There is no individual resource as such that holds the answers to your question. There are currently still a significant amount of unknowns surrounding GDPR. Some of your issues can be resolved technically. By hosting your systems and data in a country like Switzerland which already has a so called "adequacy decision" with the EU and the US. Swiss law by default already sets the benchmark higher for privacy. But there are a number of things you have to do as a bare minimum: Data inventory. KNOW where your data is. HOW is that data used; domestic or commercial data processing? Be able to show how you are using the data and be able proof that that IS how you are using the data. The most important thing is that you are able to show you are TRYING to comply first and foremost. Secondly have a data-breach coping mechanism in place that ensures timely reporting to the correct authority. Hope this is helpful. Your question was pointed out to me by Hans Idink (a Civicrm expert https://www.linkedin.com/in/hansidink/) Feel free to get in touch. Remco https://www.linkedin.com/in/remdotco/

There is no individual resource as such that holds the answers to your question. There are currently still a significant amount of unknowns surrounding GDPR. Some of your issues can be resolved technically. By hosting your systems and data in a country like Switzerland which already has a so called "adequacy decision" with the EU and the US. Swiss law by default already sets the benchmark higher for privacy. But there are a number of things you have to do as a bare minimum: Data inventory. KNOW where your data is. HOW is that data used; domestic or commercial data processing? Be able to show how you are using the data and be able proof that that IS how you are using the data. The most important thing is that you are able to show you are TRYING to comply first and foremost. Secondly have a data-breach coping mechanism in place that ensures timely reporting to the correct authority. Hope this is helpful.