E-166 · Detailed guide · Theme 2

Digital Feedback Portal

Use Digital Feedback Portal to give members a safe, visible route for ideas and concerns to lead to an answer or improvement.

Where this idea came from

Playbook entry: E-166 · Digital Feedback Portal
Theme: Theme 2: Engagement & Belonging · Subtheme 10: Feedback, Voice & Improvement
Source material: Current playbook index title and category plus an internally authored detailed-guide draft

Initiative-specific development wave

How this draft was developed

These sources support general principles for member feedback, digital-service design, accessibility, privacy and cyber security; they are not an endorsement of the named Digital Feedback Portal or approval of a platform, supplier, collection, security control, privacy statement or club decision.

Primary references consulted

Engage emerging leaders (Rotary International)
Used for: Rotary encourages clubs to ask members what they want, assess club health and use feedback for a relevant club experience.
Digital Service Standard (Digital Transformation Agency, Australian Government)
Used for: High-quality digital services should be user-friendly, inclusive, adaptable, measurable, trustworthy and designed around clear intent and user needs.
Criterion 5 - Build trust in design (Digital Transformation Agency, Australian Government)
Used for: Digital feedback routes should provide clear avenues, support anonymity by default where appropriate, respond transparently and undergo security and data-handling review.
Australian Privacy Principles guidelines (Office of the Australian Information Commissioner)
Used for: Collection, notice, use, disclosure, security, access and correction require deliberate controls, subject to the club confirming applicable Privacy Act obligations.
Cyber security for charities and not-for-profits (Australian Signals Directorate, Australian Cyber Security Centre)
Used for: Charities and not-for-profits should strengthen accounts and data handling, including multi-factor authentication and practical cyber assessment.
Hosting accessible and inclusive online meetings and events (Australian Human Rights Commission)
Used for: Online participation needs accessible technology, alternative access, advance information, clear communication and active support for adjustments.

Candidate District material

No candidate local guide was used for this version. The current initiative identity and the attributed primary references remain separate.

Theme 2 source-assurance wave

What has been checked

6 current primary pages used by this guide were reopened on 9 August 2026.
6 attributed source claim(s) were mapped to their bounded use in this initiative.
Candidate District material remains separate and does not establish this result.

See each source's scope and limit

Engage Emerging Leaders
Supports: Member-centred discovery, mentoring, feedback, emerging-leader support and club-health review principles during renewal.
Does not establish: That a person is ready for office, should be selected, has consented to a role or that a proposed renewal pathway will work locally.
Digital Service Standard
Supports: The 1 attributed Theme 2 claim attached to this source, limited to the implementation elements and supporting documents named in each initiative-level claim mapping.
Does not establish: The club's local need, legal position, capability, cost, safety, accessibility, suitability, likely effectiveness, authority to act or approval of the initiative.
Criterion 5 - Build trust in design
Supports: The 1 attributed Theme 2 claim attached to this source, limited to the implementation elements and supporting documents named in each initiative-level claim mapping.
Does not establish: The club's local need, legal position, capability, cost, safety, accessibility, suitability, likely effectiveness, authority to act or approval of the initiative.
Australian Privacy Principles guidelines
Supports: The 5 attributed Theme 2 claims attached to this source, limited to the implementation elements and supporting documents named in each initiative-level claim mapping.
Does not establish: Whether the Privacy Act or another duty applies to this club, whether consent is informed and valid, whether collection or publication is authorised, or whether the proposed safeguards are sufficient in the actual circumstances.
Cyber security for charities and not-for-profits
Supports: The 1 attributed Theme 2 claim attached to this source, limited to the implementation elements and supporting documents named in each initiative-level claim mapping.
Does not establish: The club's actual hazards, safeguarding duties, screening requirements, food controls, cyber posture or risk tolerance; completion of a local risk assessment; or approval to proceed.
Hosting accessible and inclusive online meetings and events
Supports: Practical accessibility and inclusion safeguards for online and hybrid renewal meetings, consultations, learning and events.
Does not establish: Accessibility conformance, the adjustments a person needs or the suitability of a particular platform, format, recording practice or meeting design.

What still needs a person to confirm

Confirm the member, prospective-member, past-member and community needs, preferences and consent that the local design assumes.
Confirm which privacy, safeguarding, incorporated-association, charity, work health and safety, food, liquor, copyright, licensing, screening and other duties apply to the club and the activity.
Test accessibility, cultural safety, belonging, language and alternative participation routes with affected people and recognise First Nations cultural authority rather than inferring suitability from the guide.
Confirm every local fact, starting point, cost, role, current service contact, measure, stopping condition and platform capability before the club decides to proceed.
Confirm the authority and current scope of each primary source, resolve login-gated or moved-page references and keep any candidate District material attributed and unapproved until its source decision is made.

The source-verification release gate remains closed.

Checks still on hold

The board must approve the service charter, platform owner, administrators, privacy and security controls, protected-matter referrals, service times and closure plan before launch.
The club must determine whether and how the Privacy Act and other obligations apply and obtain qualified advice where the assessment is uncertain; this draft is not legal or cyber security advice.
The Theme 2 candidate documents contain no literal current-title match or verified current-code crosswalk for E-166 and are not used as evidence.
No public launch, production data collection or supplier commitment may occur until accessibility, privacy, security, ownership, incident and exit tests are independently accepted.

Still an internal draft: source interpretation, local suitability, accessibility, governance and editorial approval remain open checks.

Why a club might use this

It gives the club a clearer view of people's experiences before decisions are made, including feedback that informal conversations can miss.

It may suit: The people whose experience the club needs to understand, especially voices that are not often heard.

Use it when

Consider Digital Feedback Portal when feedback is collected informally, repeatedly raised or rarely followed by a clear response.
A club receiving feedback across scattered emails, messages and forms and needing one controlled workflow with accountable response.
Members who value asynchronous access, optional contact and a transparent acknowledgement and status process.
A small portal pilot with a service owner, privacy and security review, accessibility testing, limited fields and a complete triage register.

Before the club starts

A service charter defining accepted matters, excluded and urgent matters, acknowledgement and response times, decision authority and non-digital alternatives.
A documented data map, necessary fields, collection notice, applicable privacy assessment, retention schedule, deletion method and incident response contact.
A platform review covering accessibility, account ownership, multi-factor authentication, least-privilege access, backups, export, audit history and supplier exit.
A trained triage team, independent conflict route, complaint and safeguarding referrals, response templates, monitoring dashboard and 90-day service review.

Capacity guide

Likely cost: Low; use existing survey, meeting and communication channels where possible.
Lead time: About two weeks for one complete listening and response cycle.
People: Three to five people, including a decision owner, feedback coordinator and action owners.

A useful club conversation

Questions worth asking

What problem does a portal solve that an accessible email, phone and paper route cannot solve more safely or simply?
Which fields are genuinely necessary, what metadata does the platform collect and can the club honour an anonymity or confidentiality statement in practice?
Who owns the service when the usual administrator is unavailable, conflicted or leaves the club?

Common traps

Trying Digital Feedback Portal when A public anonymous message board, unmoderated discussion forum or repository for emergencies, safeguarding disclosures, legal advice or confidential complaints.
Proceeding with Digital Feedback Portal when Launching a third-party form because it is convenient when the club has not checked data location, access, security, retention, accessibility, terms or exit arrangements.
A complaint, safety issue or urgent disclosure sits in an ordinary improvement queue. — Show urgent and protected routes before submission, train reviewers to triage rather than investigate and test transfer, acknowledgement and escalation scenarios.

A practical 90-day path

Three milestones for Digital Feedback Portal
When	What the club does	Evidence to keep
Days 1–30: Agree the local design	Map current feedback channels and failures, define the service purpose, accepted categories, urgent exclusions, non-digital alternatives, service times and decision owners. Complete a data and risk design covering fields, optional identity, notices, access, platform metadata, data location, retention, deletion, complaints, safeguarding and cyber incident response.	A feedback service charter and channel map A data map, risk register and collection notice
Days 31–60: Run and adjust the first version	Select or configure the smallest suitable platform, establish club-controlled ownership, multi-factor authentication, least-privilege roles, backups, export and exit, and build accessible form and status pages. Test with keyboard, screen reader, mobile, low bandwidth, plain language and real non-digital users; run privacy, security, acknowledgement, referral, outage and recovery scenarios before launch.	A controlled portal configuration A passed service-readiness checklist
Days 61–90: Review the evidence and decide	Operate a 90-day pilot, acknowledge submissions, triage by risk and authority, transfer protected matters safely, record decisions and respond through the contributor's chosen channel. Review reach, service times, unresolved matters, access barriers, security events, data holdings and delivered improvements; then continue, revise, replace or close the portal and verify export and deletion.	A controlled submission and response register A service review and data close-out decision

Fit it to the club you have

Small club

Use a minimal club-controlled form and register rather than a complex portal, separate administration from decision-making where possible and obtain district or external help for security and privacy review.

Larger club

Use role-based access, one taxonomy, service-level reporting and audit history across teams, with an independent route for submissions about portal administrators or senior leaders.

Regional or rural club

Design phone, paper and low-bandwidth routes as equal parts of the service, not fallbacks, and plan for connectivity outages and members sharing devices.

Metropolitan, hybrid or online club

Prioritise mobile and assistive-technology testing, minimise third-party tracking and keep digital convenience from becoming mandatory participation.

Learn, adapt and know when to stop

Evidence worth keeping

Every submission is acknowledged, triaged and either answered or transferred within the published service times, with overdue matters visible to the board.
Keyboard, screen-reader, mobile, low-bandwidth and non-digital end-to-end tests pass before launch and after material changes.
The portal records decisions and delivered improvements while retaining only the minimum information for the promised period.

Change course when

The platform collects more personal or sensitive information than the club needs and retains it indefinitely. — Minimise fields, use optional identity, publish an honest notice, set deletion triggers, review raw text and verify disposal in an access and retention register.
A shared password, personal account or supplier failure exposes or strands portal data. — Use club-controlled ownership, multi-factor authentication, named least-privilege accounts, backups, audit history, export tests and a documented supplier exit.
Digital design excludes members or creates an inferior non-digital route. — Test with assistive technology and low bandwidth, offer equivalent phone, paper and assisted routes, and measure service times and outcomes across channels.

How to put it into practice

Detailed implementation steps for Digital Feedback Portal
Step	Action	Suggested owner	Timing	Evidence or output
1	Map current feedback channels and failures, define the service purpose, accepted categories, urgent exclusions, non-digital alternatives, service times and decision owners.	Portal service owner and secretary	Weeks one and two	A feedback service charter and channel map
2	Complete a data and risk design covering fields, optional identity, notices, access, platform metadata, data location, retention, deletion, complaints, safeguarding and cyber incident response.	Privacy, governance and cyber reviewers	Before platform selection	A data map, risk register and collection notice
3	Select or configure the smallest suitable platform, establish club-controlled ownership, multi-factor authentication, least-privilege roles, backups, export and exit, and build accessible form and status pages.	Platform administrator and accessibility lead	Weeks three and four	A controlled portal configuration
4	Test with keyboard, screen reader, mobile, low bandwidth, plain language and real non-digital users; run privacy, security, acknowledgement, referral, outage and recovery scenarios before launch.	Independent testers and service owner	Before launch	A passed service-readiness checklist
5	Operate a 90-day pilot, acknowledge submissions, triage by risk and authority, transfer protected matters safely, record decisions and respond through the contributor's chosen channel.	Triage team and decision owners	At least twice weekly	A controlled submission and response register
6	Review reach, service times, unresolved matters, access barriers, security events, data holdings and delivered improvements; then continue, revise, replace or close the portal and verify export and deletion.	Board sponsor and independent checker	Day 90	A service review and data close-out decision

Controls and safeguards

Check the idea with the people affected and confirm its purpose, owner and practical limits before putting it into use.
Protect member choice and privacy, make participation accessible, and do not infer belonging or satisfaction from attendance alone.
Collect only necessary data, state its purpose and retention, restrict access and provide a practical correction or withdrawal route.
The platform collects more personal or sensitive information than the club needs and retains it indefinitely. — Minimise fields, use optional identity, publish an honest notice, set deletion triggers, review raw text and verify disposal in an access and retention register.
A shared password, personal account or supplier failure exposes or strands portal data. — Use club-controlled ownership, multi-factor authentication, named least-privilege accounts, backups, audit history, export tests and a documented supplier exit.
Digital design excludes members or creates an inferior non-digital route. — Test with assistive technology and low bandwidth, offer equivalent phone, paper and assisted routes, and measure service times and outcomes across channels.
A complaint, safety issue or urgent disclosure sits in an ordinary improvement queue. — Show urgent and protected routes before submission, train reviewers to triage rather than investigate and test transfer, acknowledgement and escalation scenarios.
The board must approve the service charter, platform owner, administrators, privacy and security controls, protected-matter referrals, service times and closure plan before launch.
The club must determine whether and how the Privacy Act and other obligations apply and obtain qualified advice where the assessment is uncertain; this draft is not legal or cyber security advice.
The Theme 2 candidate documents contain no literal current-title match or verified current-code crosswalk for E-166 and are not used as evidence.

What to measure

After 90 days, review Digital Feedback Portal. Look for representative participation, published themes, named actions and a report back on what changed, what did not and why.
Every submission is acknowledged, triaged and either answered or transferred within the published service times, with overdue matters visible to the board.
Keyboard, screen-reader, mobile, low-bandwidth and non-digital end-to-end tests pass before launch and after material changes.
The portal records decisions and delivered improvements while retaining only the minimum information for the promised period.
Uncontrolled administrator accounts, missing multi-factor authentication, lost referrals, unauthorised access, misleading anonymity and overdue deletion remain at zero.

Follow-up: At the 90-day review, compare the recorded measures with the starting point, resolve the listed governance holds and tell participants whether Digital Feedback Portal will change, continue or stop.

Made for this initiative

Tailored supporting documents

These working documents use the decisions, safeguards and evidence needs of this initiative. Complete them with the people affected and keep the agreed version with the club's project record.

Digital Feedback Service Charter

Define the service members can rely on.

Open supporting document

Portal Data Map and Necessity Test

Record what data is collected, why and where it travels.

Open supporting document

Collection Notice and Contributor Choice

Explain identity, use, access and privacy limits before submission.

Open supporting document

Platform Security and Ownership Checklist

Keep the portal under controlled organisational administration.

Open supporting document

Portal Accessibility and Inclusion Test

Verify that every channel works for diverse users.

Open supporting document

Submission Triage and Authority Matrix

Route ideas, service issues and protected matters correctly.

Open supporting document

Portal Submission and Response Register

Track every matter from receipt to response or transfer.

Open supporting document

Acknowledgement, Transfer and Decision Templates

Give contributors clear and consistent messages.

Open supporting document

Portal Incident and Outage Playbook

Respond to access, security, privacy and availability failures.

Open supporting document

Ninety-Day Portal Review and Closure Record

Decide whether the service should continue and close data responsibly.

Open supporting document

Related playbook entries

E-165
E-167

Supporting worksheets

Before your club says yes

Does the idea fit?

Talk with the people it is meant to serve and check that the need is real.

We have checked this

Who can say yes?

Name the person or group that can approve the work, spending and any safety arrangements.

We have checked this

Are people protected?

Check privacy, consent and safety. Collect only the information you genuinely need.

We have checked this

Can everyone take part?

Check the language, format, place, technology and cost for barriers.

We have checked this

Are the facts and permissions right?

Check names, claims, images, quotations, partner references and Rotary branding.

We have checked this

How will we learn?

Note where things stand now, check in at 30, 60 and 90 days, and decide what to do next.

We have checked this