Between the membership file, volunteer lists, parental consent forms and donor details, a neighbourhood association handles information every week that an attacker would know exactly how to monetise. The good news is that data protection for an association requires neither an IT budget nor an in-house expert: a few good habits and a tool designed for the job are enough to make a real difference.
Why associations attract cybercriminals
It is tempting to imagine that attackers only go after banks, hospitals and large corporations. The reality is more mundane: they go wherever the door is least securely locked. France has around 1.5 million active associations, and a large majority of them still run on a shared email inbox, a group on a consumer messaging app and a spreadsheet that is passed from one volunteer to the next. In other words, organisations rich in personal data, with very few barriers standing in the way of anyone who wants to reach it.
Cybermois 2026, the French edition of European Cyber Security Month led by Cybermalveillance.gouv.fr, explicitly targets associations alongside citizens, businesses and local authorities. This is no coincidence: an association can have its funds diverted by a fraudulent bank transfer, lose access to its membership file after a ransomware attack, or simply see its members’ contact details leak because a sharing link was left lying around in a conversation open to all. In each of these cases, what is at stake is the trust of members and the continuity of the association’s work, far more than a technical problem.
What you really hold on your members
Take five minutes to list what passes through your association. You will probably find names, postal addresses, phone numbers and email addresses, dates of birth, bank details for membership direct debits, medical certificates for sporting activities, parental consent forms and photos of children for youth activities, tax receipts for donors, and sometimes information about the social circumstances of the people you support. Under the GDPR, several of these categories count as sensitive data, and an association that processes them has the same obligations as a business: notifying the CNIL, the French data protection authority, within 72 hours in the event of a breach, restricting access to those who genuinely need it, and being able to say where the data is hosted.
Hosting is precisely the question most often overlooked. A file listing minors uploaded to an American storage service, or a volunteer list shared in a messaging app whose business model relies on exploiting data, raises problems that the volunteer who set up the group had no reason to anticipate. We set out these dependencies in our article on the European Cloud Sovereignty Framework: the same mechanisms apply, on a smaller scale, to any association.
The habits that matter, without the jargon
ANSSI, France’s national cybersecurity agency, has launched a free, entirely online service, MesServicesCyber, designed for small organisations and therefore for associations. It includes a maturity test that takes just a few minutes, a getting-started pathway with a dozen practical measures, and the option of an hour-long session with a volunteer cyber adviser to bring the committee and the board on board. For associations that are already highly digitalised, a full pathway of around sixty measures takes over from there.
If we had to sum up the essentials for an association, they would come down to a handful of habits. A different password for each service, kept in a password manager rather than in a notebook or a text file. Two-factor authentication switched on wherever it is available, starting with email and online banking. A phone call to the usual number before acting on any request, sent by email, to change bank details, however legitimate the message may seem. Regular backups of the membership file, stored somewhere other than the computer used every day. And above all, a simple rule on who can access what: the treasurer does not need the medical certificates, and the youth leader does not need the bank details.
This last point is often the one that makes the difference, and it depends less on individual vigilance than on the tool you choose. A consumer messaging group cannot tell the difference between a committee member and a volunteer who joined yesterday. This is where the platform you work on becomes a security issue in its own right, as we explained when presenting Whaller’s partitioned spheres in “5 lesser-known Whaller features to optimise your teamwork”.
What Whaller brings to an association
Whaller was designed from the outset as a private, partitioned space, which is exactly what an association needs. Each committee, each local branch and each project has its own sphere, with its own members and files, so information never gets mixed up. The committee talks among itself, youth leaders have their own space, and volunteers for a one-off event are invited for as long as needed and then removed. Reference documents such as the constitution, minutes of general meetings and practical guides are centralised in file management rather than scattered across email attachments.
Data is hosted in France, with OVHcloud, beyond the reach of extraterritorial laws, and Whaller neither exploits nor sells it: this has been a founding principle of the platform since 2013, now recognised by the Numérique France Garanti label. Associations that wish to go further can use end-to-end encrypted spheres for their most sensitive exchanges, for example in social support work.
Day to day, the member directory replaces the spreadsheet doing the rounds, forms handle registrations without re-keying, votes and polls for the general meeting take place in a secure environment, and Whaller (AI)ssistant, powered by Mistral AI and open-source models hosted on OVHcloud, produces meeting minutes without your discussions ever leaving French soil. For federations, the organisation tree allows each branch to keep its own life while sharing national information, as the Hauts-de-Seine Tennis Committee explains with C’Tennis.
Good to know
Whaller’s Standard plan is free for up to 100 members. A small association can therefore move away from consumer tools without spending a penny, and then grow at its own pace, all the way up to Whaller ARENA for very large networks.
Cyber Security Month, a good reason to take stock
Make the most of October to put cybersecurity on the agenda of your next committee meeting. Take the MesServicesCyber maturity test, list the data you hold and the people who can access it, then ask yourself whether the tool you use today can genuinely protect what your members entrust to you. Throughout the month, Whaller is publishing its cybersecurity A to Z (in French) every day on LinkedIn and X, a short format to share with your volunteers.
0 Comments