When it comes into force, how will the General Data Protection Regulation affect small hobbyist organisations? Will it apply to, for example, student societies that are holding lists of email addresses for their members? What about sports clubs or similar, with a small number of members whose data is being maintained?

For reference, these organisations are based in the UK.

(I have tried to find this information on Google, but the only results are business specific.)

3 Answers 3


Further to Dale's answer - Yes GDPR will apply (even if the UK leave the EU as the new Data Privacy national legislation will mirror EU regulations "https://www.gov.uk/government/collections/data-protection-bill-2017"). This does not mean the you cannot maintain membership lists. Just make sure you have a record of where all the addresses came from. I imagine it's a simple data base and not linked up to a CRM.

I would recommend emailing your subscribers and asking permission to keep them in a mailing list. You have a legitimate reason to have their email address - but only for the purposes as defined. Once everyone is opted in then happy days - you've ticked the box!


From the link you included:

The regulation applies if the data controller (organisation that collects data from EU residents) or processor (organisation that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU. Furthermore the Regulation also applies to organisations based outside the European Union if they collect or process personal data of EU residents.

As of now, the U.K. Is part of the EU, so, yes.


You cannot just email members without their consent and you cannot seek that consent via email as you are in danger of breaking currently regulations known as PECR private Electronic Communications Regulation.

  • Being given the email addresses in the first place is implied consent (or even explicit, if the sign-up sheet includes a statement that this is the purpose of giving the email address).
    – user4657
    Mar 16, 2018 at 19:03
  • Implied consent is not a thing in GDPR though. The closest you get to that would be performance of a contract (or your processing in preparation of that). Mar 27, 2019 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .