Data Protection (GDPR) for Small Charities

What is personal data in your charity? Who does it relate to?

Is any of it really sensitive?

What do you use it for and how do you justify its use?

How long can you keep it?

Where do you keep it and where can you keep it?

What do you have to tell people? … let’s write a privacy notice

What is a subject access request … and what do we do? (How about a procedure?)

Do you need policies?

What can go wrong?