GDPR for Associations: 8 Membership Management Obligations

Main article: Creating a record of processing activities 2026 — how to set up and maintain the record of processing activities under Art. 30 GDPR.

1. Treating membership data as personal data

The membership list contains personal data: name, address, date of birth and, as soon as contributions are collected, bank details — data protection compliant administration is therefore mandatory. The same rules apply to an association as to a company: each of these processing operations needs a legal basis, must be documented and must be demonstrable to the supervisory authority (Accountability, Art. 5(2) GDPR).

Two points are added in an association context. First: as soon as the data reveal political opinions, religious or philosophical beliefs, or health data are processed, the general prohibition on processing in Art. 9(1) GDPR applies in addition — permitted only through one of the narrow exceptions in paragraph 2, such as explicit consent. What follows from this for association practice is set out in the section Special categories in an association. Second: anyone who has membership data processed in association software, in a cloud service or by the tax adviser needs a data processing agreement with the minimum content set out in Art. 28(3) GDPR — and may only work with Data Processors providing sufficient guarantees of appropriate technical and organisational measures (paragraph 1). This minimum content becomes verifiable against the points the provision expressly names: the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects, and the obligations and rights of the association as Controller. Anyone reviewing a contract presented to them goes through these points one by one.

The first executable step is an inventory by data category: master data, bank details, health information, photos, results and honours board data — each with its storage location (association software, the treasurer's spreadsheet, cloud folder, tax adviser) and a note on which office holders have access. This list is at the same time the template for fields 3 to 5 of the record of processing activities — categories of data subjects, categories of personal data and categories of recipients.

2. Legal basis: membership

For membership management, Art. 6(1)(b) GDPR is the basis — membership is a contract within the meaning of that provision. Anything no longer necessary for performance of the contract but belonging to association life runs under (f); where a specific legal obligation stands behind it, under (c) (association law, in Germany §§ 21 et seq. BGB). Art. 6(1) GDPR sets out six grounds for lawfulness in total: consent ((a)), performance of a contract or pre-contractual measures ((b)), legal obligation ((c)), vital interests ((d)), public interest ((e)) and the pursuit of legitimate interests ((f)).

This is how this article assigns the processing operations customary in an association. Which basis applies in the individual case is something you assess for each processing operation, recording the result in the record of processing activities.

What matters is the assignment for each processing operation, not a blanket assignment for 'the association'. Anyone choosing consent ((a)) takes on the conditions of Art. 7 GDPR: the association must be able to demonstrate that the person has consented (paragraph 1); consent may be withdrawn at any time, withdrawal must be as easy as giving it, and processing carried out up to that point remains lawful (paragraph 3). Record the chosen basis in writing — in the record of processing activities it is the practice field that makes Accountability workable.

3. Privacy notice in the admission form

Information under Art. 13 GDPR on joining is mandatory — it belongs on the admission form; a ready-made template is part of the complete document set referred to in the box at the end of this article. The information obligations follow directly from Art. 13 and Art. 14 GDPR; the Austrian DSG contains no separate provision on this.

The mandatory content includes a reference to the right to lodge a complaint with a supervisory authority (Art. 13(2)(d) GDPR). This is where the two jurisdictions diverge: in Germany, the authorities competent under Land law supervise non-public bodies (§ 40(1) BDSG); the Federal Commissioner for Data Protection (BfDI) is responsible for federal public bodies and certain telecommunications providers (§ 9(1) BDSG). In Austria it is the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG), Barichgasse 40-42, 1030 Vienna — its address and complaint route, along with recipient categories typical for Austria, belong in the text there. Where a data protection officer has been designated, their contact details belong in the Privacy notice — they already appear in field 1 of the record of processing activities.

You do not have to gather the material for this from scratch: the Controller with contact details, purposes, legal basis for each processing operation, categories of recipients and erasure periods are already in the record of processing activities (see below). Practice recommendation: the information belongs on the same sheet the member signs — an email sent afterwards is harder to demonstrate years later.

4. Newsletter to members

An association newsletter can be based on the legitimate interest under Art. 6(1)(f) GDPR, whereas advertising requires consent — so separate the two types of content instead of mixing them in one mailing. The dividing line runs between association information (dates, fixture lists, invitation to the annual general meeting) and advertising — including advertising for sponsors, association merchandise or paid offers from third parties.

Where you work with consent, the conditions of Art. 7 GDPR apply (demonstration and withdrawal, see section 2). In practice this means (practice recommendation, not a statutory requirement): an unsubscribe link in every mailing, a recorded sign-up date and a place where withdrawals are documented. Also a practice recommendation: two separate distribution lists — association information and advertising — are easier to maintain than one with exception lists.

For Austria, § 174 TKG 2021 applies in addition (unsolicited messages): consent or double opt-in. Keep the sign-up log in such a way that the time and the confirmation remain demonstrable. This article does not deal with the German competition-law position on advertising emails; for Germany, the consent conditions of Art. 7 GDPR remain the documented benchmark here.

5. Retention after exit

Exit does not end every form of storage: it ends the purpose of ongoing membership management, while statutory retention obligations continue to run — in Germany the ten-year retention of accounting documents under the HGB/AO. For communication data, this article assumes three years; that is a practice value, not a statutory period — which period your association applies belongs, with reasoning, in the record of processing activities. The sporting past — that is, competition results, rankings and honours boards of former members — no longer has a contractual basis after exit; anyone wishing to continue publishing it needs consent under Art. 7 GDPR.

Master data such as postal address and contact details lose their basis under Art. 6(1)(b) GDPR on exit and must be removed from the active records; to the extent that the same details are contained in accounting documents, they remain stored there for the duration of the statutory retention period under Art. 6(1)(c) GDPR — document both categories separately in the record of processing activities. For Austria, this article does not state a tax-law period: in that case, record the period you have chosen, with reasoning, in the record of processing activities (Art. 30(1) GDPR) and have the retention period for accounting documents confirmed by the association's tax adviser.

To make this verifiable, envisaged erasure periods for each data category belong in the record of processing activities (Art. 30(1) GDPR) — not as a collective entry 'as required', but per category: contribution and voucher data, master data, communication data, photo archive, results and honours board data. Where a retention obligation conflicts with the right to erasure under Art. 17 GDPR, document the conflict and the reasoning in writing; that is the answer you will later give to a member or to the supervisory authority. Working through erasure once per association year on a fixed date is a practice recommendation, not a statutory period.

6. Publication of images

For photos on association websites and in social media you need the consent of the identifiable persons; in Germany the KunstUrhG and the GDPR apply side by side. For group photos, association practice works with collective information — meaning a note in the event announcement, a notice at the entrance or an announcement before the competition (practice recommendation). Independently of that, Art. 7(1) GDPR applies to the consent itself — the demonstration must be kept on a personal basis, that is, for the data subject (see section 2).

Practice recommendation for drawing the line: overview shots of the playing field are less critical than portrait and winners' photos; as soon as a person is identifiably at the centre, documented consent is the usual route. Because consent can be withdrawn at any time (Art. 7(3) GDPR, see section 2), the association needs a way to take an image down at short notice — including the copies in social media channels.

To be distinguished from this is the camera at the clubhouse: for image recordings, Austria has its own rules in §§ 12, 13 DSG — a labelling obligation (§ 13(5)) and the requirement that retention beyond 72 hours must be proportionate and must be separately logged and justified (§ 13(3)). Also to be distinguished is the consent of website visitors — see the section Association website: cookies and tracking.

7. Designating a data protection officer — from when?

Mandatory as soon as the association as a rule constantly engages at least 20 persons in the automated processing of personal data (§ 38(1) sentence 1 BDSG). The law refers to persons, not to employees or staff — so in an association, volunteers (executive board, treasurer, training instructors) also count if they constantly process membership data by automated means. Irrespective of the number of persons, a DPO must be designated where processing operations are subject to a data protection impact assessment under Art. 35 GDPR (§ 38(1) sentence 2 BDSG). How you recognise such processing is set out in Art. 35(3) GDPR: systematic and extensive evaluation of personal aspects producing legal effects, large-scale processing of special categories under Art. 9, and systematic large-scale monitoring of publicly accessible areas. In an association, the last two cases in particular come into consideration: a camera that systematically and extensively monitors a publicly accessible area, and the large-scale processing of special categories — for example where the association has a denominational or party-affiliated orientation; whether the threshold is reached in the individual case must be assessed for each processing operation.

This German threshold applies in addition to the EU base cases in Art. 37(1) GDPR, which apply irrespective of any number of persons: (a) processing by a public authority or body, (b) core activities consisting of processing operations which require regular and systematic monitoring of data subjects on a large scale, (c) core activities consisting of large-scale processing of special categories under Art. 9 or of data relating to criminal convictions under Art. 10. Where a DPO has been designated, Art. 39(1) GDPR names their five core tasks ((a)–(e)): informing and advising, monitoring compliance including awareness-raising and training of the staff involved, advising on the data protection impact assessment, cooperating with the supervisory authority and acting as its contact point. That data subjects may also consult the DPO follows from Art. 38(4) GDPR.

DE / AT: The 20-person threshold applies only in Germany; in Austria the designation obligation follows directly from Art. 37 GDPR — § 5 DSG governs only confidentiality and, in the public sector, freedom from instructions. The other legal bases (Art. 6, 9, 13 GDPR) apply equally in both countries. A comparison including the competent supervisory authority: table 'Deadlines and DE/AT differences'.

8. Training office holders

Everyone who handles membership data must be trained: the executive board, the treasurer, coaches and training instructors, as a practice recommendation at least once a year — this frequency is a practice recommendation, not a statutory period. Its benefit: training is a simple way of addressing Accountability under Art. 5(2) GDPR for the human factor.

Where a data protection officer has been designated, awareness-raising and training of the staff involved in processing operations is in any case part of their monitoring task under Art. 39(1)(b) GDPR. In Austria, the data secrecy obligation under § 6 DSG is added: controllers, processors and their staff are bound to confidentiality — a written declaration of commitment is the usual implementation there (practice recommendation). In terms of content, little is needed for the volunteer group, but it must be binding: which data are held where, who may see them, what happens on a request for access, what happens in the event of a Personal Data Breach. In practice, an attendance list with a date serves as evidence.

That covers the eight obligations of membership management. Independently of these, cross-cutting obligations are added, set out in the following sections: assessing special categories (Art. 9 GDPR), consent for the association website (§ 25(1) TDDDG in Germany, § 165 TKG 2021 in Austria), the record of processing activities (Art. 30 GDPR), responding to data subject requests (Art. 12(3) GDPR) and notifying a Personal Data Breach (Art. 33 GDPR).

Special categories in an association: when Art. 9 GDPR applies

Special categories arise in associations more often than assumed: Art. 9(1) GDPR covers data revealing racial and ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a person, health data and data concerning sex life or sexual orientation. In an association, such data can arise from the association's purpose and from donation data — where the orientation is denominational, party-affiliated or trade union related — and from health information collected for sporting activities. Processing is prohibited in principle and permitted only through one of the narrow exceptions in paragraph 2, in practice most often through explicit consent; which exception applies in the specific association must be assessed for each processing operation.

Four consequences for association practice follow from this. First, in the record of processing activities an additional basis under Art. 9(2) must be documented alongside the legal basis under Art. 6. Second, the exemption in Art. 30(5) GDPR is excluded as soon as special categories are processed — the record of processing activities must then be maintained in any event. Third, where processing is large-scale, the data protection impact assessment under Art. 35(3) GDPR applies and, where that large-scale processing is a core activity, the designation obligation under Art. 37(1)(c) GDPR. Fourth, the fining range is at the upper end: infringements of Art. 9 fall under Art. 83(5) GDPR.

Association website: cookies and tracking

For tracking cookies on the association's site, the association needs prior, informed consent. In Germany this is governed by § 25(1) TDDDG: the storage of information in the end user's terminal equipment and access to information already stored there are permitted only where the end user has consented on the basis of clear and comprehensive information; information and consent must meet the GDPR standard. Without consent, paragraph 2 leaves only what serves solely to carry out the transmission of a message or is strictly necessary in order to provide a digital service expressly requested by the user. In Austria, § 165 TKG 2021 requires an opt-in for tracking cookies.

For the association in Germany this means: check every element embedded in the association's site — embedded videos, externally loaded fonts, visitor statistics, map or sign-up widgets — individually as to whether it stores information in the terminal equipment or accesses it, and obtain consent before the first access (§ 25(1) TDDDG). For Austria, the benchmark documented here is the opt-in for tracking cookies under § 165 TKG 2021. The route to demonstration is in both cases the same as for consent for photos and advertising: the conditions of Art. 7 GDPR apply (demonstration and withdrawal, see section 2).

Record of processing activities: why the exemption in Art. 30(5) GDPR rarely applies in an association

The exemption in Art. 30(5) GDPR rarely applies in an association because it requires all four conditions cumulatively — and a continuously maintained membership list with collection of contributions already breaks the condition 'no regular processing'. An association therefore needs a record of processing activities (RoPA) as soon as it processes personal data; where a membership list is maintained, that is always the case. In this respect, associations fall under the same rules as SMEs.

Cumulative means: the exemption applies only where all conditions are met together — fewer than 250 employees and no risk to the rights and freedoms of data subjects and no regular processing and no special categories under Art. 9 or data relating to criminal convictions. The wording matters: it refers to 'a risk', not to a high risk — the 'high risk' threshold applies solely to the data protection impact assessment under Art. 35(1) GDPR.

In substance, Art. 30(1) GDPR lists seven mandatory items ((a)–(g)). Because (c) bundles two points — categories of data subjects and categories of personal data — practice derives eight mandatory fields per processing activity from this and adds the legal basis as a ninth field. For an association, the nine fields look like this:

1. Name and contact details of the Controller — the association, represented by the executive board — and, where designated, of the data protection officer
2. Purposes of the processing: membership management, collection of contributions, association information
3. Categories of data subjects: members, training instructors, donors
4. Categories of personal data: master data, bank details, health information where applicable
5. Categories of recipients: association software, tax adviser, federation
6. Transfers to third countries including the safeguards
7. Where possible: envisaged erasure periods for each data category
8. Where possible: general description of the technical and organisational measures under Art. 32(1) GDPR — as a reference to a central TOM concept
9. Legal basis for each processing operation — a practice field: it is not named in Art. 30(1); it follows from Accountability under Art. 5(2) GDPR

The record must be made available on request by the supervisory authority (Art. 30(4) GDPR); the provision sets no fixed deadline — practice recommendation: keep the record current enough that it can be transmitted without lead time. A spreadsheet is sufficient: the record must be kept in writing, which may also be in electronic form (Art. 30(3) GDPR); what matters is that content, currency and legibility are right. In Austria, Art. 30 GDPR applies in identical wording.

Data subject rights: when a member requests access

To requests for the exercise of the rights under Art. 15 to 22 GDPR — including access, rectification, erasure, restriction, data portability and objection — the association must respond without undue delay, and in any event within one month of receipt (Art. 12(3) GDPR).

The period may be extended by a further two months where the complexity and number of the requests make this necessary — but the association must then inform the data subject within the first month of the extension and the reasons for it. In practice this means: record the date of receipt, maintain a named address for such requests (the executive board or, where designated, the data protection officer as contact point under Art. 38(4) GDPR), and file the reply with a date. The sanction range is at the upper end: infringements of the rights of the data subject (Art. 12–22) fall under Art. 83(5) GDPR — up to EUR 20,000,000 or, in the case of an undertaking, up to 4 % of the total worldwide annual turnover, whichever is higher. In Germany, § 43 BDSG additionally sanctions certain infringements — incorrect handling of a request for access, or consumer information, in each case under § 30 BDSG — as an administrative offence with a fine of up to EUR 50,000 (§ 43(2) and (3) BDSG).

Personal Data Breach in an association: the 72-hour notification

Where a breach of the protection of personal data becomes known, the association notifies it to the competent supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33(1) GDPR) — unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The period runs from becoming aware, not from completion of the internal investigation; where notification is made later, reasons for the delay must be given.

Where the breach is likely to result in a high risk, notification of the data subjects is added — without undue delay and in clear and plain language (Art. 34 GDPR). It is not required in the cases set out in paragraph 3: effective protective measures, in particular encryption; subsequent measures that eliminate the high risk; or disproportionate effort — in which case a public communication takes its place.

The addressee in Germany is the authority competent under Land law for non-public bodies (§ 40(1) BDSG), in Austria the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG). There, § 62(1) DSG additionally provides for administrative fines of up to EUR 50,000 for certain intentional acts (for example, intentional unlawful access to a data processing operation, intentional transmission in breach of the data secrecy obligation under § 6 DSG) — and only where the act does not already constitute an infringement under Art. 83 GDPR. § 11 DSG requires the supervisory authority to apply Art. 83 GDPR proportionately, in particular to issue a reprimand instead of a fine for first-time infringements.

Deadlines and DE/AT differences at a glance

The column 'Deadline/point in time' reproduces what the wording of the provision named in each case states. Practice recommendations — such as the training rhythm or the annual erasure date — do not appear in this table but in the running text.

Implementation in a volunteer setting: the order of steps

For an association without full-time administration, this order of steps is worthwhile — it works without software:

1. Collect the processing operations and determine a legal basis under Art. 6(1) GDPR for each one: membership management, collection of contributions, newsletter, website, photos, training instructor settlements.
2. Mark special categories under Art. 9 GDPR separately — association purpose, donation data, health information — and document the additional basis under Art. 9(2) GDPR.
3. Set up a record of processing activities with the nine fields; a spreadsheet is sufficient.
4. Add the information under Art. 13 GDPR to the admission form, including the right to lodge a complaint with the competent supervisory authority.
5. Obtain consent for photos and advertising in such a way that demonstration and simple withdrawal under Art. 7 GDPR are possible.
6. Record erasure periods for each data category and justify conflicts with Art. 17 GDPR in writing.
7. Check the association website: in Germany consent before storing information in, or accessing information on, the terminal equipment (§ 25(1) TDDDG), in Austria opt-in for tracking cookies (§ 165 TKG 2021).
8. Assign responsibilities: who answers requests under Art. 12(3) GDPR, who notifies under Art. 33 GDPR? And: review data processing agreements under Art. 28(3) GDPR for association software, cloud services and the tax adviser — the review points are set out in section 1.