Keeping and retaining membership records
What you record about a member, what the GDPR says about it, how long you keep it and what you do when someone resigns. For the board that wants to get it right without turning it into a research project.
Try free for 30 daysNo credit card needed. After 30 days it stops by itself.
What do you record about a member?
Record what you need for someone to be a member, and no more. That is also what the GDPR asks: data you do not need is data you do not have to protect.
Name and address
To be able to reach a member and to convene the general meeting.
Email and phone
For the newsletter, the invoice and the coach who wants to know who is coming.
Type of membership and member since
Because the membership fee and the right to vote depend on it.
Payment details
An IBAN and a direct debit mandate only if you collect by direct debit. Someone who pays through a payment link does not have to give an account number.
Date of birth
Only if it matters, for example for a junior membership fee or grouping by age.
Date of resignation
So you know until when someone owes the membership fee and when you can clear out their details.
What does not belong in it: data on health, religion or ethnic origin, unless there really is no other way, and then only with explicit consent. A club never needs a citizen service number (BSN).
The member register and your articles of association
In the Netherlands, the articles of association of most clubs state that the board keeps a register with the names and addresses of the members. It is practical too: without an up-to-date list you cannot properly convene the general meeting, and at a vote you do not know who is entitled to vote.
In Belgium it is a legal duty for a vzw (non-profit association). The register of full members is kept at the registered office, a change is entered within eight days, and every member may inspect it.
The GDPR in four points
The GDPR applies to every club, however small. For membership records it comes down to four things.
A lawful basis
For what you need for someone to be a member, the membership itself is the lawful basis. For anything extra, such as a photo on the website, you ask for consent.
A privacy statement
Tell your members what data you record, what for and for how long. It can be short, as long as it is accurate.
Access and correction
A member may see what you hold about them and have a mistake corrected. If they can do that themselves, nobody on the board has to do anything for it.
A data processing agreement
If you keep the member list in someone else's software, you sign a data processing agreement with that supplier.
How long do you keep it?
The GDPR sets no fixed period. The rule is: no longer than necessary. For an active member that is as long as they are a member. After a resignation you usually no longer need their address and phone number, and then you clear them out.
For anything to do with money, the Netherlands has a seven-year retention duty: invoices, payments and the accounts. So you keep those for a former member too, with the name that is on them.
Set out your choice in your privacy statement, for example: contact details until one year after resignation, financial records seven years. Then the next board also knows what it has to stick to.
When a member resigns
Mark the member as resigned, with the date on which the membership ends. Until that date they owe the membership fee; after it they no longer count towards the member list, the newsletter or the next round of membership fees. Do not delete them straight away: their invoices and payments belong to the accounts, and the audit committee still needs those.
When the board changes
The moment membership records most often go wrong is the handover. If the list sits in a spreadsheet on the secretary's laptop, it leaves with the secretary, and so do the arrangements around it. If it is in one place the board can reach with its own permissions, all you hand over is a role.
How Ledenboek helps
- You mark a member as resigned with a resignation date. Former members stay visible separately and do not count in lists and rounds.
- A member with invoices cannot be deleted by accident, so invoices and payments last the full retention period.
- A member sees their own details in the member portal and updates their address or phone number themselves.
- Every board member sees what their role needs. An audit committee member can look but changes nothing.
- The data processing agreement comes with the subscription; you do not have to arrange anything for it.
- The member list goes to Excel in one click, for an access request or if you ever want to switch.
Frequently asked questions
How long may a club keep data on former members?
The GDPR sets no fixed period: no longer than necessary. You clear out contact details after the resignation, for example after one year. Invoices, payments and the accounts are kept for seven years in the Netherlands, for former members too.
Is a member register mandatory?
In the Netherlands it is in the articles of association of most clubs, and you need it to convene the general meeting. In Belgium a register of full members is a legal requirement for a vzw.
Do I need consent to record members' data?
Not for what you need for someone to be a member, because the membership is then the lawful basis. You do for anything extra, such as a photo on the website or sharing data with a sponsor.
May I keep the member list in Excel?
You may, as long as the file is properly secured and you know who has a copy. In practice it goes wrong at the board handover and when the file is emailed around, and that is where a system with separate permissions per board member helps.
What do I do if a member wants to know what data we hold about them?
You show them within a month what you record, and correct whatever is wrong. If a member can view their own details, for example in a member portal, that request has usually been answered already.
Looking for software for the whole picture, from sign-up to membership fees? Then read about membership administration for clubs.
Support and your data
Two things you should be able to count on with software for your association: that someone answers when you get stuck, and that your member records stay where they belong.
If you have a question
- ✓ You email and a human replies, within one business day
- ✓ The person who replies built it. Report a bug and it's sometimes fixed the same day
- ✓ No bot that replies automatically. What you read back was written by a human
- ✓ No queue, no ticket number, no chatbot that asks five questions first
- ✓ Helping you think through how to set things up is part of the service and costs nothing extra
You can call on Monday to Friday between 09:00 and 17:00, on +31 84 833 2125. No queue and no menu; you get the person who built it. If we are on another call, leave a message and you will hear back the same working day. Outside office hours and during holidays there is no cover, so then it goes by email.
Where your data lives
- ✓ Everything within the EU. The servers are at Hetzner in Germany
- ✓ Every party that does something for us is also in the EU, in the Netherlands, Germany or Ireland. No transfers beyond it
- ✓ Member records are never sold, rented out or used to offer your members anything
- ✓ Membership fees go directly to the association's bank account, not through us
- ✓ You can export your full member records yourself at any time
The data processing agreement is available online, naming all six parties and where they are based. An association ought to have one; you shouldn't have to ask for it.
Membership records you can hand over
Members, membership fees and accounts in one place, with permissions per board member and the data processing agreement included.
Try free for 30 days