{"text_format":"1","workbook":"xlsx","n_sheets":1,"sheets":["6.Data Security"],"not_rendered":{"charts":0,"images":2,"macros":1,"external_links":0,"defined_names":7,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"6.Data Security","index":0,"n_rows":17,"n_cols":10,"rows_kept":17,"cut":false,"hidden":false,"merged":[[1,1,7,2],[11,1,12,2],[9,1,9,2]]}
[]
[null,"PURPOSE : The purpose of this form is to capture the security provisions that exist for the data capture/transfer and storage used today within your trust"]
[null,null,null,null,null,null,"DATA SECURITY"]
[]
[]
[null,null,null,null,"DATA PROCESS MEDIA","DATA STORAGE","SECURITY","VENDOR","DESCRIPTION","RISKS"]
[]
[null,null,null,null,"This is the data process media used for capture/transfer or storage of personal data","Data Storage is where the data is stored for further use","Add as much detail as possible as to the security measures in place for the protection of the personal data for this media","Who is the vendor of this media process if applicable","Give a good description as the use of this media the considerations made for alternatives and justify why it is the right choice","Highlight any risks you can see that the use of this media brings. If they are significant and need to be tracked then add them to the risk register also"]
[null,null,null,null,"Paper Form","Paper based forms are stored in the Scout Leaders home filing cabinet ","Filing cabinet is locked and can only be accessed by the Scout Leader","NA","Paper records are gathered as part of the joining process for Young People and Adult Volunteers. This detail is retained on paper and stored at the residential premises of the Group Scout / Section Leader. These papers come with the Scout Leader to meets and events.","Significant risk of loss or theft of Sensitive Data. The ability to update is also limited"]
[null,"Please watch this video in advance of completing this sheet.",null,null,"Web Form","Data is captured by the online form and stored in the website database","The web form is protected by front end encryption (SSL) and the database is encrypted","The website is hosted by xxx and is a WordPress site","The website is hosted by xxx and is a WordPress site and form. The data held in this website is in an encrypted database that limited and named volunteers have access to.","The database is an aggregated source of Sensitive Data and as such is a threat target. Care should be taken to secure this"]
[null,null,null,null,"E-Mail","Data is sent in via email as part of the joiners process. This is retained in my email","The email requires a username and password, it is also stored locally on my laptop that is encrypted and requires local logon with a Strong password","Microsoft Office365 (Exchange)","The joiners process requires the Data Subject to email me their Sensitive Personal Data. This data is retained within my email system, which is managed by a Third Party Processor in the cloud. I also store my emails locally and don’t delete them.","Email is an unsecure mechanism for sending plain text details. It should also only be retained for the period of transfer and added to a Membership Management System as early as possible"]
[null,"This form is fully open for edits. If the examples don’t match with how you operate then edit as appropriate or add further media process to the bottom of the sheet",null,null,"Online Scout Manager","Online Scout Manager is used to collect the Sensitive Personal Data. This is stored in OSM","OSM requires a username and password to access and uses a secure transfer mechanism (SSL)","OSM","OSM is a Membership Management tool by a Third Party Processor. It requires user credentials to logon and uses SSL based encryption when I have access to data","OSM is a Third Party Processor and is subject to the GDPR Checklist for alignment to the GDPR"]
[null,null,null,null,"Compass","Compass is used to collect the Sensitive Personal Data of Adult Volunteers. This is stored in Compass","Compass requires a username and password to access and uses a secure transfer mechanism (SSL)","TSA","Compass is a Membership Management tool controlled by TSA. It requires user credentials to logon and uses SSL based encryption when I have access to data","TSA is a Data Controller when it comes to Adult Volunteer data and this is managed in Compass"]
[null,null,null,null,"Google Suite","Data is captured as part of an electronic G-Suite document","The Google Doc is filled in directly within my Google Drive. This requires me to invite the recipient to edit the file, it also uses SSL based encryption","Google","The Google Doc is the capture mechanism for data gathering. It works by sending a link to the recipient which is unique to them. They then use this link (encrypted) to complete the required detail. This is then stored directly into my Google Drive","The database is an aggregated source of Sensitive Data and as such is a threat target. Care should be taken to secure this"]
[null,null,null,null,"Microsoft Office","Data is captured via a Microsoft Word Document","The Word Doc is filled in directly by the recipient and emailed back to me. This communication is direct between the sender and recipient","Microsoft  ","The Word Doc is the capture mechanism for data gathering. This is via an email exchange and stored locally on my laptop.","The local laptop becomes an aggregated source of Sensitive Data. The security and continuity of this device needs to be considered"]
[null,null,null,null,"Social Media","Social media is used to capture the Sensitive Data from the recipient post a connection request","The social media platform has a requirement for username and password, it also uses SSL for encryption and all messages are Direct Messaging which is private","Social Media Provider","Social media is used to connect with the Adult Volunteers and parents of the Young People. Sensitive Data is shared as part of direct messaging within the platform","Social media platforms have large amounts of aggregated data and as such are targets. In addition, the platform is now a Third Party Processor but is not really designed for the purpose its being used so is unlikely to fully comply with the GDPR"]
[null,null,null,null,"Mail Chimp","Mail Chimp is used to communicate with Parents and Adult Volunteers. Sensitive detail is stored in the Mail Chimp Database","Mail Chimp requires a username and password for access with a Strong password policy.","Mail Chimp","Mail Chimp is to communicate with Parents and Adult Volunteers for on going Scout management. This may contain sensitive data.","Mail Chimp is a Third Party Processor and is subject to the GDPR Checklist for alignment to the GDPR"]