In my not-so-copious free time, I help maintain the online back-end for a membership organization (about 1500 members). I've found little guidance on GDPR for a volunteer-based membership organization, but have managed to piece a good bit together. I was feeling pretty good about the work done versus compliance, hand-wringing from other officers notwithstanding, e.g. if we delete old member records, someone might rejoin and get a different member number, and what if they wanted to keep the original?

Now, though I'm wondering about the discussion e-mail lists we have and if we need to auto-prune archives. They have folks' real names and such in them, after all, from participating in discussion.

(I also wonder how this affects big email lists, e.g. linux-kernel)