Background
OnSide is a national youth charity that builds state-of-the-art Youth Zones in the UK’s most economically disadvantaged areas. Staffed by skilled youth workers, the centres aim to help young people discover their passions and purpose through unique partnerships with their communities, local authorities, and private business leaders.
The charity engaged The DPO Centre for support with GDPR compliance and understanding their role as joint data controllers with the growing network of Youth Zones. With limited internal resource, they required expert advice on processing high volumes of sensitive personal data.
Challenges
- Joint Data Controller
- Sensitive personal data
- GDPR understanding
Solution
The designated DPO conducted a comprehensive review of OnSide’s data processing activities, confirming its role as a joint data controller. This distinction clarified OnSide’s responsibility for transparent data handling, particularly in managing access to Youth Zone member data through Salesforce for reporting and funding purposes.
The DPO completed a Record of Processing Activities (RoPA) to capture valid legal bases for processing special category data and helped develop a singular membership form detailing this information.
They also introduced an annual training programme with quarterly awareness sessions for new joiners, equipping staff with data protection knowledge and building a privacy-centric culture among employees.
The expert guidance from the DPO has greatly improved OnSide’s GDPR compliance and maturity in their data protection practices. The charity understands the importance of Privacy by Design, ensuring data protection is at the heart of any new project or new processing activity.
Outcome
Duncan Hall, Senior IT & Systems Manager at Onside, said, ‘We were drawn to the DPO Centre’s blended approach – dedicated support combined with readily available advice. From the outset, their focus was on understanding our needs, building trust and confidence.
‘The impact has been significant. We’ve moved from a place of uncertainty to one of confidence in our data protection practices. Our team now views data protection as an integral part of their work, proactively seeking guidance and seeing it as an enabler, not a challenge. The dedicated DPO has been instrumental in this transformation. They were not just a reactive resource but proactively engaged with our team, providing guidance, getting involved in projects, identifying potential risks, and ensuring we stay ahead of data protection requirements – a true partner in our mission.’
