I'm currently in the process of developing a system that allows my customers to keep track of members of an organisation. The organisation has members that each year pay for their membership and everyone is personally related to the organisation.

When the GDPR takes effect, is the organisation still allowed to enter information of a new (or existing) member, and if so, do they need written consent? The old situation would be storing the new member's information in Excel, for example.

If someone requests for their data to be removed ("right to be forgotten"), do I remove them from this organisation's administration? How do I let this organisation know one of their members still wants to be a member, but not in the system? Do I get to still show their name, but list all other info as "removed", or do I also have to remove their name completely (which means the organisation does not know who the person was in the first place)?

I can't seem to find the right answers to these questions, as most of the information I find about the GDPR is about us, as a company, maintaining the data, which is not entirely our work.

  • I'd like to comment that we're not lawyers here, except for maybe the very few. So any advice you receive in this thread comes with the caveat that it's not law advice from a professional attorney.
    – Michael d
    Apr 12, 2018 at 17:31
  • I am aware, but I assume I'm not the only person who faces this problem, and someone might point me to more explicit rules
    – Ruben
    Apr 12, 2018 at 17:36

2 Answers 2


GDPR still allows you to store data, it only changes the way you handle them. For instance, there should be a section of your application that explains why the data is been collected, how the data collected is been used and total removal of the data if the user requests for such. Also, the user should be able to know the amount of information he or she is sharing at the click of a button.

  • The question seems to imply that the person entering the data is not the person the data is about, I might be reading it wrong though
    – jrtapsell
    Jun 19, 2018 at 6:28

Sure, you still allowed to store eveything you want. But you should

  • offer clear opt-in before you store anything with listing everything you will store,
  • after you stored anything, you should list everything you already store on user's request,
  • offer clear opt-out.

In case you already store anything: if you began to store anything without clear opt-in, you should delete all stored user data and begin with:

  • offer clear opt-in before you store anything with listing everything you will store.

In case you already store anything - it could be checked by officials, whether you offered clear opt-in and opt-out. If no, it could be, don't know, sued, sentenced or the like - depends on certain country's law.

Depending on your competitor's situation you could become a denunciation victim, so you better contact a lawyer of your trust.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.