Follow GDPR

What is GDPR?

GDPR is covered in a massive legal document, you don't have to read it! The most important thing to understand is data is any personal information including names, contact details, birthdays etc.

There are 7 key principles of GDPR:

1. Lawfulness, fairness and transparency
2. Purpose limitation
3. Data minimisation
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality (security)
7. Accountability

What this means in practice for societies:

Overall, societies need to make sure they are careful about the collection of any data.

The key thing that societies must do is collect member's data through the union website, you must not store member details anywhere else. If someone wants to be removed from a society or their details changed they need to contact the Union, and societies should ensure they facilitate this (i.e. passing the union email onto the member wishing to delete/update information).

General GDPR compliance

1. Get consent before collecting data

   This is usually obtained when a person fills out a form- so long as you're clear why the information is being collected/what for to allow the person to give informed consent.

2. Be clear & transparent about

   How the data you're collecting will be used

   How long the data will be kept

   For example, when using a form to collect information, you can insert a disclaimer at the top of the form stating: 'Information collected will be used solely for the purposes of this event and will be deleted after the event'.

3. Delete data after it is no longer needed

   For example, you should delete information collected for a raffle after the prizes have been given out.

4. Limit the number of people who have access to data

   Only those who need access to data should have it. For example, if only the society president and secretary need access to the email, they should be the only ones who can.

5. Store data securely

   Use the Union website message function to avoid having to collect member's emails and then needing to store them. Use locked documents or limited access documents.

6. Delete a person's data if they request you to do so

   You can also refer them to the Union to have their membership deleted, etc.

7. Keep information up-to-date and correct

   You can also refer them to the Union where appropriate and neccessary.

What not to do

1. Share data without consent

   For example, you cannot send a member list out to any external company without permission of every single member.

2. Use data provided for anything other than the purpose it was collected for

   For example, if you collect contact details for a raffle, you can't then use their contact details to send them emails unrelated to the raffle.

3. Leave data open to viewing by unauthorised persons

   For example, don't leave your laptop open with your member list up.

4. Collect data you don't actually need

   For example, if you only need one form of contact methods to contact raffle winners, don't collect more than one contact method for each person, so collect an email or phone number, not both.

Top Tip

Use the Union website! Societies must get members to sign-up via your web page and should use the email function to provide GDPR-compliant communications.

Using the Native for ticket sales is another way to ensure you get the information you need including the ability to email ticket holders while keeping information safe and secure.