Why a cultivation association must document member data

Why data is required

A cultivation association must be able to establish who is a member, whether admission requirements are met and whether statutory quantity limits are observed. Member administration, contribution processing and secure organisation also require clearly attributable information.

For personal transfers, the KCanG requires strict age and membership checks using a membership card together with an official photo ID. Identity verification is therefore part of the regulated process, not merely an optional formality.

What section 26 KCanG requires

Cultivation associations must keep continuous records for traceability. For cannabis transfers, these include the member's surname, first name and year of birth, together with the amount, average THC content and date. Other records concern stocks, cultivation, destruction, propagation material and specified transport.

These statutory records must be retained for five years and transmitted electronically to the competent authority on request. Specified annual information for the previous year is also transmitted in anonymised form by 31 January. Such transmission is not publication on the internet.

• identity and membership for controlled access
• a member-linked record of each transfer
• quantity and stock data for traceability
• anonymised annual reporting for statutory evaluation

Data protection limits use and access

Even legally required data may not be used without limits. Purpose limitation, data minimisation, accuracy, storage limitation and appropriate security are core principles of the GDPR. Access rights and technical and organisational safeguards must match the risks.

The competent authority may collect and process records and data to the extent defined by law for supervision. Disclosure to other bodies is not unlimited and remains subject to legal conditions. The privacy notice is the central information source for members about purposes, legal bases, recipients and data-subject rights.

Transparency does not mean public member lists

The association's organisation, responsibilities and privacy principles should be publicly understandable. Names, individual transfer quantities and other member data do not belong on a public website or in an open directory.

AVK Club therefore separates institutional information from personal documentation. Access, rectification and privacy requests can be submitted through the contact routes stated in the privacy notice.