The General Data Protection Regulation has fundamentally altered the data governance landscape in Europe and beyond. While much of the attention around GDPR has focused on customer data and marketing practices, the regulation has profound implications for board governance that many directors have not fully considered. Board operations involve processing significant amounts of personal data — director information, employee data discussed in HR matters, customer data referenced in strategic reviews, and shareholder information managed during AGMs. Understanding how GDPR applies to these governance activities is essential for every director serving on a board with European operations or stakeholders.
Board portals and governance platforms are data processors under GDPR, handling personal information on behalf of the organization. This means boards must ensure that their technology providers meet GDPR requirements for data processing agreements, data residency, breach notification, and individual rights management. Directors should verify that their board portal provider has appropriate technical and organizational measures in place, including encryption, access controls, data minimization, and the ability to respond to data subject access requests. The selection of a governance technology platform is not merely an operational decision — it is a compliance decision with regulatory consequences.
Document retention and destruction policies take on new importance under GDPR. Board materials often contain personal data that is subject to the regulation's storage limitation principle — the requirement that personal data be kept only as long as necessary for the purpose for which it was collected. Boards must balance this requirement against corporate governance obligations that may require retaining minutes, resolutions, and other records for extended periods. A clear, documented retention policy that addresses both regulatory requirements is essential. Organizations should not simply retain everything indefinitely, nor should they destroy records that may be needed for governance or legal purposes.
The right to erasure — commonly known as the right to be forgotten — presents particular challenges for board governance. If a former director exercises their right to erasure, the organization must balance that request against legitimate governance interests in maintaining accurate historical records. GDPR provides exemptions for archiving purposes in the public interest and for the establishment, exercise, or defense of legal claims, but boards should have clear procedures in place for handling such requests rather than addressing them on an ad hoc basis. Governance teams should work with data protection officers to establish protocols that protect both individual rights and governance integrity.
Data breach notification requirements under GDPR are particularly relevant for boards because of the sensitivity of the information they handle. A breach involving board materials — strategic plans, financial projections, M&A discussions, personnel decisions — could have material consequences for the organization beyond the regulatory penalties. GDPR requires notification to supervisory authorities within seventy-two hours of becoming aware of a breach, and notification to affected individuals without undue delay in high-risk cases. Boards should ensure their governance platforms have robust breach detection and response capabilities, and that incident response plans specifically address scenarios involving board-level data.