Private area
What it is
As long as a website only shows, it keeps nothing about anyone. As soon as it asks for a login, it creates accounts, stores passwords, links people to data: reserved documents, fees, attendance, exchanges. The website changes nature: it becomes a processing of personal data, with everything that implies, whatever its size. An area of ten members and an extranet of a thousand follow the same rules.
What it adds
- The GDPR: the association is the data controller, the provider its processor, with a written contract (article 28); a record of processing, information of people, answers to access and deletion requests, and notification of a breach to the Data Protection Authority within 72 hours (article 33)
- Security: fast updates, two-factor authentication, access logs, tested backups, tests against known flaws (OWASP reference)
- Recurring maintenance: this work never stops and is quoted per year, on top of hosting
- Shared responsibility: who has access, which accounts are closed when someone leaves, what is collected and why; decided beforehand and written down
Sources: Regulation (EU) 2016/679, articles 28 and 33; Belgian Data Protection Authority, notifying a breach; OWASP Top Ten.
The alternatives to examine first
Before asking for a members' area, list what your members would really do there. Often a registration form, a newsletter, a non-public link to non-sensitive documents and a well-kept CRM give the same service without opening a door. A dedicated tool (membership platform, shared calendar) carries the accounts for you, with its own guarantees, and the website simply links to it.
In Kern4Good
No formula of the ladder includes a private area, whatever the size of the website. A members' area is quoted separately, with its recurring maintenance, and responsibilities are set out in black and white before starting. A ten-page public website with a members' area costs more than a fifty-page public website without one. The "Who this ladder is for" block of the Pricing page says so, and the guide Website levels details what a private area changes.
Is a simple password on a documents page a private area?
Yes, as soon as there is reserved access and identified people behind it. If the documents are not sensitive, a non-public link is sometimes enough, without accounts: that is what we look at during scoping.
Who answers in case of a data leak?
The association, as data controller, notifies the Data Protection Authority within 72 hours; the provider helps and documents what happened. The processing contract says who does what.
Why does a private area also cost in maintenance?
Because a door gets attacked: every flaw discovered in the software must be fixed fast, accesses monitored, backups tested. On a public website a late update is a risk; on a private area it is a possible leak.
Can a members' area be added later?
Yes, on an editable website, as a separate project with its quote and its processing contract. Better first check that an existing tool does not already provide the service.