🔐 Data protection in the association

The GDPR also applies to associations: register of processing activities, data protection officer from 20 people and supervision by the state authorities.

data protection GDPR register of processing activities data protection officer member data state data protection authority BDSG

In brief

An association processes names, addresses, fees and often photos. The General Data Protection Regulation (GDPR) applies to this.

A data protection officer is needed if as a rule at least 20 people are permanently engaged in automated data processing. This also applies to volunteers who work permanently with member data (a question of interpretation, not conclusively checked here).

Supervision of non-public bodies lies in principle with the state data protection authorities.

Step by step

Create a data overviewWhich data, for what, who has access, when is it deleted?
Check the registerA register of processing activities can be mandatory even for small associations (Art. 30 GDPR).
Limit accessOnly as many people as necessary; passwords, encrypted devices.
Use the supervisory authority or advice if in doubtThe state data protection authority for the association's seat.

Deadlines

at least 20 people

Data protection officer, if as a rule at least 20 people are permanently engaged in automated processing of personal data.§ 38 Abs. 1 BDSG

fewer than 250 employees (exception, does not apply to processing that is more than occasional)

The exception from the register requirement does not apply if processing is more than occasional, poses risks or concerns special categories of data.Art. 30 Abs. 5 DSGVO

Watch out – common mistakes

The exception from the register requirement rarely applies in practice with regular member administration (interpretation, not documented here by an authority source).
Special categories of data (for example health, religion) are subject to stricter rules.
Photos of events and publication online need a sound legal basis; not checked here in detail.
Reporting obligations for data breaches are not covered here.

In depth · legal basis, figures and practice – for advisers and professionals

Data protection officer

§ 38 Abs. 1 BDSG requires non-public bodies to appoint a data protection officer if as a rule they permanently engage at least 20 people in the automated processing of personal data; also in the case of a data protection impact assessment or business-like data processing for transfer, anonymised transfer or market and opinion research.

Register

Under Art. 30 Abs. 1 DSGVO the controller keeps a register of processing activities. The exception for organisations with fewer than 250 employees does not apply if the processing poses a risk to rights and freedoms, is more than occasional or concerns special categories of data (Art. 30 Abs. 5 DSGVO).

Supervision

The state data protection authorities in principle also supervise the non-public sector (statement of the BfDI).

Who is responsible

State data protection authority of the federal state
Data protection officer (if appointed)

Quick questions

Worum geht es bei „Data protection in the association“?

The GDPR also applies to associations: register of processing activities, data protection officer from 20 people and supervision by the state authorities.

Which deadlines and figures matter?

at least 20 people: Data protection officer, if as a rule at least 20 people are permanently engaged in automated processing of personal data. (§ 38 Abs. 1 BDSG)
fewer than 250 employees (exception, does not apply to processing that is more than occasional): The exception from the register requirement does not apply if processing is more than occasional, poses risks or concerns special categories of data. (Art. 30 Abs. 5 DSGVO)

What should I do first?

Create a data overview: Which data, for what, who has access, when is it deleted?
Check the register: A register of processing activities can be mandatory even for small associations (Art. 30 GDPR).
Limit access: Only as many people as necessary; passwords, encrypted devices.

What do I need to watch out for?

The exception from the register requirement rarely applies in practice with regular member administration (interpretation, not documented here by an authority source).
Special categories of data (for example health, religion) are subject to stricter rules.
Photos of events and publication online need a sound legal basis; not checked here in detail.

Evidence

BDSG § 38, gesetze-im-internet.de, retrieved 20 September 2026
DSGVO Art. 30, dsgvo-gesetz.de, retrieved 20 September 2026
BfDI, addresses of the state authorities, bfdi.bund.de, retrieved 20 September 2026

As of

September 2026 · Sources and method

A question about your situation that this page does not answer? Write to us or use the contact form – we will tell you which office is responsible and what to bring. Free of charge, without individual legal advice.