Volunteer records for a small charity

Start with the job the record needs to do

A volunteer record should help the charity run its activities and explain the decisions it has made. Can this person open the building? Have they received the induction for this role? Who agreed a change in responsibilities? A useful record answers those questions without requiring the coordinator who remembers everything to be available.

For charities in England and Wales, the Charity Commission's volunteer guidance covers recruitment, role descriptions, appropriate checks, expenses and insurance. Use it to decide what your volunteer management process must support. This guide addresses the records behind that process; different arrangements apply in Scotland and Northern Ireland.

Appoint someone to own the register and name a deputy. In a small voluntary organisation, that may be a trustee as well as a volunteer manager. Decide who updates it after an induction, who checks outstanding training and who acts when someone leaves. A spreadsheet that nobody owns becomes an old contact list remarkably quickly.

Keep the main register separate from information that needs tighter access. The person arranging Saturday's rota may need a name, availability and confirmation of relevant training. They do not automatically need a recruitment reference, a medical explanation or the contents of a safeguarding report. A shared register can point an authorised person to a restricted record without reproducing it.

This is one part of the charity's records management, not the whole system. Accounts, trustee decisions and annual reporting have different purposes and rules. Our charity record-keeping guide covers those wider responsibilities.

What to record when a volunteer joins

Build the joining process around the role, rather than copying an employee personnel form. A practical starting record contains the information below. Treat each field as a question to justify, not an instruction to collect it in every case.

• Identity and contact. Name, the contact route needed for the role and a way to distinguish people with similar names. Collect emergency contact details only where the activity gives you a reason to need them.
• Role and responsibility. Role description or version, team or location, start date, named supervisor and any agreed limits on the activity.
• Recruitment decision. Who approved the appointment, when, and where any necessary references or checks are held. Put restricted detail in the appropriate file, not the rota.
• Induction. What was covered, when it happened and who delivered it. Include the reporting route for a concern, practical safety arrangements and the systems the volunteer is authorised to use.
• Training and review. Training completed for the role, evidence location where needed and the next review date under your policy. A planned course is different from a completed one.

Explain the use of personal data in a volunteer privacy notice. The ICO's staff and volunteer privacy notice tool is a useful starting point for describing collection, sharing and retention. Make sure the notice describes your actual process, including any service provider used to hold the records.

Identify a lawful basis for each purpose. A signature saying that someone has read a privacy notice is not, by itself, consent to every future use. Health information and criminal-offence data need additional consideration under the data protection rules. Use the ICO's lawful-basis guidance and take advice where the correct basis or additional condition is unclear.

Give the volunteer a straightforward way to correct contact details or raise a concern about their information. Keep a note of an important correction so that a deputy does not reinstate an old address from an earlier export.

DBS information and training records are different things

There is no single DBS check for every charity volunteer. Establish the activities of the role and whether it is eligible for the level of check you are considering. Eligibility for a check and eligibility for a free volunteer application are separate questions. The DBS volunteer application guidance explains that distinction; do not infer eligibility simply from the charity's name or the fact that it works with children or adults at risk.

Keep the decision about checks with the recruitment process. If responsibilities change, reassess the role instead of assuming the original decision covers the new work. The Charity Commission's safeguarding guidance places checks within a wider approach to protecting people, including suitable policies and reporting arrangements.

A record that a check was considered or completed is different from keeping a scan of the certificate. The DBS handling guidance requires controlled access and retention no longer than necessary. Its sample policy allows a limited record of the certificate and recruitment decision after certificate information is disposed of. Some inspection and safeguarding-audit circumstances may justify retaining certificate information; assess those rather than applying a blanket deadline.

Do not put certificate images or criminal-record details into an ordinary volunteer spreadsheet or messaging group. Decide who is entitled to see them, where they are stored and who authorises their disposal. Record the outcome needed for deployment of the volunteer without giving every rota editor access to the underlying material.

Training records answer a separate question: what has someone been prepared to do? Record the course or briefing, completion date, relevant evidence and any reassessment your policy requires. Avoid a single tick headed 'trained' when a volunteer may be inducted for one activity but not another.

For example, a volunteer might have completed the stockroom induction but still need the driving checks and briefing for deliveries. Recording those separately lets a coordinator allocate work accurately. This is a fictional example of record design, not a rule that every charity needs those activities or checks.

How long to keep volunteer records, and what happens on leaving

There is no universal retention period for a volunteer's entire file. The ICO's storage-limitation guidance requires a reason for keeping personal data and a justifiable retention approach. Set periods by record category and purpose, review them and securely dispose of information when it is no longer needed. A charity's accounting retention rule is not automatically the right period for every volunteer contact detail.

Write the trigger beside the period. 'After leaving' and 'after the last payment' may lead to different dates. Record the source of any required period and the reason for a policy decision. If you cannot explain why a category is kept, adding another year does not resolve the uncertainty.

1. Confirm the change. Record the leaving date or change of role and tell the person responsible for access. Do not rely on a message that only one coordinator saw.
2. Remove operational access. Review keys, shared folders, mailing lists and messaging membership. A record may need to be retained after someone leaves without that person retaining access to the system.
3. Separate outstanding matters. Identify unpaid expenses, equipment to return and any complaint, incident or other process that still needs an owner.
4. Apply the schedule. Assign review or disposal dates by category. Check whether a relevant inquiry, dispute or preservation requirement affects the proposed action; take advice before disposing of related material.
5. Record completion. Note who reviewed the records and what action they took. Keep the disposal log proportionate rather than copying the information you decided to remove.

Include downloaded copies in the process. A carefully maintained master register is little help if an old spreadsheet remains on a former coordinator's laptop. Agree where working copies may be kept and how they are replaced or removed. Before exporting a register for an event, ask which fields the event team actually needs.

Requests for access to personal data and requests to erase it need a considered response through the charity's data protection process. Neither should be answered simply by pointing to the length of time a software product happens to keep history.

A volunteer register checklist you can use

Use this checklist when setting up or reviewing a register. It works with a restricted spreadsheet, a suitable database or a volunteer management system. The important test is whether the people responsible can keep it accurate and find the evidence they need.

1. Define the record. Volunteer reference, name, role, supervisor, start date and active/leaving status. Add only the contact fields needed for the job.
2. Make completion visible. Induction completed on; completed by; training required; training completed on; next review due. Keep booked and completed activities distinct.
3. Point to evidence. Record a restricted file reference where necessary. Check that the reference opens for an authorised deputy and stays inaccessible to people who do not need it.
4. Set responsibility. Record the register owner, deputy and last review date. Decide who can read, edit or export it and how a new editor is approved.
5. Prepare for leaving. Leaving date; access removal assigned to; access removal completed on; outstanding matters owner; retention review date and rationale reference.
6. Test the handover. Ask the deputy to answer one real operational question using the register. Fix missing instructions before adding more fields.

For a blank starting point, use these field labels in your approved system: volunteer reference; role; supervisor; start date; status; induction completion; training completion; next action and owner; restricted evidence reference; last review; leaving date; access removal; retention decision reference. Add a name and necessary contact details in the appropriately restricted register, not on a public task sheet.

At the next trustee or management review, report useful totals such as outstanding induction actions or overdue reviews. Do not circulate everybody's individual file when the board needs to understand whether the process is working. The checklist is a starting design, not a complete policy or a substitute for role-specific safeguarding requirements.

Keep the decisions that arrive in conversations

A register shows the current position. Conversations often explain how it changed. A volunteer tells a coordinator they cannot continue with a task. A supervisor approves a different responsibility. Someone raises a concern and asks for it to be followed up. If the only copy is in one person's message history, the next coordinator may see the outcome without understanding the decision.

Agree which conversations need a record and where that record belongs. Safeguarding concerns should follow the charity's safeguarding route; a messaging group is not a replacement for its case record. A change to responsibilities should reach the volunteer register or authorised file. Include enough context to explain the action without copying unrelated personal conversation.

ComplyChat provides an alternative place for work conversations. On paid plans, the lasting record files into the organisation's own Microsoft 365 once the archive is connected and filing. It does not import or capture personal WhatsApp conversations, and it is not a volunteer database, a DBS checking service or a safeguarding case-management system.

ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history. It includes no Microsoft 365 archive or Replay, and upgrading cannot restore expired history. It can help you explore the messaging experience; it should not be selected as the charity's lasting volunteer-record system.

A useful question for the next management meeting is: if the coordinator changed tomorrow, could their replacement find both the current volunteer record and the decisions they need to act on?

Official guidance and your next step

Start with the Charity Commission's volunteer management guidance and safeguarding guidance. Use the ICO sources above for the personal-data decisions, and DBS guidance for eligibility and certificate handling. Read the current pages when adopting a policy, rather than relying on an old downloaded form.

This guide provides a practical starting point for charities in England and Wales, not legal advice on an individual volunteer or case. Have the people responsible for volunteer management, safeguarding and data protection review the parts that apply to your activities.

Choose one active role and walk through the checklist with the coordinator and their deputy. Resolve the missing owner, unclear evidence location or uncompleted induction you find before buying another system. A modest register that is kept up to date is more useful than a comprehensive form that nobody maintains.