Overview
The general data-protection obligations under the EU’s GDPR (and the UK GDPR / Swiss FADP) that affect how campaigns collect, store and use supporter data.
How it works
The EU General Data Protection Regulation (2016/679) — operative since May 2018 — applies to almost every campaign that handles EU-resident personal data, regardless of where the campaign is based. Core obligations: a lawful basis for processing (usually consent or legitimate interest); clear, specific opt-in consent for marketing and political communication; data-minimisation; purpose limitation; storage limitation; the right to erasure; data-protection impact assessments for high-risk processing; a 72-hour breach notification. Most EU member states have supplementary national laws (e.g. Germany’s BDSG, France’s Loi Informatique et Libertés) [source: la-quadrature-du-net]. Tactical Tech’s holistic-security curriculum covers the data-hygiene practices that GDPR operationalises — minimisation, retention policies, breach response [source: tactical-tech]. The Amadeu Antonio Foundation and Digitalcourage both publish German-language guidance on the BDSG and on the data-protection regime specifically applicable to civil-society organisations [source: amadeu-antonio], [source: digitalcourage]. For a campaign: the consent banner and signup form design is where most GDPR risk lives. EU authorities have repeatedly fined political parties and campaigns for unlawful data processing.
When to use it
Designing a compliant signup form; assessing a campaign’s data-handling risk; responding to a subject-access request; reporting a breach.
Examples
- Chilean high school students strike, win education reform, “Penguin Revolution, — latin-america
- Internally displaced Peruvians campaign for land (Villa El Salvador Land Invasion), — latin-america
- California inmates hunger strike to end “gang member” label by prison, 2001-02 — north-america
Worked examples
- chinese-americans-protest-conviction-of-nypd-officer-peter-liang — diaspora list-building across borders raised the data-protection and consent issues GDPR addresses.
- australian-campaign-case-study-divestment-campaign-2013-2021 — student campaigns needed compliance with Australian Privacy Act (the principal analogue to GDPR) for lawful list-building.
Learn more
- On Wikipedia: GDPR fines and notices — CC BY-SA 4.0
Sources & verification
- sources/la-quadrature-du-net — grounding: secondary — RAW (2498 chars)
- sources/tactical-tech — grounding: secondary — RAW (588 chars)
- amadeu-antonio — grounding: secondary — RAW (51338 chars)
- digitalcourage — grounding: secondary — RAW (3487 chars)
Verified 2026-06-23 by llm-qc.