GDPR
What it asks of an association
- Knowing which data you hold and where: a one-page inventory is enough to start
- Telling people why you collect it, in a privacy policy on the website and at registration time
- Keeping only what is useful, for as long as needed, and deleting the rest
- Limiting access to those who need it, with named accounts and serious passwords
- Answering a person who asks for their data, its correction or its deletion
- Signing a contract with every provider that processes data for you (host, mailing tool, CRM): that is article 28
- Notifying a data breach to the Data Protection Authority within 72 hours: that is article 33
Sources: Regulation (EU) 2016/679; Belgian Data Protection Authority, notifying and handling a breach.
Common mistakes
The members' spreadsheet shared with everyone through an open link; the mailing list without unsubscribe; photos of beneficiaries published without consent; records of people gone for ten years; the free tool that uses the data for training; the administrator account of a volunteer who is no longer there. None is technical. A well-configured CRM, a website with its privacy policy and a written one-page rule fix most of it.
Where to start
- The inventory: which lists, where, who accesses them, since when, why
- The privacy policy on the website, written on verified facts, not copied from a template
- Access: one account per person, two-factor authentication, closing the accounts of people who left
- Sorting: deleting what is no longer useful, archiving what must be kept
- Contracts with providers, and a contact person who keeps the inventory up to date
In Kern4Good
Every delivered website includes a privacy and cookie policy written on verified facts, and no tracker is set without consent: this website works that way. The CRM scoping sets the access and retention rules before the import. As soon as a website requires a private area, the association becomes the data controller and KERN-IT its processor, with a contract: that is why the private area is outside the ladder, on quote, on the Pricing page.
Further reading
Must a small association appoint a data protection officer?
Generally no, unless it processes sensitive data at scale (health, for instance). A contact person who keeps the inventory is enough in most cases.
Can we publish photos of our activities?
Yes with the consent of recognisable people, preferably written, and with particular care for minors. Plan the checkbox in your registrations.
How long should we keep former members' records?
As long as useful: the duration of the membership plus what the law requires for accounting. Past that period, delete or anonymise. Write the rule once, the tool can apply it.
What if we lose a laptop with the members' list?
It is a data breach: assess it, notify the Data Protection Authority within 72 hours if it presents a risk for people, warn them if the risk is high, and document what happened. An encrypted disk avoids the worst.