What exactly does a small common interest club with 100 members need to do to comply with GDPR requirements?
But to be fair, your chances of audit are insignificant for a small club.
Since I am the leader of an owner-association for cabins and have great interest in GDPR I have gone through an analysis for my association.
- We have contact information (as required by law and GDPR requires to inform of breaches)
- We don't store personal information that's not required by law
- We don't share personal information externally
We can no longer share our contacts list
The tricky part of GDPR is the "Consent" requirement and as far as sharing information we used to share the contact information on a printed list with telephone, email and address. In reality, sharing the contact info would not be essential to operate and thus would require special consent from each member. This would be to much work and therefore we stopped sending out the contacts list. Members will now have to ask us and we can forward requests.
Publish a summary of GDPR policies
To round it off I published a summary of our GDPR policies to our members. What personal info we have, and who has access to it. How long we keep the information and who has had access to it in the past. And that I had decided to no longer distribute the contacts list, because I did not want to go through the process of getting consents to share it.