--- title: "The New World of Global Data Protection" id: "10455" type: "post" slug: "the-new-world-of-global-data-protection" published_at: "2017-10-27T00:00:00+00:00" modified_at: "2026-03-15T02:48:59+00:00" url: "https://associationsnow.com/2017/10/27/the-new-world-of-global-data-protection/" markdown_url: "https://associationsnow.com/2017/10/27/the-new-world-of-global-data-protection.md" excerpt: "Data security and protection continue to make headlines in the United States and abroad, and after four years of preparation and debate, the European Parliament and European Council approved the General Data Protection Regulation (opens in a new tab) (GDPR)..." taxonomy_category: - "Governance" taxonomy_post_tag: - "ASAEcenter" - "Compliance" - "Data Management" - "data protection" - "GDPR" - "International Law" taxonomy_content_format: - "Article" taxonomy_role: - "Association CEO / Executive Director" - "C-Level" - "Executive Team" taxonomy_persona: - "Association Professionals" --- [Home](https://associationsnow.com/) » [Articles](https://associationsnow.com/format/article/) » The New World of Global Data Protection Data security and protection continue to make headlines in the United States and abroad, and after four years of preparation and debate, the European Parliament and European Council approved the [General Data Protection Regulation (opens in a new tab)](https://gdpr-info.eu/) (GDPR) in April 2016. After a two-year grace period, the new rules will take effect on May 25, 2018. The GDPR marks a significant shift in the ways organizations will be required to handle personal data of residents of EU countries, and many associations are just starting to look closely at how the new rules will affect their data protection strategies. During the 2017 ASAE Annual Meeting and Exposition in Toronto, I moderated a discussion—joined by panelists Terrance Barkan, CAE (Globalstrat), Marc Beebe, CAE (IEEE), and Alfons Westgeest (Kellen Company)—to discuss with association leaders why organizations should be paying attention. ### What is GDPR? GDPR was initially developed by the European Commission in 2012 to strengthen and unify data protection across the EU. It [includes specific provisions (opens in a new tab)](https://www.asaecenter.org/resources/articles/an_plus/2016/september/are-you-ready-for-the-eus-new-data-privacy-laws) for the handling of personal data exported outside the EU. It imposes mandatory reporting for data breaches, heavier sanctions for noncompliance, revised consent criteria, and much more. Under these rules, any organization that maintains and uses European member or customer data, even if it is hosted in the U.S., will be subject to these regulations. ### What Does GDPR Cover? The regulation covers the processing of “personal data” that relates to “data subjects” by or on behalf of a “data controller.” By definition, “personal data” is any information that relates to an identified or identifiable natural person (the “data subject”). An identifiable natural person is anyone who can be identified, either directly or indirectly, by things like a name, identification number, location data, online identifier, or data that relates to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. Based on this broad definition, it is clear that “personal data” applies to much of the data that associations hold on their members, prospects, former members, sponsors, donors, meeting attendees, and others. Some personal data is categorized as special data by GDPR and is subject to greater restrictions, including data about religious or philosophical beliefs, health, racial or ethnic origin, trade union membership, political beliefs, and sex life or sexual orientation. > Many associations are just starting to look closely at how the new General Data Protection Regulation will affect their data protection strategies. ### What Requirements Does GDPR Impose? GDPR has several requirements for compliance measures and safeguards, including privacy by design and default, data protection impact assessments, and a comprehensive record of data processing for activities and reporting of data breaches. The principle of accountability implies that data controllers must be able to demonstrate compliance with the following six privacy principles: - **Lawfulness, fairness, and transparency** in the processing of personal data. - **Purpose limitation.** Personal data is obtained for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. - **Data minimization.** Data processed is adequate, relevant, and limited to what is necessary. - **Accuracy.** Personal data is accurate and, where necessary, kept up to date. - **Storage limitation.** Personal data is not kept longer than necessary. However, data aggregated for archiving and research purposes can be kept longer, always subject to safeguards. - **Integrity and confidentiality.** Adequate technical and organizational measures must be in place to guard against unauthorized or unlawful processing, loss, damage, or destruction. ### GDPR in Action Associations should be taking steps now to determine what they need to do to comply with GDPR when it becomes effective next year. First, don’t panic. Determine your association’s level of exposure and ask: How much data should we collect from the EU? Do your due diligence, and start preparing now. You can break this work down into three main areas: understanding the regulation, figuring out a technical solution, and how it will impact your marketing and communication efforts. Find experts and resources that can help you navigate GDPR. Even if you have in-house counsel, they’re probably not experts in data privacy—let alone GDPR. You’ll likely need some outside assistance. Fortunately, [many (opens in a new tab)](https://onetrust.com/resources/) [resources (opens in a new tab)](http://www.globalstrat.org/referenceresource-material) are [available (opens in a new tab)](https://www.twobirds.com/en/hot-topics/general-data-protection-regulation) [online (opens in a new tab)](https://www.dpnetwork.org.uk/gdpr/) , including some [guidelines and related materials (opens in a new tab)](http://ec.europa.eu/newsroom/just/item-detail.cfm?item_id=50083) published by the European Commission. Every association needs to assess its situation and risk and take necessary steps to protect members’ data. Having a strong risk management strategy that addresses data management and privacy policies is a good start. [Thomas G. Foley, CAE](https://associationsnow.com/author/thomas-g-foley-cae/) Thomas G. Foley, CAE, is vice president of membership and customer development at the Institute of Food Technologists. [More articles by this author](https://associationsnow.com/author/thomas-g-foley-cae/) Tags: [#Compliance](https://associationsnow.com/tag/compliance/) [#Data Management](https://associationsnow.com/tag/data-management/) [#data protection](https://associationsnow.com/tag/data-protection/) [#GDPR](https://associationsnow.com/tag/gdpr/) [#International Law](https://associationsnow.com/tag/international-law/) **Stay Informed** [Subscribe to our free newsletter](https://associationsnow.com/newsletter/) , *Associations Now Daily News*, to find out what’s happening in the association world every business day. ## You Might Like - [TemplateMembers onlyASAE Terms and PrivacyJune 15, 2018](https://associationsnow.com/2018/06/15/asae-terms-and-privacy/) - [TemplateMembers onlyMira Data Protection PolicyMay 11, 2018](https://associationsnow.com/2018/05/11/mira-data-protection-policy/) - [TemplateMembers onlyASAE GDPR Vendor LetterMay 11, 2018](https://associationsnow.com/2018/05/11/asae-gdpr-vendor-letter/) - [VideoSmarter Board Management for Associations: An OnBoard ShowcaseJuly 24, 2026](https://associationsnow.com/2026/07/24/smarter-board-management-for-associations-an-onboard-showcase/) ## Comments **Comments are for ASAE members.** [Learn more about comments on this site.](https://associationsnow.com/comments/) [Log in](https://associationsnow.com/login?redirect_to=https%3A%2F%2Fassociationsnow.com%2F2017%2F10%2F27%2Fthe-new-world-of-global-data-protection%2F%23comments) to your member account or [join ASAE](https://my.asaecenter.org/select-a-membership-type/) !