Associations are Responsible persons within the meaning of Art. 4 No. 7 GDPR obliged to fulfill all data protection requirements and to demonstrate compliance with them (Art. 5 para. 2 GDPR - accountability). Implementation regularly poses considerable practical challenges, particularly for smaller, voluntary associations. The following explanations summarize the main obligations in the association.
Lawfulness of data processing
The central legal basis for data processing in the association is Art. 6 para. 1 lit. b GDPR - the fulfillment of the association agreement, specified in the association statutes. In addition legitimate interests (Art. 6 para. 1 lit. f) GDPR) or consent (Art. 6 para. 1 lit. a GDPR) the Processing justify the processing. The latter are particularly necessary if data is processed or published beyond the purposes of membership (e.g. Photosbirthday lists, appeals for donations by e-mail). The Consent must be voluntary, informed, unambiguous, earmarked and revocable at any time. It must be documented in writing or electronically and must not be hidden in general declarations.
With the Processing special categories of personal data (Art. 9 GDPR) - e.g. Health data - is regularly an explicit Consent required. This typically concerns self-help groups, trade unions or religious associations.
Organizational responsibility in the association
The board of the association is legally and actually responsible for compliance with data protection regulations (Section 26 (1) sentence 2 BGB in conjunction with Art. 24 GDPR). Art. 24 GDPR). He has suitable Technical and organizational measures to ensure the lawfulness of the data processing.
This also includes the delegation of tasks, whereby data protection-compliant implementation must be ensured. Even in the event of delegation, overall responsibility remains with the Management Board.
Everyone in the association with the Processing persons entrusted with the processing of personal data are Confidentiality to commit. Although the GDPR no provision corresponding to Section 5 BDSG old version, but a documented commitment to the data protection principles of Art. 5 Para. 1 GDPR required.
In addition, it must be ensured that the persons concerned - in particular members, volunteers and service providers - are informed of the Processing your data in accordance with Art. 13 and 14 GDPR be informed. This Duty to inform should be integrated into the membership form, whereby subsequent information is recommended for existing memberships.
Security of the Processing in the association
The safety of the Processing of personal data is a central principle of the General Data Protection Regulation. According to Art. 32 GDPR are Responsible persons - clubs - are obliged to provide suitable Technical and organizational measures (TOM) to ensure a level of protection appropriate to the risk. These measures must be reviewed regularly and adjusted if necessary.
Technical protective measures are e.g: Encryption of stored and transmitted data (e.g. transport and end-to-end encryption for emails), password protection and two-factor authentication when accessing member data, regular security updates and virus protection software, separate user accounts for shared systems, automatic blocking mechanisms in the event of inactivity.
The organizational measures in the association include: a clearly regulated authorization and role concept for data use, training of board members and volunteers in the secure handling of personal data, the creation of a data protection and IT security concept, the definition of reporting channels in the event of data protection incidents, written regulations on the use of private devices ("Bring Your Own Device") and their control.
In addition, back-up concepts, logging of accesses and deletion concepts for data that is no longer required are also part of the data protection organization.
Reading tip: Newsletter between GDPR and ePrivacy - Consent not always necessary
Rights of the data subjects
Associations must establish internal procedures that ensure the swift, complete and data protection-compliant processing of inquiries from data subjects. This includes, in particular, the establishment of a central point of contact for data protection concerns, the training of responsible persons and the Documentation of incoming requests and their processing steps.
According to Art. 15 GDPR have affected persons have a right to information about the personal data stored about them. This Right to information extends, among other things, to the purposes of Processingthe categories of data processed, the recipients or categories of recipients to whom the data have been or will be disclosed, the planned storage period or the criteria for determining this period and the existence of other recipients. Rights of data subjects. The origin of the data (if it was not collected from the data subject) and the existence of automated decision-making including Profiling must be informed.
In addition Affected parties under certain legal conditions:
- Correction incorrect data (Art. 16 GDPR),
- Deletion ("Right to be forgotten", Art. 17 GDPR),
- Restriction of the Processing (Art. 18 GDPR),
- Data portability (Art. 20 GDPR) and
- Contradiction against the Processing their data (Art. 21 GDPR).
Associations are obliged to fulfill these rights in a timely manner - usually within one month - and to affected person about the measures taken. If applications are rejected, reasons must be given and the right of appeal to the data protection supervisory authority must be notified.
Data protection officer and List of processing activities in the association
A data protection officer must be appointed if at least 20 people regularly personal data automatically (§ 38 BDSG). This also includes volunteers and part-time employees. If there is no designation obligation, voluntary designation may be advisable for special risks, e.g. self-help groups or political associations.
Each club must also have a List of processing activities according to Art. 30 GDPR must be maintained. This must include all regular data processing processes, in particular membership administration, contribution accounting or the operation of a website. The exception pursuant to Art. 30 para. 5 GDPR hardly ever comes into play in practice, as clubs regularly have permanent personal data process.
One Data protection impact assessment (DSFA) pursuant to Art. 35 GDPR must be carried out if a Processing is likely to result in a high risk to the rights and freedoms of data subjects. This is rarely the case with the typical activities of an association, but could become relevant if:
- extensive Health data are collected and processed in self-help groups,
- systematic Tracking or Video surveillance is carried out,
- particularly sensitive data categories are analyzed using AI or profiling methods.
If a DPIA is mandatory, it must be carried out and documented before data processing begins. In addition, the risk mitigation measures must also be specified and, if applicable, the Supervisory authority if no risk reduction can be achieved.
In case of doubt, associations should check whether a DPIA is necessary and carry out a structured risk assessment to safeguard themselves. However, for many standard processing operations - such as membership administration or contribution accounting - there is generally no obligation to carry out a DPIA.
According to Art. 32 GDPR are suitable Technical and organizational measures to secure data processing. These include in particular Encryptionauthorization concepts, the separation of association and private databases and effective management of end devices that are also used in the home office. An IT security concept is also recommended. Sending personal data by email should at least be transport-encrypted; end-to-end encryption is recommended for particularly sensitive data. When using private devices, care should be taken to classify and separate data, e.g. by using separate user accounts.
Publication of club information
In the case of the publication of personal data - such as names, functions, pictures or birthdays - a documented Consent to be obtained. This applies in particular to:
- Individual and group photos at events,
- Result lists from tournaments or competitions,
- Mention of honorary memberships or anniversaries,
- Publication of meeting minutes or contact persons on the website.
For Photos Sections 22 and 23 KUG also apply. Although these permit publication in certain cases without Consent (e.g. images of meetings or historical events), but there are considerable legal uncertainties, particularly in the case of digital distribution. In the context of the association, a Consent which must be unambiguous, voluntary and revocable.
Particular caution is also required when passing on data to service providers: If an external third party not only provides support, but also processes the data on behalf of the company, this regularly constitutes a Order processing within the meaning of Art. 28 GDPR This requires a separate contract.
For reasons of traceability and accountability, every data transfer - especially on the Internet - should be documented internally in order to be able to prove compliance with data protection requirements in the event of complaints or audits by supervisory authorities.
Data transfers to Third - in particular to umbrella associations, association-related organizations, external service providers or the public via websites - require a legal basis. The publication of personal data on the Internet constitutes a data transfer within the meaning of the GDPR and is regularly only possible on the basis of a Consent permissible. The same applies to Photosminutes of meetings and lists of results, unless an exception is made under the Art Copyright Act (§§ 22, 23 KUG) applies. To be on the safe side, the Consent be documented in any case - especially for individual and group photos.
Order processing and website
If an external service provider is commissioned with the Processing of personal data, an order processing contract pursuant to Art. 28 GDPR is required. GDPR to conclude. This is the case, for example, when commissioning IT service providers, tax consultants or hosting providers.
The association's website must contain a privacy policy in accordance with GDPR be easily accessible and retrievable on every subpage. Among other things, this must include information on the controller, the data protection officer (if appointed), the purposes, the Legal basisstorage periods and the rights of data subjects. Cookie consent banners and transparent information on tracking and analysis tools are also mandatory.
Social media
According to the current legal situation, the use of Facebook fan pages and other social networks is not advisable, as they do not meet the data protection requirements of the GDPR - in particular with regard to joint responsibility and third country transfers. In the case of mandatory use, additional technical measures (e.g. two-click solutions) must be taken.
Source: Data protection in the association according to the GDPR
Do you need support with implementation in your association? We offer practical data protection advice and digital solutions - efficient, understandable and legally compliant.
Get in touch with us - we can help!
☎️ +49 (228) 926165-100
📧info@2b-advice.com
German 
English 
Italian 
French