Answers.Body: <p>There is no individual resource as such that holds the answers to your question. There are currently still a significant amount of unknowns surrounding GDPR. Some of your issues can be resolved technically. By hosting your systems and data in a country like Switzerland which already has a so called "adequacy decision" with the EU and the US. Swiss law by default already sets the benchmark higher for privacy. But there are a number of things you have to do as a bare minimum: Data inventory. KNOW where your data is. HOW is that data used; domestic or commercial data processing? Be able to show how you are using the data and be able proof that that IS how you are using the data. The most important thing is that you are able to show you are TRYING to comply first and foremost. Secondly have a data-breach coping mechanism in place that ensures timely reporting to the correct authority. Hope this is helpful.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-08-14T13:24:37.723Z
Answers.LastActivityDate: 2017-08-15T02:21:49.673Z
Answers.LastEditDate: 2017-08-15T02:21:49.673Z
Answers.UserDisplayName: remco
Answers.Body: <p>While this is only a partial answer to your question, it's worth checking out the CiviCRM GDPR extension, detailed <a href="https://civicrm.org/blog/parvez/gdpr-and-civicrm" rel="nofollow noreferrer">on the CiviCRM blog</a>.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-08T06:09:28.933Z
Answers.LastActivityDate: 2018-02-08T06:09:28.933Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>In our relatively small UK based charity, our CiviCRM database holds personal data of members, donors, event attendees and volunteers from around the UK, Europe, USA and other countries around the world.</p>
  
  <p>Our trained volunteers manage our CRM database by logging on to CiviCRM in the UK, India, USA and other countries around the world.</p>
  
  <p>Could you point me to any suitable resources to determine how an <strong>internationally serving and operating organisation</strong> that holds personal data on people from multiple countries and operates in multiple countries can <strong>get ready for the General Data Protection Regulation (GDPR)</strong> which is coming into effect on 25 May 2018?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-29T12:31:04.057Z
Comments.Text: Great question. USA don't have (federal) privacy laws. For EU, certification and code of conducts are seemingly the [best advice](https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection/reform/rules-business-and-organisations/obligations/compliance/how-can-i-demonstrate-my-organisation-compliant-gdpr_en) currently given. Some [GDPR principles](https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection/reform/rules-business-and-organisations/principles-gdpr_en) are rather simple. You could skim them and report CiviCRM bugs for each dubious one.
Comments.UserDisplayName: Nemo
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-29T14:45:46.893Z
Comments.Text: Maybe the Commission has answers... https://twitter.com/nemobis/status/957988391513141249
Comments.UserDisplayName: Nemo
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-04-11T23:59:03.973Z
Comments.Text: It's my understanding that the GDPR is connected to the EU individual no matter where they live. So they may be a resident of the EU and live in the USA.
Comments.UserDisplayName: Danielle Siembieda
Tags: <security><gdpr><privacy>
Title: GDPR and CiviCRM for a small but internationally operating and serving organisation
ThreadText: # GDPR and CiviCRM for a small but internationally operating and serving organisation
  
  (Asked by: username_0 on 2017-08-11)
  
  In our relatively small UK based charity, our CiviCRM database holds personal data of members, donors, event attendees and volunteers from around the UK, Europe, USA and other countries around the world.
  
  Our trained volunteers manage our CRM database by logging on to CiviCRM in the UK, India, USA and other countries around the world.
  
  Could you point me to any suitable resources to determine how an **internationally serving and operating organisation** that holds personal data on people from multiple countries and operates in multiple countries can **get ready for the General Data Protection Regulation (GDPR)** which is coming into effect on 25 May 2018?
  
  **Tags:** security, gdpr, privacy
  
  > **Comments:**
  > **username_1**: Great question. USA don't have (federal) privacy laws. For EU, certification and code of conducts are seemingly the [best advice](https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection/reform/rules-business-and-organisations/obligations/compliance/how-can-i-demonstrate-my-organisation-compliant-gdpr_en) currently given. Some [GDPR principles](https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection/reform/rules-business-and-organisations/principles-gdpr_en) are rather simple. You could skim them and report CiviCRM bugs for each dubious one.  
  > **username_1**: Maybe the Commission has answers... https://twitter.com/nemobis/status/957988391513141249  
  > **username_2**: It's my understanding that the GDPR is connected to the EU individual no matter where they live. So they may be a resident of the EU and live in the USA.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_3 on 2017-08-14. Score: 3
  
  There is no individual resource as such that holds the answers to your question. There are currently still a significant amount of unknowns surrounding GDPR. Some of your issues can be resolved technically. By hosting your systems and data in a country like Switzerland which already has a so called "adequacy decision" with the EU and the US. Swiss law by default already sets the benchmark higher for privacy. But there are a number of things you have to do as a bare minimum: Data inventory. KNOW where your data is. HOW is that data used; domestic or commercial data processing? Be able to show how you are using the data and be able proof that that IS how you are using the data. The most important thing is that you are able to show you are TRYING to comply first and foremost. Secondly have a data-breach coping mechanism in place that ensures timely reporting to the correct authority. Hope this is helpful.
  
  
  ---
  
  ### Answer by username_4 on 2018-02-08. Score: 2
  
  While this is only a partial answer to your question, it's worth checking out the CiviCRM GDPR extension, detailed [on the CiviCRM blog](https://civicrm.org/blog/parvez/gdpr-and-civicrm).
  
  
  ---
  
  