Association & foundation — GDPR: donors, members and volunteers

What does GDPR cover?

Associations and foundations operate under a variety of legal bases (membership, legitimate interest, consent for certain prospecting activities). Fundraising appeals and donor retention require proper transparency and opt-out management. Fiscal receipts impose statutory retention periods.

The obligation-of-means approach calls for prioritising a realistic baseline.

Is the 'Association & Foundation' sector concerned?

All associations and foundations processing data relating to donors, members or volunteers are concerned, with no threshold. Service providers (management software, donation platforms) act as processors.

Data collection campaigns often involve partners that need to be governed.

Detailed obligations

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Beyond that, the trust of donors and members is the sector's most valuable asset.

Common mistakes in the sector

• 1Ungoverned prospecting. Soliciting without a legal basis or opt-out mechanism.
• 2Uncontrolled retention periods. Retaining donor data indefinitely.
• 3Poorly managed receipts. Failing to apply statutory retention periods.
• 4Missing register. Document no processing activity.

Practical case

An association was soliciting its former donors without managing opt-outs and retaining all data indefinitely. The remediation framework governs fundraising appeals, applies statutory retention periods to tax receipts, defines retention periods for other data, and maintains a proportionate record.

Compliance roadmap

1. 1

   Map. Map donors, members, and volunteers.

2. 2

   Frame donations. Consent/objection and frequency.

3. 3

   Tax Receipts. Apply statutory retention periods.

4. 4

   Secure. Security and retention periods.

5. 5

   Document. Maintain a proportionate register.

Frequently asked questions