Compliance for associations & foundations: GDPR & AI Act

Why the 'Association & Foundation' sector is affected

The core asset of an association or foundation is its relationship with its donors, members and volunteers. This personal data underpins associative life and fundraising, and falls squarely within GDPR: legal bases, information requirements, security and retention periods.

Donation appeals and prospecting are sensitive processing activities with respect to consent and opt-out rules; donor retention requires fair management of solicitations. Fiscal receipts impose legally mandated retention periods.

Many organisations operate with limited resources: the priority is a realistic baseline — register, information notices, security, and retention periods — before addressing AI use cases (chatbots, campaign targeting), which generally fall under limited risk.

GDPR — donors, members, volunteers

The association or foundation is the data controller for its donors, members, and volunteers. It must define legal bases, govern donation appeals and prospecting, manage fiscal receipts, and ensure security and control over retention periods.

Key obligations

• Legal bases and information (donors, members, volunteers).
• Regulation of fundraising appeals and prospecting.
• Tax receipts: statutory retention periods.
• Security and appropriate retention periods.

AI Act — emerging use cases

AI uses in the sector (chatbots, donation campaign targeting, writing assistance) generally fall under limited risk, with transparency requirements. Donor profiling remains governed by the GDPR; manipulative practices are prohibited.

Key obligations

• Qualifying uses (often limited risk).
• Disclosing interaction with an AI.
• Prohibiting manipulative practices.
• Articulation with GDPR profiling.

Comparative overview of regulations

How these regulations interact

The non-profit sector is primarily driven by GDPR: the relationship with donors and members, fundraising appeals, and tax receipts are at its core. AI (chatbots, targeting) is layered on top through profiling (GDPR) and transparency (AI Act).

Resource constraints call for prioritising a realistic baseline — registry, information, security, retention periods — and pooling resources where possible, before tackling AI topics.

Application timeline

• 1GDPR. In force; vigilance on fundraising appeals and retention periods.
• 2AI Act. Progressive transparency; prohibitions in force since February 2025.

Applicable penalties

GDPR up to €20M or 4%. Beyond the financial risk, the real issue is donor and member trust, which is the sector's essential capital; the AI Act is limited here to transparency and non-manipulation.

Compliance roadmap

• 1Map. Mapping donors, members, volunteers, and campaigns.
• 2Frame donation appeals. Legal bases, information obligations, and objection management.
• 3Managing tax receipts. Applying legally required retention periods.
• 4Secure and limit. Data security and appropriate retention periods.
• 5Prioritise. A realistic baseline relative to available resources, pooled where possible.

How Data Comply One supports the sector

Data Comply One covers GDPR and AI Act on a single platform, with an outsourced DPO, and supports associations and foundations on donor relations, fundraising appeals and a realistic compliance foundation.

DCO offers tailored templates (register, donor information, donation campaign frameworks).

Frequently asked questions