{"text_format":"1","workbook":"xlsx","n_sheets":1,"sheets":["9.Risk Register"],"not_rendered":{"charts":0,"images":2,"macros":1,"external_links":0,"defined_names":7,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"9.Risk Register","index":0,"n_rows":25,"n_cols":13,"rows_kept":25,"cut":false,"hidden":false,"merged":[[1,1,7,2],[11,1,12,2],[9,1,9,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the risks identified as part "]
[null,null,null,null,null,null,null,"RISK REGISTER"]
[]
[]
[null,null,null,null,"RISK No","FUNCTIONAL AREA","OWNER","RISK","RATING","RECOMMENDATION","COST","STATUS","Mitigation"]
[null,null,null,null,"Number identifier for the risk","The area of the trust/group that the risk applies to","The owner of the risk and its mitigation","Give a good description of the risk so it is clear what it actually is","Rate the risk based on its impact","Add a detailed description of the recommendation for managing / mitigating the risk. This isn't necessarily the mitigation, merely an idea of what is possible","Indication of any cost impact for mitigation","Give the risk a status dependent on its mitigation","Describe the mitigation that has been chosen for the risk in as much detail as possible"]
[null,null,null,null,1,"Trust/group","Executive Committee","Third Party Processor may refuse to or not complete fully the TPP GDPR Checklist","MEDIUM","Work with suppliers that are aligning with the GDPR and can answer the TPP Checklist affirmatively. Alternative is to accept as a business risk","NA","COMPLETED","TBC"]
[null,null,null,null,2,"Trust/group","Executive Committee","Maintain records of Lawful Processing at data capture source is mandated to be on going","MEDIUM","Review data repositories and develop a method for maintaining evidence of Lawful Processing.","NA","PENDING REVIEW","TBC"]
[null,"Please watch this video in advance of completing this sheet.",null,null,3,"Scout Unit","Group Scout  / Section Leader","Local laptops holding Sensitive Personal Data do not have \"Strong\" passwords - Strong = 8 characters or more, mixture of letters, numbers and special characters","HIGH","Implement a local password on the laptops that meets the Strong password criteria","NA","PENDING REVIEW","TBC"]
[null,null,null,null,4,"Scout Unit","Group Scout  / Section Leader","No local encryption for local laptops holding Sensitive Personal Data","MEDIUM","Laptops have the ability to store personal data locally, this should be protected in case of loss or theft by encryption","Low","PENDING REVIEW","TBC"]
[null,"This form currently contains examples that may or not be applicable for you. Review and edit as appropriate",null,null,5,"Scout Unit","Executive Committee","Paper based records are kept in a variety of locations that contain Sensitive Personal Data","HIGH","Review the requirement to hold paper based records. Where possible replace this with an electronic means, such as online webforms, membership management platform or a cloud based office application. Where it is required, store printed paper records in physical and lockable cabinets and store for only as long as required","Low","PENDING REVIEW","TBC"]
[null,null,null,null,6,"Trust/group","Executive Committee","Sensitive Personal Data is captured at multiple points during a Young Person/Adult Volunteers journey through Scouting, such as annual health update forms","MEDIUM","Review the frequency and mechanisms used for gathering Sensitive Personal Data, minimise where possible. Where this activity is required, ensure it is documented as part of this Impact Assessment and secure as appropriate using Best Practices","NA","PENDING REVIEW","TBC"]
[null,null,null,null,7,"Trust/group","Executive Committee","Privacy Policies at data capture points do not give transparent statements or the ability to opt In to further communications","HIGH","Add a Privacy Statement at each data collection point (web form, joiners form etc..) that is clear and transparent to answer; what, why, when and where with regards to the data you are gathering. In addition you need to present the additional opt in boxes for the Data Subject to select if you wish to send them communication that is outside the scope of the direct purpose of membership, this guide will help:\nhttps://ico.org.uk/for-organisations/guide-to-data-protection/privacy-notices-transparency-and-control/privacy-notices-under-the-eu-general-data-protection-regulation/","NA","PENDING REVIEW","TBC"]
[null,null,null,null,8,"Trust/group","Executive Committee","If the Data Subject (Young Person/Adult Volunteer) request their detail to be deleted/changed/reported on it will be difficult to ensure data corrected in multiple data sources","HIGH","Use the journey detail captured for the Adult Member and Young Person to review the data stores in use and look to minimise where it makes sense. Where a Third Party Processor is in use, issue them the GDPR Checklist and review again upon their response","NA","PENDING REVIEW","TBC"]
[null,null,null,null,9,"Trust/group","Executive Committee","Documentation for IT Systems in use across the Trust is very low","HIGH","Use this GDPR Register to start a documentation pack on the IT estate. This should be flowed down to the Scout Leaders as a blue print of best practice IT use","NA","PENDING REVIEW","TBC"]
[null,null,null,null,10,"Trust/group","Executive Committee","All data captured is kept forever with no defined policies for retention of this data","HIGH","Review the data sources and categories highlighted in the Data Inventory and align an appropriate retention policy to each.","NA","PENDING REVIEW","TBC"]
[null,null,null,null,11,"Trust/group","Executive Committee","Sensitive Personal Data is stored in a variety of locations and this varies depending on the Scout Unit themselves.","MEDIUM","Encourage the use of a standard operating model for the Scout Units that takes data privacy into consideration as well as ease of use. This should be propagated down from the Trust level as a recommendation","Low","PENDING REVIEW","TBC"]
[null,null,null,null,12,null,null,null,"HIGH",null,null,"OPEN"]
[null,null,null,null,13,null,null,null,"HIGH",null,null,"OPEN"]
[null,null,null,null,14,null,null,null,"HIGH",null,null,"OPEN"]
[null,null,null,null,15,null,null,null,"HIGH",null,null,"OPEN"]
[null,null,null,null,16,null,null,null,"HIGH",null,null,"OPEN"]
[null,null,null,null,17,null,null,null,"HIGH",null,null,"OPEN"]
[null,null,null,null,18,null,null,null,"HIGH",null,null,"OPEN"]