null,{"$f":"'5.Data Inventory'!F37","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I37","v":0},{"$f":"'5.Data Inventory'!J37","v":"NA"},null,{"$f":"'5.Data Inventory'!O37","v":0},null,{"$error":"#N/A"}]
[null,null,null,null,{"$f":"'5.Data Inventory'!F38","v":0},"ENTER NAME OF REPONSIBLE PERSON",{"$f":"'5.Data Inventory'!I38","v":0},{"$f":"'5.Data Inventory'!J38","v":"NA"},null,{"$f":"'5.Data Inventory'!O38","v":0},null,{"$error":"#N/A"}]

{"sheet":"8.Third Party Processors","index":7,"n_rows":28,"n_cols":12,"rows_kept":28,"cut":false,"hidden":false,"merged":[[1,1,7,2],[14,1,26,2],[9,1,12,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the third party processors that you use to complete a certain processing activity with the personal data you control"]
[null,null,null,null,null,null,"THIRD PARTY PROCESSOR CHECKLIST"]
[]
[]
[]
[]
[null,null,null,null,"THIRD PARTY","SERVICE","DETAIL","RETENTION PERIOD","CONTRACT RENEWAL DATE","INCIDENT REPORTING PROCESS","GDPR COMPLIANT","Notes"]
[null,null,null,null,"Enter the name of the identified third party used for a processing activity","Give the name of the service provided by this third party processor","Enter as much detail as possible on what the service is that is provided by the third party","Specify the period of time the third party will have access to the data","Enter the date for the contract renewal with the third party","Do the third party have a robust incident reporting process","Have you had confirmation from the third party that they are GDPR Compliant. If not they should be issued the Third Party Processor Checklist to complete","Notes"]
[null,"Please watch this video in advance of completing this sheet.",null,null,"Google","Google Suite","Office application suite and Google Drive Cloud Storage","Undefined","Unknown","Yes","CONFIRMED"]
[null,null,null,null,"Google","Analytics","Analytics drawn from Google Search Engine and Ad Words","Undefined","Unknown","Yes","CONFIRMED"]
[null,null,null,null,"Microsoft","Office 365","Office application suite excluding OneDrive Cloud Storage","Undefined","Unknown","Yes","CONFIRMED"]
[null,null,null,null,"Drobox","Personal","Personal Cloud Storage","Undefined","Unknown","No","UNCONFIRMED"]
[null,null,null,null,"England Athletics","Secretaries Portal","Membership Management platform for clubs and athletes","Undefined","Unknown","No","CONFIRMED"]
[null,"This form currently contains examples that may or not be applicable for you. Review and edit as appropriate. Larger third parties such as Google and Microsoft will have GDPR alignment statements on their websites",null,null,"Events organiser xx","Activity xx","Activity provided by third party who need the personal data of attendees","Undefined","Unknown","No","UNCONFIRMED"]
[null,null,null,null,"DotMailer","Mass Mailer","Mass mailer tool used for communications with the club athletes and parents","Undefined","Unknown","No","UNCONFIRMED"]
[null,null,null,null,"SurveyGizmo","Survey Tool","Survey tool used to complete surveys with the club athletes and parents","Undefined","Unknown","No","UNCONFIRMED"]
[null,null,null,null,"SurveyMonkey","Survey Tool","Survey tool used to complete surveys with the club athletes and parents","Undefined","Unknown","No","UNCONFIRMED"]
[null,null,null,null,"Mail Chimp","Mass Mailer","Mass mailer tool used for communications with the club athletes and parents","Undefined","Unknown","No","UNCONFIRMED"]
[null,null,null,null,"Membership management database xx","Membership Management","Membership Management platform for coaches and athletes","Undefined","Unknown","No","UNCONFIRMED"]
[null,null,null,null,null,null,null,null,null,"No","UNCONFIRMED"]
[null,null,null,null,null,null,null,null,null,"No","UNCONFIRMED"]
[null,null,null,null,null,null,null,null,null,"No","UNCONFIRMED"]
[null,null,null,null,null,null,null,null,null,"No","UNCONFIRMED"]
[null,null,null,null,null,null,null,null,null,"No","UNCONFIRMED"]
[null,null,null,null,null,null,null,null,null,"No","UNCONFIRMED"]
[null,null,null,null,null,null,null,null,null,"No","UNCONFIRMED"]
[null,null,null,null,null,null,null,null,null,"No","UNCONFIRMED"]

{"sheet":"9.Risk Register","index":8,"n_rows":25,"n_cols":13,"rows_kept":25,"cut":false,"hidden":false,"merged":[[1,1,7,2],[11,1,12,2],[9,1,9,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the risks identified as part "]
[null,null,null,null,null,null,null,"RISK REGISTER"]
[]
[]
[null,null,null,null,"RISK No","FUNCTIONAL AREA","OWNER","RISK","RATING","RECOMMENDATION","COST","STATUS","Mitigation"]
[null,null,null,null,"Number identifier for the risk","The area of the club that the risk applies to","The owner of the risk and its mitigation","Give a good description of the risk so it is clear what it actually is","Rate the risk based on its impact","Add a detailed description of the recommendation for managing / mitigating the risk. This isn't necessarily the mitigation, merely an idea of what is possible","Indication of any cost impact for mitigation","Give the risk a status dependent on its mitigation","Describe the mitigation that has been chosen for the risk in as much detail as possible"]
[null,null,null,null,1,"Club Officials","TBC","Third Party Processor may refuse to or not be able to demonstrate GDPR compliance","MEDIUM","Work with suppliers that are aligning with the GDPR and can demonstrate alignment to the GDPR. Alternative is to accept as a business risk","NA","PENDING REVIEW","TBC"]
[null,null,null,null,2,"Club Officials","TBC","Maintain records of Lawful Processing at data capture source is mandated to be on going","MEDIUM","Review data repositories and develop a method for maintaining evidence of Lawful Processing. This register acts as the evidence but requires updating when things change within the club","NA","PENDING REVIEW","TBC"]
[null,"Please watch this video in advance of completing this sheet.",null,null,3,"Club Officials and coaches","TBC","Local laptops holding Sensitive Personal Data do not have \"Strong\" passwords - Strong = 8 characters or more, mixture of letters, numbers and special characters","HIGH","Implement a local password on the laptops that meets the Strong password criteria","NA","PENDING REVIEW","TBC"]
[null,null,null,null,4,"Club Officials and coaches","TBC","No local encryption for local laptops holding Sensitive Personal Data","MEDIUM","Laptops have the ability to store personal data locally, this should be protected in case of loss or theft by encryption","Low","PENDING REVIEW","TBC"]
[null,"This form currently contains examples that may or not be applicable for you. Review and edit as appropriate",null,null,5,"Club Officials and coaches","TBC","Paper based records are kept in a variety of locations that contain Sensitive Personal Data","HIGH","Review the requirement to hold paper based records. Where possible replace this with an electronic means, such as online webforms, membership management platform or a cloud based office application. Where it is required, store printed paper records in physical and lockable cabinets and store for only as long as required","Low","PENDING REVIEW","TBC"]
[null,null,null,null,6,"Club Officials","TBC","Sensitive Personal Data is captured at multiple points during an athletes journey through the club, such as competitions.","MEDIUM","Review the frequency and mechanisms used for gathering Sensitive Personal Data, minimise where possible. Where this activity is required, ensure it is documented as part of this register (impact assessment) and secure as appropriate using best practices","NA","PENDING REVIEW","TBC"]
[null,null,null,null,7,"Club Officials","TBC","Privacy Policies at data capture points do not give transparent statements or the ability to opt In to further communications","HIGH","Add a Privacy Statement at each data collection point (web form, joiners form etc..) that is clear and transparent to answer; what, why, when and where with regards to the data you are gathering. In addition you need to present the additional opt in boxes for the Data Subject to select if you wish to send them communication that is outside the scope of the direct purpose of membership, England Athletics have supplied templates that can assist: https://www.englandathletics.org/clubs--community/club-management/gdpr-and-data-protection-advice","NA","PENDING REVIEW","TBC"]
[null,null,null,null,8,"Club Officials","TBC","If the Data Subject (athlete, parent, coach, donor) request their detail to be deleted/changed/reported on it will be difficult to ensure data corrected in multiple data sources","HIGH","Use the journey detail captured in this register for the athlete, coach, parent, donor to review the data stores in use and look to minimise where it makes sense. Where a Third Party Processor is in use, check their alignment to the GDPR to assist with such requests, review again upon their response","NA","PENDING REVIEW","TBC"]
[null,null,null,null,9,"Club Officials","TBC","Documentation for IT Systems in use across the club is very low","HIGH","Use this GDPR Register to start a documentation pack on the IT estate.","NA","PENDING REVIEW","TBC"]
[null,null,null,null,10,"Club Officials","TBC","All data captured is kept forever with no defined policies for retention of this data","HIGH","Review the data sources and categories highlighted in the Data Inventory and align an appropriate and justified retention policy to each, this should match the retention periods defined in the privacy notice, England Athletics have supplied templates that can assist: https://www.englandathletics.org/clubs--community/club-management/gdpr-and-data-protection-advice","NA","PENDING REVIEW","TBC"]
[null,null,null,null,11]
[null,null,null,null,12]
[null,null,null,null,13]
[null,null,null,null,14]
[null,null,null,null,15]
[null,null,null,null,16]
[null,null,null,null,17]
[null,null,null,null,18]

{"sheet":"10.Privacy Notice Register","index":9,"n_rows":14,"n_cols":10,"rows_kept":14,"cut":false,"hidden":false,"merged":[[11,1,11,2],[1,1,7,2],[9,1,9,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the Privacy Notices that are required at the various data capture points to inform individuals of what, why, when with regards to their data"]
[null,null,null,null,null,null,"PRIVACY NOTICE REGISTER"]
[]
[]
[]
[null,null,null,null,"NAME","ISSUE DATE","LOCATED","NOTES","GDPR READY","DATE WITHDRAWN"]
[null,null,null,null,"Give the Privacy Notice a name to identify it","The date the Privacy Notice has been issued","Where is this Privacy Notice located","Add detail on the current status of the Privacy Notice, specifically if you need to update it to align to the GDPR","Is it GDPR ready as is","If not then what date was It withdrawn"]
[null,null,null,null,"Paper based joiners form","TBI","On paper based joiners forms for athletes and coaches","The existing Privacy Notice does not give the Data Subject enough transparency on What, Why and Where, when it comes to the data being gathered. In addition the Privacy Notice does not offer opt In boxes for communication on further services","NO"]
[null,"Please watch this video in advance of completing this sheet. ",null,null,"Web based joiners form","TBI","On web based joiners forms for athletes an coaches","The existing Privacy Notice does not give the Data Subject enough transparency on What, Why and Where, when it comes to the data being gathered. In addition the Privacy Notice does not offer opt In boxes for communication on further services","NO"]
[null,null,null,null,"Joiners form on Membership Management platform","TBI","Membership Management Platform joiners forms for athletes and coaches","The existing Privacy Notice does not give the Data Subject enough transparency on What, Why and Where, when it comes to the data being gathered. In addition the Privacy Notice does not offer opt In boxes for communication on further services","NO"]
[null,"This form currently contains examples that may or not be applicable for you. Review and edit as appropriate",null,null,"Paper based event form","TBI","On paper based event consent form for athletes and coaches","The existing Privacy Notice does not give the Data Subject enough transparency on What, Why and Where, when it comes to the data being gathered. In addition the Privacy Notice does not offer opt In boxes for communication on further services","NO"]
[null,null,null,null,"Web based event form","TBI","On web based event consent form for athletes and coaches","The existing Privacy Notice does not give the Data Subject enough transparency on What, Why and Where, when it comes to the data being gathered. In addition the Privacy Notice does not offer opt In boxes for communication on further services","NO"]
[null,null,null,null,"Membership Management Platform event form","TBI","Membership Management Platform event consent form for athletes and coaches","The existing Privacy Notice does not give the Data Subject enough transparency on What, Why and Where, when it comes to the data being gathered. In addition the Privacy Notice does not offer opt In boxes for communication on further services","NO"]

{"sheet":"LIA Register","index":10,"n_rows":62,"n_cols":17,"rows_kept":62,"cut":false,"hidden":false,"merged":[[1,1,6,2],[9,1,14,2],[16,1,19,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the assessment you have completed for the justification of legitimate interest as a lawful purpose for processing personal data"]
[null,null,null,null,null,null,"Legitimate Interest Assessments"]
[]
[]
[null,null,null,null,"Relationship with data subject","Sensitive data","Data subject expectation","Data subject explanation","What is the reason","Objection or intrusive","Data subject impact","Impact size","Children's data","Vulnerability","Safeguards","Opt-out","Decision"]
[null,null,null,null,"What is the nature of your relationship with the individual? Why do you want to carry out the processing\n","Is any of the data particularly sensitive or private?","Would people expect you to use their data in this way?","Are you able to explain to them?",null,"Are some people likely to object or find it intrusive?","What is the possible impact on the individual?","How big an impact might it have on them?","For this process are you processing children’s data?","Are any of the individuals vulnerable in any other way?","Can you adopt any safeguards to minimise the impact?","Can you offer an opt-out?","Am I comfortable I have legitimate interest"]
[null,null,null,null,"Athletes parent - Introduction to talent scout","No","Yes","Yes","The talent scout attends without pre warning and requests details of athletes / parents when they stand out. The club believe this justifies approaching the parents without any prior warning or consent.","No","They may object to a direct approach without pre warning. But I would expect them to see this as positive for them and their child","Low","No","No","Yes","Yes","Yes"]
[]
[null,"This form is to be used to demonstrate a balance test has been completed for assessing legitimate interest"]
[]
[]
[]
[]
[]
[]
[null,"Please watch this video in advance of completing this sheet. "]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,"Further guidance on legitimate interest lawful processing:"]
[]
[null,null,null,null,"First, identify the legitimate interest(s). Consider:"]
[]
[null,null,null,null,"Why do you want to process the data – what are you trying to achieve?"]
[null,null,null,null,"Who benefits from the processing? In what way?"]
[null,null,null,null,"Are there any wider public benefits to the processing?"]
[null,null,null,null,"How important are those benefits?"]
[null,null,null,null,"What would the impact be if you couldn’t go ahead?"]
[null,null,null,null,"Would your use of the data be unethical or unlawful in any way?"]
[]
[null,null,null,null,"Second, apply the necessity test. Consider:"]
[]
[null,null,null,null,"Does this processing actually help to further that interest?"]
[null,null,null,null,"Is it a reasonable way to go about it?"]
[null,null,null,null,"Is there another less intrusive way to achieve the same result?"]
[]
[null,null,null,null,"Third, do a balancing test as above. Consider the impact of your processing and whether this overrides the interest you have identified."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,"Can you offer an opt-out?"]

{"sheet":"Breach Register","index":11,"n_rows":17,"n_cols":13,"rows_kept":17,"cut":false,"hidden":false,"merged":[[1,1,6,2],[9,1,14,2],[16,1,19,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture any breaches that may occur and requiring registering for future audit. REMEMBER: You have 72 hours to report a breach to the ICO, if serious"]
[null,null,null,null,null,null,"DATA BREACH REGISTER"]
[]
[]
[null,null,null,null,"Breach Description","Date of breach","Breach Effect","Remedial Action Taken","Date of remediation","Personal Data Affected","Number of data subjects affected","Number of personal data records affected","Likely consequences of the Breach"]
[null,null,null,null,"Supply a description of the breach","The date the breach occurred","The effect the breach had or is likely to have on the data subjects","Describe any action taken to remediate the breach ","Date the remediation was completed","Details of data types involved in the breach","How many data subjects / individuals were involved","How many records of the data subjects were involved","What might happen now this data is breached"]
[]
[]
[null,"This form is to be used in the event of a breach and maintained for future reference"]
[]
[]
[]
[]
[]
[]
[null,"Please watch this video in advance of completing this sheet. "]

{"sheet":"SAR Register","index":12,"n_rows":18,"n_cols":11,"rows_kept":18,"cut":false,"hidden":false,"merged":[[1,1,6,2],[9,1,15,2],[17,1,20,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the SAR's received and the progress of them. REMEMBER: You have 1 month to respond to a SAR"]
[null,null,null,null,null,"SUBJECT ACCESS REQUEST REGISTER"]
[]
[]
[null,null,null,null,"DSAR Name","Date Received","ID Verified","Discovery Requested","Discovery Completed","Data Sanitised","Data sent to requestor"]
[null,null,null,null,"The name of the Data Subject in question","Date the request was received","Has the ID been verified, the SAR information cannot be released unless","What date was the discovery of data requested","What date was the data discovery completed","What date was the data sanitised","How many records of the data subjects were involved"]
[]
[]
[null,"This form is to be used in the event of a SAR and maintained for future reference"]
[]
[]
[]
[]
[]
[]
[]
[null,"Please watch this video in advance of completing this sheet. "]