SSAFA Volunteer Knowledgebase

Christmas hamper GDPR Guidance

Updated on

As part of the Christmas hamper campaign, branches may need access to personal information to help identify recipients and arrange delivery of hampers. This could include details such as a beneficiary's name and address. Because this information relates to individuals we support, it is important that it is handled carefully, shared only where necessary and used only for the purpose for which it has been provided. 

This guidance is intended to give branches a clear and consistent way of identifying recipients while protecting their personal information. 

The guidance below explains: 

  • when existing SSAFA beneficiary information can be used; 
  • when information can be shared with a branch to arrange delivery; 
  • how referrals from external organisations should be handled; and 
  • what branches should do with recipient information once it has been provided. 

These arrangements are supported by the agreed Christmas Assistance Legitimate Interests Assessment, which covers the use of existing Mosaic information and the process for people newly referred to SSAFA. 

Branches should follow the steps below rather than developing their own arrangements for collecting or recording recipient information. 

Identify Your Recipients

Many branches tell us this is one of the most important parts of the Christmas hamper campaign. Recipients can be identified through a number of routes, including: 

  • Caseworkers 
  • Regional Offices 
  • Community Engagement Managers 
  • Crisis Team 
  • Local veterans' breakfast clubs 
  • Veterans' hubs 
  • Partner charities 
  • Community organisations 

To make sure personal information is handled appropriately, the process you follow will depend on whether the individual is already known to SSAFA or is being newly referred to SSAFA by an external organisation. The agreed approach uses existing Mosaic records alongside referrals from local partners. 

If the recipient is already known to SSAFA

Christmas Hampers can be provided to beneficiaries who: 

  • have a currently open case, or 
  • have had a case closed within the last six months. 

The Regional Office can share the address and details required with the branch so that the Christmas hamper can be delivered. 

Branches should only use the personal information provided for the purpose of arranging and delivering the agreed Christmas Hampers. Only the information necessary to carry out the activity should be shared or used. 

If the recipient is being referred by a partner organisation

Local organisations such as veterans' hubs, breakfast clubs, partner charities and other community organisations can also identify people who may benefit from Christmas Hampers. 

If the individual is not already known to SSAFA, the agreed Third-Party Referral Form must be completed so that their information can be provided to SSAFA and recorded through the agreed process. 

For people not already on Mosaic, the referral form provides the consent route, after which authorised Community Engagement and Casework staff can record the necessary information on Mosaic and attach the signed referral form. 

Protecting recipient information

Please remember that recipient information is personal data and should be treated carefully. 

Branches should: 

  • only use the information provided for the Christmas Hampers activity; 
  • only share information with those who need it to arrange or complete the assistance; 
  • avoid creating additional local records containing personal information where these are not required; and 
  • not use recipients' names or other identifying information in publicity about the activity. 

Need support?

If you are unsure which route applies, please speak to your Community Engagement Manager before sharing or requesting personal information. 

Previous Article Guide to Hosting a Christmas Meal
Next Article September 2026 Bulletin