Removing a former member's details — what associations must do

Open your club's member list and scroll to the bottom. Somewhere down there is a family who left in 2019. You still have their address, two mobile numbers, an emergency contact, possibly a medical note, and the name of a child who is now old enough to drive. Nobody decided to keep any of it. It simply stayed.

Most committees assume that is harmless, or at worst untidy. It is neither. Keeping a former member's personal details is a live obligation in at least one state, an unnecessary risk everywhere else, and the single easiest privacy improvement a club can make in an afternoon.

General information only. This article is general information for community clubs, not legal advice, and it does not make your club compliant with anything. Incorporated associations are regulated state by state, the rules differ, and they change. Check the current requirements with your own regulator — Consumer Affairs Victoria, NSW Fair Trading, Queensland Office of Fair Trading, Consumer and Business Services SA, WA Consumer Protection, Consumer, Building and Occupational Services Tasmania, Access Canberra or Licensing NT — and read your own rules, which may say more than the legislation does.

The Victorian rule, stated plainly

Consumer Affairs Victoria sets out what an incorporated association's register of members must contain and what happens when membership ends. While someone is a member, the register must contain their name and address, their class of membership if the association has classes (voting or non-voting, for example), and the date they became a member.

When a person stops being a member, two things must happen within 14 days:

1. Record the date they stopped being a member in the register.
2. Remove all information about that person from the register — everything except their name and the date they stopped being a member.

Read the second one carefully, because it is more specific than the summary most clubs pass around. It is not "delete the person". The register keeps a name and a leaving date, which is what lets the association show who was a member and when. What goes is everything else: the address, the contact details, the class of membership, whatever else has accumulated in the row over the years.

Fourteen days is a short clock for a volunteer committee that meets monthly, which is the real argument for making this a routine rather than a project.

What the rule does not reach

This is where clubs go wrong in the other direction, and enthusiastic deletion is worse than doing nothing.

The obligation is about the register of members — a specific document that associations legislation defines. It is not an instruction to erase every trace of a person from the club. Several other records have their own reasons to exist, and some of them exist precisely because somebody may need them years later:

• Financial records. Payments, receipts, invoices and the accounts they roll up into have their own retention requirements. Ask your treasurer or accountant what applies to your club; do not shorten them because a member left.
• Incident reports. An injury register is the document that answers questions from an insurer or a governing body long after everyone involved has moved on.
• Signed waivers and consents. These are point-in-time records of what a specific named person agreed to on a specific date. Their whole value is that they cannot be edited afterwards.
• Minutes of meetings that were actually held. Who moved a motion and who seconded it is part of the association's corporate record.
• Child safety and complaint records, which follow their own regime entirely and are almost never candidates for quiet deletion.

The workable mental model: the register is a live directory, the others are historical records. A directory should not contain people who left. A historical record is supposed to.

Everywhere else in the country

Every state and territory runs its own associations regime, and the detail differs: what the register must contain, who may inspect it, how long records are kept, and what happens when membership ends. Some are prescriptive, some leave more to the association's own rules, and a handful of clubs are not incorporated associations at all — they are companies limited by guarantee, co-operatives, or unincorporated groups operating under a governing body's umbrella, each with a different rulebook again.

So do not port Victoria's fourteen days into your policy as though it were a national rule. Do the opposite: look up what your own regulator requires, write that into your own procedure, and put the reference beside it so the next secretary can check it without repeating your research.

Your own rules matter too, and clubs forget this. A constitution or set of rules often says more about the register than the legislation does, and it binds you either way.

Privacy sits on top, and points the same way

Separately from associations law, privacy obligations push towards the same conclusion: do not hold personal information you no longer need, and do not hold it where more people than necessary can see it. Exactly which privacy rules reach your club depends on its size and what it does — our club privacy policy template covers that ground, including the circumstances in which a small club stops being able to rely on assumptions about its size.

For this guide, the practical version is simpler than the law. Ask two questions about every field you are holding on a former member:

1. What would we use this for? If there is no answer that survives a follow-up question, it should not be there.
2. Who can see it? If the answer is "anyone with a login", that is its own problem, whatever the retention period.

The copies problem, which is the real one

The register is the easy part. The hard part is that a club's member data is rarely in one place. Before you can honestly say you have removed a former member's details, somebody has to know where those details live.

The usual inventory:

• the membership system or roster;
• a committee spreadsheet on somebody's laptop or in a shared drive;
• the email marketing list, which nobody has pruned since the last secretary;
• team chat groups, which often contain phone numbers;
• a coach's phone, with contacts entered by hand;
• the shop or ticketing system, with delivery addresses;
• printed forms in a filing cabinet in the clubrooms;
• an old website with a committee page listing names and mobile numbers.

A club that keeps one authoritative member record has a small job. A club with nine copies has nine jobs, and will do about three of them. That is the strongest practical argument for consolidating before you worry about retention policy at all — you cannot manage what you cannot enumerate.

The leaving checklist

Make this a routine that runs whenever a membership ends — resignation, non-renewal, or removal under your rules. Give it to one role, not one person.

• Record the date membership ended in the register, against their name.
• Remove the other register fields for that person within the time your own rules and regulator require.
• Remove them from the mailing list, unless they have separately asked to keep receiving club news as a non-member — and record that they asked.
• Remove them from team chats and group messages, which is the step most often missed.
• Remove access to any club systems, shared drives or admin accounts.
• Deal with the credentials — if they held a working with children check or coaching accreditation linked to your club, unlink it in the regulator's system as well as in your own register.
• Leave the historical records alone: finance, incidents, waivers, minutes.
• Check the website for committee pages, team lists and photo galleries naming them.
• Note anything deliberately retained and why, in one line, so the next committee understands the decision.
• Do the same sweep in bulk once a season, because individual departures are always noticed less than they should be.

Keep the history, drop the person

Clubs resist all of this for a good reason: history matters. Premiership teams, life members, honour boards, the person who ran the canteen for eleven years — none of that should evaporate because somebody stopped paying subs.

It does not have to. The distinction is between the club's story, which is public and about achievements, and the club's directory, which is private and about contact details. A premiership team list is a name and a year. An honour board is a name. Neither needs a phone number, an address, an emergency contact or a date of birth.

The same thinking applies inside the systems. Where a record must survive for a legitimate reason, the answer is usually to strip the personal detail rather than destroy the record.

Doing this in ClubHelix

Consolidation first: members live in one record with role-based access, so contact details, emergency contacts and anything sensitive are visible to the roles that need them rather than to everybody with a login. The roles and permissions model is what makes "who can see this" a setting rather than a hope, and the audit log records the administrative actions taken on those records.

When a person's data must actually go, an account erasure runs as a scheduled anonymisation that clears personal fields — contact details, emergency contacts, medical notes, date of birth — and reports anything left behind, rather than leaving it to somebody remembering every table. The carve-outs are deliberate and worth knowing: waiver acceptances, incident report names and the mover and seconder recorded on a motion keep their name snapshots, because those are point-in-time legal records and a register that quietly rewrites itself is no register at all.

Clubs can also export their own member data as CSV, which matters more than it sounds: a club that can get its data out is a club that can audit what it holds. More on how we handle all of this is on the security page.

Frequently asked questions

How long does an association have to remove a former member's details?

In Victoria the rule is explicit: within 14 days of someone ceasing to be a member, the association must record the date they stopped being a member and remove all other information about that person from the register, keeping only their name and that date. Other states and territories have their own associations legislation, so check your own regulator rather than assuming the same clock applies — and check your club's own rules, which may say more than the legislation does.

Does that mean we delete everything about them?

No, and this is the most common misreading. The obligation is about the register of members. Financial records, incident reports, signed waivers, complaint records and the minutes of meetings that were held all have their own reasons to exist and their own retention expectations. Keep the historical records; clear the directory.

What about the team chat and the mailing list?

They are copies of the same personal information, so they belong on the leaving checklist. The mailing list is the one that generates complaints — a former member who keeps receiving club emails two years after leaving has a fair grievance, and it is trivially avoidable. Team chats are the one that gets missed, because nobody owns them.

Can we keep a former member's contact details so we can invite them back?

Only with a clear basis for doing so, and never by default. A club that wants to run win-back campaigns should ask people at the point of leaving whether they would like to stay on the news list, record the answer, and honour it. That is a much better campaign anyway — see how to win back lapsed members — and it keeps the club's list made of people who want to hear from it.

What should we do about the spreadsheets on volunteers' laptops?

Treat them as the risk they are. Get member data into one system with proper access controls, agree that exports are for a specific task and deleted afterwards, and make it part of every handover that departing office-holders confirm what they still hold. A club cannot honour a retention rule it cannot enforce, and it cannot enforce anything on a file it does not know exists.

---

Keep member records in one place, with access by role and an audit trail, using ClubHelix. Next: the club privacy policy template and moving member data between systems.