GDPR Guide.pdf

The General Data Protection Regulation (GDPR) replaces the Data Protection Act 1998 and applies to organizations handling personal data, with the UK's Information Commissioner's Office (ICO) as the independent authority. Key definitions include 'personal data', 'data controller', and 'data processor'. The GDPR applies to both controllers and processors, and organizations must comply with the new regulations. Action areas include documentation, consent, and record-keeping, with requirements for Data Privacy Notices, Data Protection Policies, and membership forms. Consent is only required where necessary, and clubs must gain consent for direct marketing, including contacting members, ex-members, and non-members with club news and events. Record-keeping is crucial, with separate storage and maintenance of contact lists, and the ICO provides guidance on obtaining, recording, and managing consent.