# membership dpia draft

Status: Draft for trustee review.

## Purpose and scope

This is a draft data protection impact assessment for membership applications, family support and related safeguarding information. It covers the journey from the public website into Sparks Connect and the handling of public enquiries. The full assessment must include the actual Connect system and the people who operate it.

## Risks and safeguards to assess

Risks include collecting more child or health information than necessary, access by the wrong person, accidental disclosure through email, records being kept too long, and families not understanding how information is used. Existing public-website safeguards include encrypted enquiry records, restricted access to sensitive enquiries and notification emails that link to the record. The assessment must check these controls in the hosting environment and confirm equivalent controls in Sparks Connect.

## Required assessment and decisions

Record the information collected, its source, each purpose, lawful basis, sensitive-data condition, recipients, hosting locations, retention periods and deletion process. Consult trustees, safeguarding leads and parent representatives. Assess necessity, proportionality, likelihood and impact for each risk; assign actions and owners, then record the remaining risk. If high risks cannot be reduced, obtain appropriate advice and consult the ICO where required before starting that processing.

## Approval and review

Not yet a completed or approved DPIA. The responsible trustee must record the assessment owner, evidence, actions, approval date and review date. Review it when membership processes, technology, providers or the use of children’s information changes, and after a relevant incident.