> The problem is that it applies to small organisations, even non-profits, that do not trade that information which is proportionately a much bigger burden.

Eh?

Collect only the personal data you need (with permission) and keep it secure. Such a basic responsibility to your members privacy and safety is hardly a burden.