The GDPR and Operational Risks of Managing 5,000 Association Members on Excel.

Where a shared register becomes several registers

Imagine an association with 5,000 members across 15 branches. Head office sends a renewal extract on Monday. A branch officer corrects a surname in their copy. Finance marks a subscription paid in another. On Friday, an administrator merges the files and discovers two rows for the same member, with different renewal statuses.

The team can fix the cells. The harder task is establishing which change was authorised, whether both rows refer to the same membership, and whether the previous decision still needs to be retained. If a former officer also has the Monday extract, correcting the central file has not corrected every copy.

This is an illustrative scenario, not a customer case study or a claim about how often spreadsheet errors occur.

Six risks and the controls to test

Use this table to review the whole process: the workbook, its storage, email attachments, exports, staff access and the handover procedure.

A managed Microsoft 365 setup can provide access controls and version history. Check what your organisation has actually configured and what happens to downloaded copies. The government’s spreadsheet guidance also recommends documenting workbooks and checking hidden data before sharing.

For branch workflows, take the access test one step further: can an officer see only the records their role permits? Hiding rows or protecting formulas does not establish that boundary. See our guide to branch submissions and central approval.

What UK GDPR asks of your organisation

Your obligations apply to the personal information and how you use it, whichever tool holds it. The ICO’s data protection principles cover lawful and transparent use, purpose, minimisation, accuracy, retention, security and accountability. Document the lawful basis and purpose for each use, and explain those uses to members.

Keep the information you need, for as long as you need it

A renewal checklist rarely needs an unrestricted explanation of a member’s health or personal circumstances. Decide which fields are necessary before collecting them. The ICO’s data minimisation guidance is a useful starting point.

There is no universal GDPR retention period for a membership register. Set and justify periods for different purposes, review them, and consider relevant legal requirements or holds before deletion. Membership ending does not automatically mean every related record must disappear that day. See the ICO’s storage limitation guidance.

Know how you would find a member’s information

Try a fictional subject access exercise: identify the central record, branch copies and decision correspondence, then decide what is relevant and what needs review before disclosure. Searching the latest workbook alone may miss information held elsewhere. The ICO’s right of access guidance explains the obligations and how to prepare.

Test security and recovery, and plan for an incident

The ICO’s security guidance calls for measures appropriate to the risk, timely restoration of access and regular testing. A backup success notification is useful evidence of a copy; a restore exercise tests whether the team can recover usable records.

If an extract goes to the wrong recipient, contain the incident, preserve the facts and assess the risk to people. Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people’s rights and freedoms. High-risk breaches also require informing affected people without undue delay. Use the ICO’s breach reporting guidance and assessment tools.

This is a practical operations guide, not an assessment of your organisation’s compliance. ICO sources were checked on 9 October 2026; consult the current guidance when making a legal decision.

A checklist for the next committee meeting

For each question, record the answer, the evidence, an owner and a next review date. An unanswered question becomes a specific action, rather than a vague instruction to “sort out GDPR”. You can print this page or share this checklist link with the committee.

1. Where is the authoritative register? Can two officers independently identify the same current version?
2. Who can see and change it? Include branch officers, contractors, shared links and people who have left.
3. Where are the copies? Account for email attachments, downloads, exports and backup locations.
4. What identifies a person and a membership? Test a leading-zero number, a changed email and someone in two branches.
5. Can we explain a renewal? Reconstruct one decision from the rule, evidence, dates, reviewer and any exception.
6. What do we retain and why? Check the schedule against actual stored data and document exceptions.
7. Can we recover and respond? Record the last restore result and who leads a breach or access request.
8. Can the next officer take over? Have a second person follow the documented process without borrowing someone else’s login.

Move without losing the record

If keeping those controls working takes more effort than the renewal itself, test a shared membership workspace. Start with fictional records, then agree a controlled migration with the people who own the source data.

1. Keep a protected source snapshot. Agree an export date, stable references and who may access the file.
2. Map and review before importing. Check names, member numbers, branches, grades and statuses. Resolve ambiguities rather than guessing.
3. Reconcile the result. Compare record counts and exceptions, including rejected rows and people with more than one membership.
4. Prove the workflow. Complete one renewal through assessment, review and issuance, then export the result.
5. Agree the cutover. Name the authoritative system, notify officers and apply the retention decision to superseded copies.

Our worked Excel-to-register guide includes a free workbook and fictional CSV so you can try the mapping and reconciliation steps.