3. Legal, Ethical & Compliance Setup

Explanation

This phase prepares the legal and ethical safety net of the ESC project. It is easy to think about ESC mainly as learning, volunteering and intercultural exchange, but every project also involves sensitive responsibilities: personal data, emergency contacts, ID/passport information, health information, insurance information, travel documents, reimbursement documents, photos, videos, consent forms and sometimes work with children, young people, refugees, people with disabilities or vulnerable groups. If these are not handled properly, both the volunteer and the organisation can be exposed to risk.

The organisation should define what data is collected, why it is collected, who can access it, where it is stored, how long it is kept and when it is deleted. Consent should be clear, especially for photos, videos, testimonials and social media. If the project involves children, schools, vulnerable adults or protected groups, safeguarding and child protection procedures must be clarified before activities begin. The organisation should also know what clearance, background checks or local legal requirements apply in its country or activity context.

This phase also includes insurance documentation and emergency access. The coordinator should know where to find the volunteer’s insurance information, emergency contacts and relevant health-related support information when needed, while still respecting privacy and access limits. The ESC Guide states that personal data is processed under Regulation (EU) 2018/1725, with GDPR applying where relevant, and that data may be transferred only on a need-to-know basis for evaluation, grant management, monitoring or inspection purposes. EVoly’s own technical specification also requires GDPR-compliant hosting, encryption, audit logs, secure backups and emergency volunteer profile information accessible in offline mode.

Role perspectives

Organisation: The organisation is responsible for legal compliance, safeguarding and data protection. It must prepare policies for consent, document storage, access rights and protection of vulnerable groups. It should make sure that legal duties are not left to informal habits.

Coordinator: The coordinator collects only necessary data and stores it safely. They make sure volunteers sign the right documents and understand their rights. They also ensure that emergency information is accessible only to the right people.

Volunteer: The volunteer should know what personal data is collected and why. They should give clear consent for photos, videos, stories or public visibility. They also need to understand insurance, emergency procedures and safeguarding rules.

Community: Children, young people, refugees, people with disabilities and other vulnerable groups must be protected. The community should know that activities follow ethical and safeguarding standards. Trust is built when the organisation is transparent and responsible.

Differences by ESC model

Long-term volunteering: More personal data and documents are usually needed, including residence, health, insurance and accommodation records. The organisation must plan longer retention and stronger privacy procedures. Safeguarding and consent may need to be reviewed throughout the project.

Short-term volunteering: The data load is smaller, but legal and ethical standards still apply. Consent, emergency contacts, insurance and safeguarding must be prepared before arrival. Short duration is not a reason to skip compliance.

Volunteering teams / group volunteering: Group projects create extra risks around shared accommodation, group photos, public events and collective safety. Consent and safeguarding must be clear for the whole group. Emergency procedures should be easy to activate because many people are involved at once.

Questions & answers

Do we need photo consent?

Yes. Image use should be clear, voluntary and documented.

Can all staff access volunteer files?

No. Access should be limited to people who need the information for their role.

What should be retained?

Agreements, financial evidence, consent forms, incident records, insurance evidence and reporting documentation.

Documents for further reading

• European_solidarity_corps_guide_2025.pdf — data protection, records, agreements, insurance and applicant obligations.
• EVoly Technical Specification.pdf — GDPR, encryption, offline emergency data and audit logic.
• EVoly Confidentiality Agreement.pdf — confidentiality principles.
• EVoly Call for Tender Final.pdf — data protection and GDPR requirements for EVoly.
• RL-Guidelines-Volunteers-with-disabilities-within-the-new-European-Solidarity-Corps-ESC.pdf — accessibility, reasonable accommodation and inclusive procedures.