GDPR and database of customers (mailing list)

[RiftGibbon]

I wonder if anyone can advise? I'm trying to understand the information/regulations around this and am getting confused.

In this instance the situation is a small charity where a number of people may wish to be informed of updates, events, new initiatives.
The information held would be Surname, First Name and email address. Data would not include details of marital status, age, income, race, gender, or any other identifying characteristics.
Ideally it would be entered into a database but could just be a spreadsheet. From there, a mailing list would need to be generated which could autofill and mail out a pre-written message.

The information could theoretically be a spreadsheet saved only on a usb stick, which would be used on the business premises, and could be password protected. This could be stored in a safe.
If that wasn't a viable option, then something on a computer, also password protected.

Can anyone tell me in simple terms what we need to do? Or point me to a source that's relatively easy to navigate.

Thanks in advance

I have a few mailing lists for a charity. I gave several.email groups set up.on in Outlook.
I always send emails using BCC

Thankyou, this is helpful.

I don't think that anything that is wanted (as outlined in my post above) would breach GDPR but it's more about where the information is stored that is causing some concern.

I'm more than happy to read up to get a full understanding but am struggling to find a website/source that isn't overly complicated. Most things I have seen are talking about keeping records that profile people but that isn't the information that's needing to be used in this instance.

Saving it on a computer with a password would be absolutely fine! Make sure you also have a proper data protection policy in place

Short video
It’s not rocket science. Basically don’t use the data for anything else (volunteers side hustles etc.) and don’t lose it. So don’t print stuff out and leave it around, password protect devices and spreadsheets.
What’s your role in the charity?

Here’s a free template to use if you don’t have one and also gives you an overview - https://www.lambethhubs.com/resources/data-protection-policy-template/

A password protected spreadsheet on a computer would be fine for this, I don’t think you need to go to the trouble of a separate device or anything. Just make sure you BCC everyone!

Thankyou!
My role is as a new volunteer helping with selection and packing of items for users of our service. However, there is an administrative role that the charity is trying to recruit for, and that entails holding contact details for people who wish to donate, or volunteer, or to receive monthly updates via a future newsletter (yet to be drafted).
I can relay this information to the manager and let them consider all the factors, and how to proceed.

You would need to have a retention policy and delete the data after that time. Also an access control policy and make sure only authorised users can access it (ideally audited but that could be a CCTV camera)
Retention policies can be complex for email lists as you can't always tell when someone has opened an email, in order to refresh the period.
If you use one of the online mail management platforms there would be a cost but they would handle the compliance for you.
I'm not sure what the options are for small businesses and charities but there must be a body for charities which could provide information on best practices, as this is a really common problem.

@johnd2 and @RiftGibbon
NCVO is a good source of support and information for charities.

https://ico.org.uk/for-organisations/advice-for-small-organisations/