GDPR in task distribution: Only share what the helper needs.
A practical task can quickly contain member information. Limit access and descriptions to what the volunteer actually needs.
Published August 27, 2026 · Hjerterum
An assignment may sound innocent: "Call those who have not paid" or "Make a list of children without registration". But as soon as names, contact information, payment or other circumstances can be linked to people, the association works with personal data.
This does not mean that volunteers should never help. It means that the association must know why the information is used, who needs it, and how it can be removed again.
Describe the action without unnecessary personal data.
An open task list should say "Check in for Team A" instead of showing the names of the affected members. The person taking on the task can access the details in the system they belong to — if the role requires it.
Avoid including health information, conflict notes, payment details, and child information in regular job descriptions. A link to a protected workspace is better than copying data across multiple locations.
Grant access by role and period
A volunteer at one event doesn't need the entire membership list. The bartender doesn't need the board's documents. Grant them the minimum access necessary to still perform the task and remove them when the role ends.
Keep a single overview of which groups can see what. At the end of the season, the association should check whether former coaches, committees, or assistants still have access to things they no longer use.
Think purpose before tool
The Danish Data Protection Authority recommends that small associations ask why they have an information and whether there is a legal basis for it. That question should come before the desire to register "just in case".
If the purpose is only to know that an assignment has been completed, a member's name may not be necessary at all. If the purpose requires information, the association must also inform the registered members and have appropriate security and deletion procedures.
Make deletion a final assignment.
When a temporary list or export is no longer needed, it should not remain in a private download folder. Incorporate cleanup into your workflow: confirm the result, only save the necessary data in the main system, and securely delete the working copy.
In Hjerterum Forening, the task can be assigned to a specific group so that it is not visible to all members. Do not still enter more personal information than necessary. Hjerterum is a task management tool, not a replacement for the association's membership or journal system.