I'm currently in the process of developing a system that allows my customers to keep track of members of an organisation. The organisation has members that each year pay for their membership and everyone is personally related to the organisation.
When the GDPR takes effect, is the organisation still allowed to enter information of a new (or existing) member, and if so, do they need written consent? The old situation would be storing the new member's information in Excel, for example.
If someone requests for their data to be removed ("right to be forgotten"), do I remove them from this organisation's administration? How do I let this organisation know one of their members still wants to be a member, but not in the system? Do I get to still show their name, but list all other info as "removed", or do I also have to remove their name completely (which means the organisation does not know who the person was in the first place)?
I can't seem to find the right answers to these questions, as most of the information I find about the GDPR is about us, as a company, maintaining the data, which is not entirely our work.