Members Site Builder

Member directory privacy: what to show publicly, what to keep for members (2026)

A field-by-field guide to deciding what an association or business directory shows the public, what stays members-only, and what only admins see, with GDPR basics and protection against scraping.

Floot ·

Key Takeaways

  • Decide visibility per field, not per directory. Give every field one of three settings: public, members-only or admin-only. A directory that is either fully public or fully private forces a bad compromise.
  • Businesses and people need different defaults. A business listing exists to be found, so most of it can be public. An individual’s profile should default to name, organisation and role in public, with contact details for members only.
  • Under GDPR, show only what the purpose needs. Article 5 requires personal data to be limited to what is necessary. If a field doesn’t help members find or contact each other, it doesn’t belong in the directory.
  • Some memberships are sensitive by themselves. GDPR treats trade union membership, and data revealing religious or political beliefs, as special category data. A public list of members of such a body needs explicit care and usually consent.
  • Let members hide, and stop bulk copying. Offer a one-click way to leave the directory, use contact forms instead of printed email addresses, and don’t give members a bulk export of other members.

Quick-Start Prioritization Framework

FieldIndividual memberBusiness listing
Name / business namePublicPublic
Organisation, job title, categoryPublicPublic
Work email or phoneMembers-only (or contact form)Public if it is the business’s main line
Personal mobile, home addressAdmin-onlyAdmin-only unless it is the trading address and the owner agrees
Photo or logoMember’s choicePublic
Membership level, join dateMembers-onlyPublic if it is a selling point (e.g. “Gold member”)
Dues status, payments, date of birthAdmin-onlyAdmin-only

A member directory is often the most used part of an association’s website, and the part most likely to cause a complaint. Networking is the top reason people join associations, so members want to be found. They don’t want their mobile number scraped by a recruiter or their home address on a public page. This guide gives you sensible defaults for each field, explains the privacy rules that most often apply, and covers the practical protections that stop a directory turning into a spam list. It is general information, not legal advice.

Why the directory is a privacy decision

Associations exist to connect people. In Marketing General Incorporated’s 2024 benchmarking survey of associations, networking with others in the field was the top reason members join (67%). A directory is the simplest way to deliver that benefit, which is why almost every association has one.

But the same list that helps a member find a peer also helps a cold-caller, a recruiter or a scammer who wants a ready-made list of professionals. Once a field is public it can be copied in seconds and you can’t take it back. So the question for each field is not “is this useful?” but “who needs it, and what is the worst thing that happens if the wrong person sees it?”

Three visibility levels that cover almost everything

Most good directories use the same three levels. Set them as defaults, then decide which ones a member may change for their own profile.

LevelWho sees itUse it for
PublicAnyone on the web, including search enginesWhat a member wants new clients or contacts to find: name, organisation, category, region, website
Members-onlyLogged-in members in good standingWhat helps members reach each other: work email, direct phone, LinkedIn, areas of expertise
Admin-onlyStaff and named volunteersWhat the association needs to run: home address, personal mobile, date of birth, dues and payment history, notes

Members-only still means “shared”

Members-only is not private. A directory with 2,000 members means 2,000 people can see the field, and any of them can copy it. Treat members-only as “shared with colleagues”, and keep anything a member wouldn’t hand to a stranger at a conference in admin-only.

Admin-only should be small too

Admin-only fields should still have a reason to exist. If nobody uses a member’s date of birth, stop collecting it. GDPR’s data minimisation principle in Article 5 says personal data must be adequate, relevant and limited to what is necessary for the purpose.

Business listings versus individual profiles

Chambers, business associations and local directories list businesses. Professional associations list people. The defaults are very different.

Business listings

A listing exists to bring the business customers, so name, category, description, trading address, opening hours, website and main phone number are normally public. Members of a chamber often join partly for that visibility.

The exception is the sole trader or home-based business, where the “business address” is someone’s home and the “business phone” is their mobile. Ask during sign-up whether the address is a public trading address or a home address, and default home addresses to show only the town or area.

Individual profiles

For people, start narrow: name, employer, job title, region and areas of expertise in public, if the association wants a public “find a professional” page at all. Many professional networks keep the whole people directory behind the login and publish only a count (“1,200 members in 14 regions”).

Contact details go members-only, ideally through a contact form so the member’s address is never shown. Photos should be the member’s choice, not a default.

Staff of member companies

Where a company is the member, its employees often get logins. Decide whether the public company listing shows its staff. A sensible rule is to show the named main contact and let each employee opt in to appearing.

The privacy rules that usually apply

This section summarises rules that commonly affect association directories. Laws vary by country and change; check with an adviser for your situation. This is general information, not legal advice.

GDPR and UK GDPR: lawful basis

If you have members in the EU or UK, you need a lawful basis under Article 6 for each use of their data. Listing members in a members-only directory can often rest on the membership contract or on legitimate interests, because connecting members is what the association is for. Publishing personal details on the open web is harder to justify that way, and many associations use consent for public profiles.

The UK Information Commissioner’s Office describes legitimate interests as a three-part test: identify a legitimate purpose, show the processing is necessary for it, and balance it against the person’s interests, rights and freedoms. Writing that assessment down for your directory is a short exercise worth doing.

Special category data

Article 9 of GDPR gives extra protection to data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health and sexual orientation. For some bodies, membership itself reveals one of these: a trade union, a faith-based professional network, a political association, a patient group.

Article 9(2)(d) lets not-for-profit bodies with a political, philosophical, religious or trade union aim process their members’ data for their legitimate activities, with safeguards, but only if the data is not disclosed outside the body without the members’ consent. In practice, a public directory for such a body should be opt-in.

The right to object and to leave

Under Article 21, people can object to processing based on legitimate interests, and can object to direct marketing at any time. Build the directory so a member can remove their own listing immediately, without emailing anyone. Under the storage limitation principle in Article 5, don’t keep a lapsed member’s profile visible indefinitely either.

Outside Europe

Many other countries and US states have their own privacy laws with different thresholds and exemptions, some of which exclude non-profits. Whatever law applies, your published privacy notice is a promise. If it says contact details are only shared with members, the directory must match it.

Giving members control

Clear defaults plus member control resolves most complaints before they happen.

Ask at sign-up, briefly

On the join form, show a short preview of how the listing will appear and two or three choices: show me in the public directory, show me in the members directory, or don’t list me. Pre-tick only what your privacy notice and lawful basis support.

Per-field overrides

Let members make a field more private than the default, but not more public than the association allows. Directory products commonly work this way. Novi AMS’s help centre, for example, describes member-level options to hide a member from the website entirely, hide contact information, or hide the address, and says those settings override the broader directory settings.

Imported members

When you move an existing list into a new directory, don’t publish everyone overnight. Import them with the most private reasonable setting, then email members to check their listing and choose their visibility. Expect a good share to stay hidden unless asked; a reminder and a preview of the listing usually helps.

Stopping scraping and spam

A directory is a list of people with something to sell or something to buy. Assume someone will try to copy it.

  • Use a contact form instead of printing email addresses, and limit how many messages one account can send per day.
  • Show members-only fields only to logged-in members whose dues are current.
  • Show search results in pages of 20 to 50, not one long list, and rate-limit searches per account.
  • Don’t give members an “export all” button; keep CSV export for admins.
  • Add a challenge such as reCAPTCHA in front of revealed contact details if your directory is public. Novi, for example, documents showing emails behind reCAPTCHA.
  • Tell members how to report misuse, and suspend accounts that harvest contacts.

Special cases

A few situations come up often enough to plan for.

Lapsed members

When a member lapses, hide their listing from the public and members directories but keep the record so renewing restores it. Decide how long you keep a lapsed record before deleting or anonymising it, and write that into your retention policy.

Students and young members

Student members may be under 18 in some fields. Keep student profiles members-only or unlisted by default, and never show their age or school publicly.

Event attendee lists

Publishing who is attending an event is a separate decision from the directory. Ask attendees at registration rather than assuming that a public directory listing means they’re happy to appear on every attendee list.

Search engines

Public business listings benefit from being indexed. Individual profiles usually don’t need to be. If you have public people profiles, consider asking search engines not to index them, so a member’s name search doesn’t lead with your directory.

Common mistakes

These are the problems that most often lead to complaints or awkward board meetings.

  • Making the whole directory public because the business listings need to be.
  • Printing personal mobile numbers and home addresses for sole traders.
  • Importing an old member spreadsheet and publishing everyone without asking.
  • Treating “members-only” as private and putting sensitive data there.
  • No self-service way to leave the directory, so removal requests sit in an inbox.
  • Letting members export the full directory to CSV.
  • Keeping lapsed members visible for years after they stopped paying.

Frequently Asked Questions

Should a member directory be public or private?

Usually both. Make business listings and basic professional details public if that helps members get work, and keep contact details members-only. Decide per field rather than for the whole directory.

Do we need members’ consent to list them in a directory?

It depends on where your members are and what you publish. Under GDPR, a members-only directory can often rely on the membership contract or legitimate interests, while public profiles are commonly based on consent. Associations whose membership reveals sensitive information, such as trade union or religious affiliation, should treat any listing outside the body as needing consent. This is general information, not legal advice.

What contact details are safe to show?

For businesses, the main business phone, website and trading address. For individuals, show contact details to logged-in members only, ideally through a contact form so the email address is never displayed.

How do we stop our directory being scraped?

Require login for anything beyond basic public listings, use contact forms instead of printed emails, page and rate-limit search results, and keep bulk export for admins only.

What should happen to a lapsed member’s listing?

Hide it from public and member views straight away, keep the record so renewal restores it, and delete or anonymise it after the retention period your policy sets.

Can I build a directory with these privacy rules myself?

If you’d rather not configure an off-the-shelf directory, Floot is an AI app builder where you describe the fields and who can see each one, and it builds the member logins, roles and directory with its own database. It is free to start.

Sources