◇ OpenCyber Academy
Professional · Chapter 9 · English

Chapter 9 — Working with suppliers and volunteers

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Working with suppliers and volunteers

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Suppliers"]
  N2["9.2 Volunteers"]
  N3["9.3 Referral partners"]
  N4["9.4 Ending relationships"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Suppliers"]
  N2["9.2 Volunteers"]
  N3["9.3 Referral partners"]
  N4["9.4 Ending relationships"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]
[Learning outcomes]
    |
    v
[9.1 Suppliers]
    |
    v
[9.2 Volunteers]
    |
    v
[9.3 Referral partners]
    |
    v
[9.4 Ending relationships]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) manage data with suppliers; (2) set expectations for volunteers; (3) handle data shared with referral partners.

9.1 Suppliers

Northbank uses a donor database supplier, an email newsletter service and a payroll provider for its few staff. Grace lists the personal data each receives and checks that contracts include processor terms required by the GDPR: acting only on Northbank's instructions, security, confidentiality and deleting data at the end. The newsletter service's standard terms include them; the payroll contract is old and lacks them, so she asks for an updated agreement. The payroll provider sends a new agreement within a month, and Grace files it with the other supplier contracts in one folder.

9.2 Volunteers

Volunteers handle client data during sessions. Grace adds a confidentiality agreement to volunteer sign-up, explaining that client details must stay private, and includes data rules in induction. She arranges that only volunteers who need client details see them, such as those preparing parcels for named collections. Volunteers sorting donated food do not need them. She notes that limiting who sees data reduces risk without slowing work. Leads decide which volunteers need client details for each session, and the rota shows this so that nobody has to guess whether they may see the referral list.

9.3 Referral partners

Social workers and doctors send referrals. Grace finds some send full case notes by ordinary email. She agrees with the main referral partners a short referral form asking only what Northbank needs: name, contact, household size, any dietary needs and the referrer's details. Health details are included only where relevant to food, such as allergies. Partners send forms through a secure portal. She records the agreement with each partner. Partners welcome the shorter form, which takes less time to complete, and the number of referrals containing unnecessary case notes falls sharply.

9.4 Ending relationships

When the old newsletter service is replaced, Grace asks it to confirm deletion of donor emails and records the confirmation. When volunteers leave, their access to systems and any keys are removed within a week. Mr. Nowak notes that ending relationships cleanly is often forgotten, and that a short leaving checklist for volunteers and suppliers prevents data remaining where it should not. Grace writes the checklist on a single page and asks leads to complete it whenever a volunteer leaves, returning it to her so that she can confirm that every account and key has been removed.

Worked example

Grace checks processor terms and updates the payroll contract, adds volunteer confidentiality and limits client data to those who need it, agrees a minimal secure referral form with partners and confirms deletion when changing suppliers.

Synthetic case. Suppliers and partners are synthetic; the GDPR is real.

Errors and limits

Accepting full case notes when a short form would do collects more sensitive data than needed.

Exercises

Continue studying — lesson 09 (chapter 09 of 12)

← Chapter 08 · Course chapter index · Chapter 10 →

Continue to the next authored lesson.