The GDPR is the EU data protection regulation which replaces the current Data Protection Act. It aims to simplify regulation and give individuals more control over their personal data.

For Third Sector organisations already working within the constraints of the Data Protection Act it is unlikely to mean enormous changes to their approach. However, it does come with some additional duties and and some additional anxiety, due to the enormous penalties for non-compliance. The penalties for non-compliance will make third sector organisations think twice about their use of personal data (i.e. fines can be up to 4% of worldwide turnover).

The regulations become enforceable from 25 May 2018.…