Small charities & General Data Protection Regs

I cannot tell you how happy I was when my manager said I didn't need to care about our response to GDPR - it's above my paygrade!!!

However, I have kept a watchful eye on the subject because I am on the committee for a small walking group, and unsurprisingly we record members names, addresses, phone numbers and email addresses in an excel spreadsheet.

I looked into whether we needed to register under the current legislation and concluded that we did not.

So, I cannot be much help myself, but I can recommend some useful sources of information, and will watch eagerly for anyone who understands what's required.

The AFVS - worth signing up for the Monthly Bulletin which you can do even if membership is beyond you - and if membership is NOT beyond you it is well worth while.

Sandy Adirondack offers a legal update email at variable intervals, aimed at voluntary organisations. If you can afford to pay the annual fee for this, please do, but it's not a requirement.

It is well worth finding out who your local voluntary services council is - google that plus your local town / county / area. If they don't have information available, I'll be surprised, and they should be able to point you to other sources.

finally, a quote from the AFVS website home page:

You will be hearing a lot about GDPR over the coming months.

It is effective from May 2018, but charities must start to get prepared now.

It’s going to affect every charity that collects and stores personal data.

For small to medium charities it’s not rocket science, and trustees should not be unduly alarmed, provided they treat GDPR as something which has to be faced.

I am a trustee of a small charity, we have decided to adopt a new data protection policy to reflect the GDPR. We will also do a mass mail shot mid April to explain that we now need individual member's active consent to hold their information and to contact them (with options for them as to which info they consent to us holding, and options for how we contact them), and to advise them of exactly what information we currently hold on them. We have decided to not register with the ICO at this stage as registration for us (currently) is voluntary.

TBH, apart from the pain of the mass mailing and having our membership leaflets reprinted to include the active consent boxes, it shouldn't affect us too much in terms of the communications we do send out - fortunately our members enjoy our quarterly newsletters.