Data protection impact assessment
Be;Ready processes personal data about young people, including under-18s, so a DPIA is required. This is our assessment of what we do, what could go wrong, and what we have done about it.
1. What the processing is
- Young people create a Be;Ready Card: name, headline, strengths, interests, goals, an optional photo and an optional short video.
- Cards can be shared by link or QR code, and optionally made discoverable to approved employers (Be Found).
- Employers register interest; the young person accepts or declines.
- Delivery organisations run cohorts by issuing licence codes, and record 4, 12 and 26 week outcome follow-ups.
- Commissioners receive aggregate, anonymised insight only.
- We send sign-in codes and, with consent, an opportunity digest email.
2. Necessity and proportionality
The purpose is to help young people evidence their strengths and reach opportunities. Every field is optional beyond a first name and email. Discovery by employers is off unless the young person turns it on. There is no automated decision-making with legal or similarly significant effect: the AI matcher only orders opportunities for the young person to consider, and never filters a person out for an employer.
Lawful basis: [consent] for the card, discovery and digest emails; [legitimate interests] for security, fraud prevention and service analytics; [legal obligation] for financial records. To be confirmed by Be Free Campaign with its data protection adviser.
3. Risks and mitigations
| Risk | Mitigation | Residual risk |
|---|---|---|
| A young person's card is seen more widely than they intended | Cards are private by default; the young person controls public visibility and Be Found; the public endpoint refuses non-public or hidden cards | Low |
| An adult uses the platform to contact a young person inappropriately | Employers are vetted before approval; contact only via interest requests the young person can decline; no free-form messaging to a young person; contact details are never released automatically; moderation and flagging with admin review | Low / Medium, depends on ongoing vetting discipline |
| An under-18 shares more than they should (photo, video, location clues) | Guidance shown in the builder; content is optional and deletable; moderator hide; safeguarding guidance on the homepage | Medium |
| An organisation sees young people outside its remit | Access rules enforced in the database by cohort membership; commissioners receive aggregates only; administrator actions are audit logged | Low |
| Account takeover through the email address | Passwordless one-time codes that expire; no password reuse risk; guidance to secure the email account; sessions revocable | Low / Medium, depends on the person's email security |
| Data kept longer than needed | Published retention schedule with defined periods and self-serve deletion | Low |
| A supplier (hosting, email, payments) is breached | Reputable processors under contract; data minimisation; incident response plan covering supplier breach | Medium |
| Bias in AI-suggested opportunities | Suggestions are advisory to the young person only, always alongside the full unfiltered list; no protected characteristics used as inputs | Low |
4. Children's data, specific considerations
- Design follows a high-privacy default: nothing is public unless chosen.
- Language throughout is written to be understood by a young person, not a lawyer.
- No behavioural advertising, no profiling for marketing, no selling of data, ever.
- Where a young person is supported by an organisation, that organisation and its safeguarding route are visible to them.
- Parent/carer involvement and age assurance approach: [to be confirmed by Be Free Campaign].
5. Rights
Access, correction, deletion, restriction, objection and portability requests go to info@befreecampaign.org and are answered within one month. Most correction and deletion can be done instantly by the young person from My Card. Complaints can be made to the Information Commissioner's Office.
6. Outcome
Assessment: the processing is proportionate to the benefit to young people, and the residual risks are acceptable with the mitigations above in place. Sign-off by Dr Shantanu Kundu MBChB MSc FRSPH FRSA, Data protection lead, on August 2026. Review at least annually and on any significant change to the service.
Draft for review
Anything shown in [square brackets] needs confirming by Be Free Campaign before this is shared with funders, commissioners or an auditor.