Data Protection Regulations Include U.S. Not-for-Profits
Most U.S. not-for-profits have paid little attention to the
European Union's (EU's) General Data Protection Regulation
(GDPR), which took effect May 25, 2018. The GDPR revises the
standards for privacy rights, information security and compliance
in the EU. But, because the GDPR applies to all organizations
— inside and outside the EU — that access or process
data about persons in Europe, unsuspecting U.S. organizations could
fall under these requirements.
GDPR's Scope
The regulation's requirements are much stricter than any
existing U.S. privacy standards. For example, they define
"personal data" to include a wide range of personal
identifiers, including name, address, Social Security or
identification number, email addresses, location data and online
identifiers such as cookies or IP addresses. With such a broad
definition, odds are that your organization collects at least some
data subject to the rules.
