GDPR and CiviCRM for a small but internationally operating and serving organisation

Question

In our relatively small UK based charity, our CiviCRM database holds personal data of members, donors, event attendees and volunteers from around the UK, Europe, USA and other countries around the world.

Our trained volunteers manage our CRM database by logging on to CiviCRM in the UK, India, USA and other countries around the world.

Could you point me to any suitable resources to determine how an internationally serving and operating organisation that holds personal data on people from multiple countries and operates in multiple countries can get ready for the General Data Protection Regulation (GDPR) which is coming into effect on 25 May 2018?

Answer 1

There is no individual resource as such that holds the answers to your question. There are currently still a significant amount of unknowns surrounding GDPR. Some of your issues can be resolved technically. By hosting your systems and data in a country like Switzerland which already has a so called "adequacy decision" with the EU and the US. Swiss law by default already sets the benchmark higher for privacy. But there are a number of things you have to do as a bare minimum: Data inventory. KNOW where your data is. HOW is that data used; domestic or commercial data processing? Be able to show how you are using the data and be able proof that that IS how you are using the data. The most important thing is that you are able to show you are TRYING to comply first and foremost. Secondly have a data-breach coping mechanism in place that ensures timely reporting to the correct authority. Hope this is helpful.

Answer 2

While this is only a partial answer to your question, it's worth checking out the CiviCRM GDPR extension, detailed on the CiviCRM blog.