Lawful Bases for Processing
Under Article 6 of the UK GDPR, Jesus Youth UK must have a lawful basis for processing personal data. We rely on the following lawful bases depending on the nature and purpose of the processing:
Consent (Article 6(1)(a))
We rely on consent for:
- Sending newsletters, event updates, and other communications
- Publishing photographs or videos of individuals on our website or social media
- Collecting and using data for non-essential purposes such as testimonials or promotional material
- Processing data of children under 13, where parental consent is obtained
Consent is always freely given, specific, informed, and unambiguous. Individuals may withdraw consent at any time by contacting us at safeguarding@jesusyouth.co.uk. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Legitimate Interests (Article 6(1)(f))
We rely on legitimate interests for:
- Managing event registrations and attendance
- Volunteer coordination and management
- Internal administration and record-keeping
- Maintaining contact with members and supporters
Before relying on legitimate interests, we carry out a Legitimate Interests Assessment (LIA) to ensure our interests do not override the rights and freedoms of the individual, particularly where children are involved.
Legal Obligation (Article 6(1)(c))
We rely on legal obligation for:
- Processing DBS (Disclosure and Barring Service) checks for staff and volunteers working with children
- Reporting safeguarding concerns to statutory agencies
- Complying with tax and employment legislation
- Responding to lawful requests from law enforcement
Performance of a Contract (Article 6(1)(b))
We rely on contractual necessity for:
- Processing employee data for employment purposes
- Managing agreements with service providers
Special Category Data (Article 9)
Some data we process falls into special categories under Article 9 of the UK GDPR, including:
- Health data — collected via medical/dietary forms for events involving children
- Religious beliefs — inherent in our activities as a Catholic youth organisation
- Data relating to criminal convictions — processed as part of DBS checks
We process special category data under the following conditions:
- Explicit consent (Article 9(2)(a)) — for health information provided on event registration forms
- Substantial public interest (Article 9(2)(g)) — for safeguarding children and vulnerable adults, as set out in Schedule 1 of the Data Protection Act 2018
- Legal obligations relating to employment (Article 9(2)(b)) — for DBS checks and safer recruitment
ICO Guidance
Our approach to lawful processing is informed by guidance from the Information Commissioner’s Office (ICO), including:
- Lawful basis for processing — ICO guidance on Article 6 bases
- Children and the UK GDPR — specific guidance on processing children’s data
- Special category data — guidance on Article 9 processing
We keep our lawful basis assessments under regular review and document our decisions in our Records of Processing Activities (ROPA).