Clubs do not need to get a positive agreement, explicit consent or even confirmation from their members that they have read the club's privacy notice. You simply need to share it with them, by email or in paper form, and record when and how you shared the notice with them. You will need to share it again any time you make changes to it in the future. 

So long as your privacy notice explains that you hold and use your members' personal information on the basis of the club's contractual and legitimate interests, then their positive agreement is confirmed by their signing up for or choosing to renew their membership. It is important that your privacy notice also gives members a clear option to manage or change their communication preferences with the club on an ongoing basis.

The law is not specific in stipulating how data must be stored, just that you have appropriate safeguards in place. We suggest that you first need to review whether it is necessary to hold hard copies of members' personal information in multiple homes. Try to cut down where possible - for instance, by scanning in paper membership forms or inputting into a password protected spreadsheet. 

If it is important to the operation of the club that you retain paper copies of personal information, then you do need to demonstrate that you are taking precautions to hold that information responsibly and securely. If paper documentation is stored in a locked cabinet, this conveys that you have sought to be diligent.

Your privacy notice should cover all the people who you hold personal information for. So yes, it should be shared with all existing non-members/prospective members and it should be given to new guests/non-members when you are collecting their personal information. 

You should add a specific sentence into your privacy notice if you retain the data of people who don’t join for a different timescale to your members. If another club shares the personal information of their members with you – they should add this to their privacy notice or ensure they have a record of informing their members about the transfer of the data.

GDPR will allow organisations to process next of kin details / emergency contact details under legitimate interest processing rules or lawful bases. It is reasonable to assume that it is in a person’s best interest to have their data processed for this purpose and it is an important part of the club's responsible approach to managing safety. 

Clubs should review whether it is really necessary to circulate members' contact details publicly or between the full club membership. 

If the club chooses to continue to publish detailed membership lists or contact details, they should also provide recipients with clear instructions on what they can/can’t do with the data in the lists, i.e. they can only use the data for club-related communication and can not pass or sell the data on to anyone else. This should be highlighted in the club's privacy notice too.

It will continue to be acceptable to retain historic publications like club newsletters or journals that include members' personal information in the public domain or in a public archive. 

Clubs should review whether it is really necessary to continue to publicly share members' contact information in future publications, though there is obviously always likely to be references to names and photos. You should ensure that any personal information that you intend to continue publishing in these public locations is referred to in your club's privacy notice.

If a member were to request their "right to be deleted", this can not reasonably include personal information which is already in the public domain.

Members sign up to a Facebook closed group themselves and in choosing to do so, they accept Facebook’s security and data protection principles.

This is not necessary for small not-for-profit membership organisations, unless a club operates CCTV for crime protection, e.g. at a hut. 

• Check out the ICO self-assessment tool if you are not sure 
  

This advice has been written to help club officers of Mountaineering Scotland's affiliated clubs review whether their club processes will be compliant with GDPR changes in data protection law. We have received legal support through sportscotland's expert resource, Harper McLeod, in pulling together our advice and templates. The guidance in these web pages does not constitute legal advice and is based on information available at the time of writing.