Volunteers' personal data: what to ask for, what to keep
Published on September 18, 2026
A volunteer list is a file of personal data, with names, addresses, phone numbers and sometimes health information. The GDPR does not ask much of an association; it asks that you have thought about it once. The regulation itself applies across the European Union; the authority and the templates named here are those of the French framework.
The rule that sums up all the others: only ask for what you use
This is the minimisation principle, and it is the one to remember if you only remember one. Before adding a question to the sign-up form, ask yourself what you would do with the answer. Date of birth is useful if you are welcoming minors or serving alcohol; a postal address is only useful if you are sending something by post.
The sorting falls naturally into three piles:
- Essential: surname, first name, one way of making contact (email, and a phone number for the day itself).
- Useful depending on the event: date of birth, tee-shirt size, driving licence, languages spoken, availability, preferred teams.
- To avoid, absent a specific reason: national insurance number, family situation, occupation, a photograph if no badge uses it.
Health data, to be handled separately
A food allergy, a medication, a physical restriction are health data. You may have good reasons to ask for them (a meal to provide, a position to adapt), but they call for more care: collect them only if they are genuinely necessary, explain what they are for, restrict access to the people who need it, and delete them earlier than the rest.
Who is responsible for what
It is the organising association that decides which details to ask for, who has access to them and how long they are kept: it is the controller. The tool it uses to host them is its processor, and must offer it a written contract: a data processing agreement within the meaning of article 28 of the GDPR.
That is exactly the relationship described in our privacy policy, and the data processing agreement can be downloaded, pre-filled, to be filed with your own record of processing.
What to tell the volunteers, and where
A short notice on the sign-up form is enough, provided it answers the four questions the person is asking: who is collecting, what for, how long it is kept, and how to ask for a correction or an erasure. Three sentences and a contact address.
How long to keep the list
The GDPR sets no period: it asks for a period justified by the purpose. In practice, for an association running a recurring event:
- Contact details and the position held: until the next edition, plus a margin. You need them in order to re-invite, which is a legitimate purpose, and the volunteer must be able to object.
- Files supplied by the volunteers (certificates, consent forms): for the duration of the edition and of the obligations attached to it, no longer.
- Health data: for the duration of the event.
- Accounting records: according to the applicable statutory periods, independently of everything else.
Write these periods down once, apply them, and note the date of the last purge. A period written down and never applied is worse than one never written down.
Five requests you need to be able to answer
- "What data do you hold on me?": you must be able to show it to them or send it to them.
- "Correct my phone number.": changed straight away, or by the person themselves if they have an account.
- "Erase me.": deletion, subject to whatever you have to keep for other reasons, explaining which.
- "Stop writing to me.": an objection. It does not prevent you keeping the history, only the approaches.
- "Take that photograph down.": image rights are a separate matter, and one to prepare: ask permission at sign-up, and say where the photographs will be published.
The time limit for answering is one month. In an association the real difficulty is not the deadline, it is knowing who answers: name a person, and put them on the information notice.
The three most common mistakes
- The spreadsheet shared by public link. A list of two hundred volunteers readable by anyone with the address is a data breach waiting to happen. See Volunteo or a spreadsheet.
- The file that never dies, copied from year to year, with people in it who have not taken part for ten years.
- The mailing list with everyone in plain copy: two hundred email addresses sent to two hundred people, every time. Sending through the tool settles that at the same time as it makes the message readable. See emails to volunteers.
Frequently asked questions
Do you have to keep a record of processing activities?
The record is the rule, with lighter requirements for small organisations in some cases. It is useful anyway: it is the document that makes you decide, once, which data you keep and for how long. The French data protection authority publishes a simplified template.
Do you need volunteers' consent?
To manage their participation in your event, the legal basis is generally not consent but the performance of the relationship and the association's legitimate interest. Consent is required for anything beyond that: photographs, approaches about other events, messages unrelated to their participation.
Can you share the volunteer list with a partner?
Not by default. A partner running their own group needs access to their own members, not to the whole list. Access by team or by group settles that cleanly, with no file to send.