Confidentiality & Data Protection

The General Data Protection Regulation (UK GDPR) governs how personal data is collected, stored, used, and shared. As a volunteer, you will come across personal information about the people you visit. You must treat this information with care and respect.

• Personal data includes names, addresses, phone numbers, health information, and anything that could identify a person
• You must only use personal data for the purpose it was shared with you (i.e. befriending)
• You must not share personal data with anyone outside of the Steps Together team
• One Step Counselling and Therapies C.I.C. is the data controller and is responsible for keeping data safe

• Relevant concerns with your coordinator (e.g. safeguarding worries, changes in wellbeing)
• Session notes through the agreed recording process
• Information with emergency services if someone is in immediate danger

• Details about service users with friends, family, or other volunteers
• Personal information on social media — even without naming someone
• Information with other organisations without consent (unless safeguarding)
• Photos of service users without explicit written consent

• Do not keep personal information about service users on your personal devices or in unsecured locations
• If you make handwritten notes, store them securely and hand them in to your coordinator promptly
• Do not keep notes longer than necessary — your coordinator will advise on retention
• If you use a phone to record session dates, do not include identifying details