GDPR impacts upon the collection, use and retention of participant information for educational visits.
Medical and dietary information, parent contact details etc. must be kept secure, regardless of how the data is shared or carried. If it is necessary to share personal data with an external organisation involved in a visit, the establishment should obtain assurances that the other organisation is GDPR compliant. For details: www.gov.uk/data-protection
If travelling out-with the UK, and sharing data with an external provider, it is important to ensure that similar safeguards regarding data are in place.
Written consent must be received for images used in marketing or if shared on social media. Sample consent forms, which include permission for images, can be found in the Toolkits.
Record Keeping
Examples of reasons for retaining records of visits and outdoor learning experiences include:
- To record the range of opportunities that your organisation provides
- To demonstrate effective planning and evaluation of trips and visits
- To evaluate and improve both safeguarding and learning
- When there has been an incident that may result in an insurance claim or legal action
- Your establishment should have a GDPR policy that gives guidance on retention
- The system itself must be secure
- Access to the system must be strictly controlled
- If copies are made (on paper or electronically), e.g., to take on a visit or activity, they must also be kept securely
Record Keeping Following an Accident/Incident
For information about record keeping following an accident or incident see Section 14.7. Data relating to an accident or incident should be retained in line with Employers GDPR procedures.
