The Burrow¶

The Burrow is a Notion workspace created by Priya, a senior programmes coordinator, in response to a problem that was real and a solution that was available and a procurement process that was not going to move quickly enough. The problem was that volunteer coordination for the east wing was being managed across three spreadsheets, a shared calendar that only two people could edit, and a folder of Word documents named things like “FINAL rota April ACTUAL v3”. The solution was Notion. The procurement process was not consulted.

Priya created a workspace on her personal Notion account, invited six colleagues, and built a set of linked databases over the course of a weekend. By Monday morning the east wing had a functional volunteer roster, a linked task tracker for resident care assignments, a page for each resident with a summary of their needs and the volunteers cleared to work with them, and a shared calendar that everyone could edit. The spreadsheets did not disappear immediately, but they stopped being updated within three weeks.

The workspace was named the Burrow by the programmes team. It is not named this in any official documentation because it does not appear in any official documentation. IT did not know it existed for approximately eight months. IT learned of its existence when a volunteer submitted a helpdesk ticket asking how to log in to “the Notion thing for east wing”.

What it contains¶

The Burrow contains personal data about volunteers: names, contact details, role assignments, availability, DBS check reference numbers and expiry dates, and notes on individual volunteers’ experience and suitability for specific tasks. Some of the suitability notes are measured and professional. Some were written at the end of a long shift and reflect a candour that was appropriate for a private conversation and is less appropriate as a semi-permanent record associated with a named individual.

It contains summarised information about residents: behavioural notes relevant to volunteer safety, feeding preferences, and flags for volunteers to be aware of. The resident information is a subset of what is in Bestiary, entered manually by Priya and two colleagues, which means it may not reflect updates made in Bestiary since the last time someone remembered to check.

There is a page titled “Incidents and Near-Misses” containing brief descriptions of eighteen incidents involving volunteers and residents over a period of approximately two years. The page was created as a practical reference for shift supervisors. Its existence was not known to the Head of Programmes until IT mentioned the workspace, at which point the Head of Programmes asked to see it and had a difficult afternoon.

How it is accessed¶

The Burrow is on Priya’s personal Notion account. Access is managed by Priya, who invites people and removes them when they leave. Removal on departure is more reliable than in most comparable systems, because Priya is conscientious and because the workspace is small enough that she notices when someone is no longer active.

There are currently nineteen people with access. All nineteen are current staff or active volunteers. This is better than many shadow IT systems. It does not address the fact that the data is hosted on Notion’s infrastructure under a free personal account, subject to Notion’s terms of service rather than a Data Processing Agreement with the Home, in a jurisdiction that depends on which Notion legal entity the account is associated with, which has not been established.

The Home’s Data Protection Officer became aware of The Burrow six weeks ago. She has described the situation as “not ideal” and has asked for a written summary of what data is in the workspace. The written summary is being prepared by Priya, who is also trying to finish the east wing rota for next month.

What happens next¶

There are three options available. The first is migration to an approved platform, SharePoint or a Teams channel, which would require someone to rebuild what Priya built over a weekend in whatever time they can find around their other responsibilities. The second is formalisation, procuring a Notion Business account with a DPA and transferring ownership from Priya’s personal account, which costs money that was not in the budget. The third is something that nobody has officially proposed but that represents the current state: the situation is known, it is being assessed, and the Burrow continues to be used because the east wing volunteers still need coordinating and the spreadsheets are not going back.