What data a club asks you for, and what should happen to it
What documentation is usual when joining a cannabis club, what the GDPR requires of the register of members, and which practices should make you wary.
July 31, 2026
When joining a cannabis club in Spain, the usual thing is to identify yourself with a valid official document — DNI (the Spanish national identity card), NIE (the identity number issued to foreign residents) or a passport —, leave some contact details and sign the membership application together with your acceptance of the statutes. That information goes into the register of members, which in legal terms is a file of personal data subject to the General Data Protection Regulation (GDPR) and to Ley Orgánica 3/2018 (LOPDGDD, the Spanish data protection act): the association is answerable for keeping it safe, may use it only to manage your membership and must delete it once it is no longer needed. Anything outside that framework — copies of your document sent by messaging app, lists shared in group chats, requests for data that nobody explains — points to a level of management that falls short.
What documentation is asked for, and why
Joining a cannabis association rests on three elements: a valid identity document, some contact details and a signature. The document proves that you are of legal age and that the person named in the register of members really is you. The contact details make it possible to call general meetings and communicate decisions, something the law on associations requires of any entity of this kind. The signature completes acceptance of the statutes and internal rules, and it is what turns a visit into an associative relationship.
For people living in Spain the norm is the DNI or the NIE. For visitors and foreign residents, a passport or the identity document of their home country; some associations also ask for a contact address, precisely because notices have to be able to reach somewhere. On top of this, in most cases, comes an introduction by another member, a requirement explained in detail in the article on the member's sponsorship. The full route to joining, with its timescales and its scope for refusal, is described in the guide on how to become a member.
| Data | What it is used for | What handing it over does not imply |
|---|---|---|
| Valid identity document | Proving legal age and identity | That the association may keep a copy without justifying what for |
| Name and surnames | Appearing in the up-to-date list of members that the law requires | That the name is visible to the other members |
| Email address or phone number | Notices, general meetings and internal communications | Receiving advertising, or the contact being passed to third parties |
| Signature on the application and the statutes | Evidencing the wish to join and acceptance of the rules | Giving up the rights that data protection law recognises |
The register of members is a file of personal data
Ley Orgánica 1/2002, the Spanish law on the right of association, obliges every association to keep an up-to-date list of its members, as well as a minute book and orderly accounts. That list is not a decorative formality: it is the document showing that the circuit is closed and that the people entering the premises are members, not the general public. Without it, the associative construction these spaces rest on has no basis, as the page on what a cannabis club is explains.
The consequence is that the register of members has a dual nature. On one hand it is an obligation flowing from the right of association. On the other it is personal data processing in the full sense, with the association acting as the controller. And this is not trivial data: in practice, appearing in the register of a cannabis association is sensitive information, of the kind nobody would want circulating outside the entity. However it is classified in legal terms, the GDPR requires security measures proportionate to the risk, and here that risk is not theoretical. An entity that keeps the register in an open spreadsheet, with no access control and no backups, is taking on — and passing to its members — a risk it has no business taking on.
What the GDPR and the LOPDGDD require of an association
The GDPR does not distinguish between large companies and small entities when it comes to principles: they apply equally to a multinational and to an association with two hundred members. What does vary is the intensity of some formal obligations. Not every association is required to appoint a data protection officer, for example, because that requirement depends on the type and scale of the processing. Keeping a record of processing activities, by contrast, is required whenever the processing is not occasional, and a register of members hardly is.
How long they can keep your data
The short answer is: as long as it is needed for the purpose that justified collecting it, and no longer. While membership lasts, that need is obvious. When someone leaves, the logic changes and the volume of information the association may go on keeping is reduced to whatever supports obligations that outlive the relationship: keeping the accounts, evidencing fees collected, any liability arising from that period.
The LOPDGDD addresses exactly this situation with the concept of blocking. Data does not always disappear at a stroke: it may be kept in restricted form, out of ordinary use, available only for dealing with the authorities or the courts during the time in which liability may still be claimed, and deleted afterwards. It is an important difference, because it explains why an association can answer "your data has been blocked" instead of "your data has been destroyed" without being in breach of anything.
What has no cover is indefinite retention through inertia: lists of former members from years back, access records nobody reviews, or personal copies on the phone of someone on the board. The absence of a written retention criterion is, in practice, the most frequent sign that no such criterion exists.
Your rights: access, rectification and erasure
Anyone whose data appears in the register of members keeps the rights the GDPR recognises: access, to know what information is processed and for what purpose; rectification, if something is inaccurate; erasure, when the data is no longer needed; and also restriction, objection and portability. These rights are free of charge and do not depend on the relationship with the association having ended well. They should not be confused with the rights to information and to vote that the law on associations gives members as members of the entity, explained in the article on the rights and obligations of a member: they are two separate planes exercised through separate channels.
The controller is the association, not the person who handled your application. Its full name and a contact channel should appear in the information clause signed on joining, or in the statutes.
By email or on paper with proof of receipt, stating which right you are exercising and evidencing your identity. Keeping a record of sending it is what later allows you to prove the date.
An erasure request that spells out which data and from which record is far harder to leave unanswered than a general request to "delete me from everything".
One month as a general rule. If the association needs more time, it must say so and give reasons within that first month.
Silence or an unreasoned refusal opens the way to a complaint before the Agencia Española de Protección de Datos (the Spanish data protection authority), which is free and requires no lawyer or court representative.
Erasure, however, is not absolute. If the association can show that it needs to keep certain information to comply with a legal obligation or to defend itself against possible claims, it may keep it blocked for that period. What can be required is that it explains this, not that it takes it for granted.
Signs of poor practice
Some practices describe how an entity is run rather well, without any need to know the rules in depth. The most widespread is asking for a photograph of your identity document sent through a messaging app before a membership application even exists. That file ends up duplicated on the phone of whoever sent it, on the phone of whoever received it, probably in a cloud backup, and outside any control by the association. Showing a document to verify your age and handing over a digital copy that ends up replicated across several devices beyond the entity's control are not the same operation.
- Requests for photos or copies of your DNI, NIE or passport by instant messaging, unencrypted email or third-party forms.
- Member lists in documents shared by open link, or in chat groups where names and phone numbers are visible.
- Joining with no document at all informing you of who processes the data, for what and for how long.
- Requests for data unrelated to membership: place of work, social media profiles, relatives' contact details.
- Cameras recording the identification area or the interior with no notice and no explanation about how long the images are kept.
- Pressure to hand over documentation before the person has been able to see the premises, the statutes or the procedure.
The last point deserves a reading of its own. Someone who asks for documentation in the street, in advance and in exchange for quick access is not managing a membership application: they are building a database about people who do not even know which entity they are dealing with. The connection between that dynamic and other signs of irregular practice is developed in the article on how to tell a serious association apart.
Before handing over any document, the useful question is not "will they ask me for it?" but "who is the controller of this data, and where is that stated in writing?". An association with its house in order should be able to answer without looking it up, because it is set down in writing. One that improvises an answer has already said a good deal.
Differences between places show up here too: in cities under heavy tourist pressure, as described in the hub of associations by city and on the Barcelona page, hurried collection of documentation tends to go hand in hand with recruitment in the street.
Frequently asked questions
Is it compulsory to give your DNI in order to join?
Some form of official identification is, in practice: without verifying legal age and identity, the association cannot maintain that its circuit is closed or meet the legal obligation to keep an up-to-date list of members. The format is another matter: showing the document and having the necessary details noted down is not the same as handing over a copy.
Can they keep a photocopy of my document?
Only if they can explain what they need it for, on what legal basis and how long they will keep it. A copy adds risk without adding any safeguard compared with simple verification, so an association that requires one without justification is processing more data than it needs.
I am a foreigner: will my passport do?
A passport or the identity document of your home country is the usual option for anyone without a DNI or NIE. Each association sets its own requirements and may also ask for a contact address; presenting the right documentation does not in itself guarantee admission, which is exclusively a matter for the entity.
What happens to my data if the association closes down?
Dissolution does not make the obligations disappear: whoever handles the winding-up must keep the documentation for as long as liability may be claimed and delete it afterwards, with the same security safeguards. The rights of access and erasure remain exercisable while there is an identifiable controller, and a complaint to the Agencia Española de Protección de Datos remains available if nobody answers.
