It's important to consider that if you'd like individual young people to enter themselves, rather than through their school or youth group, and you'd be collecting identifying information about them such as names or their photos, you would need to obtain signed parental consent to do so. Always liaise with/contact the child’s teacher/guardian rather than directly with the child at all times to ensure there are no safeguarding issues. You must only collect minimum necessary information e.g. only their name, school year and school. You must not collect their home address, date of birth or phone number.
The parental consent form should also provide a Privacy Notice which includes who you are, the purpose of collecting the personal data (e.g. for running a competition), what the personal data you're collecting will be used for, (e.g. for selecting and contacting the winner), who it will be shared with (e.g. name of the third party), how long their data will be kept for (e.g. information relating to winners will be held for one year, those not selected will be securely destroyed after one month).
If the school is sending you this data, it's their responsibility to ensure the correct permissions are in place, but it's your responsibility to ensure the information is stored securely (e.g. kept in a locked cabinet and access to the information is restricted).
Read more about GDPR and consent in our
GDPR guidance for Community groups (183kB).
You should also make sure you have the teacher/contact’s consent to contact them, either about the competition or into the future. While there is no legal barrier to storing publically available contact details, it is good practice to find out whether the school is happy to be contacted, and this transparency could help to strengthen your relationship into the future.