In our relatively small UK based charity, our CiviCRM database holds personal data of members, donors, event attendees and volunteers from around the UK, Europe, USA and other countries around the world.

Our trained volunteers manage our CRM database by logging on to CiviCRM in the UK, India, USA and other countries around the world.

Could you point me to any suitable resources to determine how an internationally serving and operating organisation that holds personal data on people from multiple countries and operates in multiple countries can get ready for the General Data Protection Regulation (GDPR) which is coming into effect on 25 May 2018?

  • Great question. USA don't have (federal) privacy laws. For EU, certification and code of conducts are seemingly the best advice currently given. Some GDPR principles are rather simple. You could skim them and report CiviCRM bugs for each dubious one.
    – Nemo
    Jan 29, 2018 at 12:31
  • Maybe the Commission has answers... twitter.com/nemobis/status/957988391513141249
    – Nemo
    Jan 29, 2018 at 14:45
  • It's my understanding that the GDPR is connected to the EU individual no matter where they live. So they may be a resident of the EU and live in the USA. Apr 11, 2018 at 23:59

2 Answers 2


There is no individual resource as such that holds the answers to your question. There are currently still a significant amount of unknowns surrounding GDPR. Some of your issues can be resolved technically. By hosting your systems and data in a country like Switzerland which already has a so called "adequacy decision" with the EU and the US. Swiss law by default already sets the benchmark higher for privacy. But there are a number of things you have to do as a bare minimum: Data inventory. KNOW where your data is. HOW is that data used; domestic or commercial data processing? Be able to show how you are using the data and be able proof that that IS how you are using the data. The most important thing is that you are able to show you are TRYING to comply first and foremost. Secondly have a data-breach coping mechanism in place that ensures timely reporting to the correct authority. Hope this is helpful.


While this is only a partial answer to your question, it's worth checking out the CiviCRM GDPR extension, detailed on the CiviCRM blog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.