GDPR and member admin for an association

GDPR and member admin for an association come down to this: you may keep data you need to make someone a member, collect dues and grant access. You do not keep “everything we ever asked”, and not in a file the whole board has by email.

What purpose the list has

The purpose is the membership. Name, contact, start date, member type and the payment details the debit needs belong there. A copy of an ID or a health question usually does not, unless you have a separate reason and you explain it. If you are unsure, ask someone who knows your association. This is not legal advice for a special case.

Why a shared spreadsheet is a risk

Not because Excel is forbidden, but because copies remain when someone leaves. You no longer know which file is current, and former members stay in an attachment. A system with one list and a login per board member is easier to explain to a member who asks what you keep.

On membership management for associations that list lives in one place. You remove former members from the working list without throwing away the financial records. Those stay in your bookkeeping, where the retention period belongs.

What you can show a member

The member should be able to see their own details, pass and balance, without you emailing an export. That is also the practical answer to access requests: let the member log in, instead of searching a spreadsheet.