GDPR for charities: a practical UK guide for trustees and staff

Charities are subject to UK GDPR and the Data Protection Act 2018 in exactly the same way as businesses. There is no charitable exemption from the law. What makes charities different is the mix of data they hold, which is often sensitive, the reliance on volunteers, the specific rules around fundraising, and the fact that legal accountability sits with a board of volunteer trustees. This guide explains what that means in practice.

The data charities hold

Most charities process three overlapping groups of personal data:

Group	Typical data	Why it needs care
Beneficiaries	Names, contact details, health conditions, disabilities, safeguarding concerns, immigration status, criminal records	Much of this is special category data and needs a specific condition as well as a lawful basis
Supporters and donors	Contact details, giving history, Gift Aid declarations, communication preferences, sometimes wealth information	Fundraising rules under UK GDPR and PECR apply, and this is where most complaints start
Staff and volunteers	HR and recruitment data, DBS checks, emergency contacts, training records	Volunteers are often outside HR processes but need the same protections

The first step for any charity is to know what it holds. A record of processing activities (RoPA) is required for most charities and is the foundation for everything else.

Lawful bases and special category conditions

Every use of personal data needs a lawful basis. For charities the common ones are:

• Consent, for marketing by email and text, and where nothing else fits.
• Legitimate interests, for many operational uses and for postal fundraising, provided you have assessed and documented the balance with the individual’s interests.
• Contract, for services you provide to beneficiaries under an agreement.
• Legal obligation, for Gift Aid records, safeguarding reporting and employment law.
• Public task applies only where a charity is carrying out a function set out in law, which is rarer than people assume.

Where the data is special category, you also need a condition from Article 9 or Schedule 1 of the Data Protection Act 2018. For beneficiary health and care data that is usually the provision of health or social care; for safeguarding there is a specific condition; for some sensitive support work it is explicit consent. Record which condition you rely on and why.

Fundraising, marketing and PECR

Fundraising is the area where charities most often get into difficulty with the ICO, and the rules are layered:

• Direct mail fundraising can generally rely on legitimate interests. You must tell people in your privacy notice, offer an easy opt-out and honour it.
• Email and text marketing falls under the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR. For most charities this has meant consent. The Data (Use and Access) Act 2025 extends the “soft opt-in”, which lets organisations email existing customers about similar products, to charities contacting people who have previously supported or expressed interest in their charitable purposes. Check current ICO guidance on the conditions and timing before relying on it.
• Telephone fundraising must respect the Telephone Preference Service and PECR rules on live and automated calls.
• Wealth screening, profiling and data appending need a lawful basis, clear transparency in your privacy notice and often a DPIA. The ICO has fined charities for doing this without telling supporters.
• The Fundraising Regulator’s Code of Fundraising Practice applies alongside the law, and the Fundraising Preference Service lets people stop contact from named charities.

Write down your fundraising data practices once, agree them with trustees and reflect them in your privacy notice. Doing that avoids relitigating the rules every campaign.

The ICO fee and registration

Almost every charity that processes personal data electronically must pay the annual data protection fee to the ICO. Charities pay the lowest tier regardless of size, which is a small annual amount. A narrow exemption exists for not-for-profit bodies that process personal data only for membership or support purposes and do not disclose it; most charities that hold beneficiary data do not qualify. Use the ICO’s online fee self-assessment and keep the result. Our guide to ICO registration explains the process.

Do charities need a DPO?

Charities are not public authorities, so a Data Protection Officer is not automatic. It becomes mandatory where your core activities involve large-scale processing of special category data, or large-scale systematic monitoring. A charity supporting people with health conditions, disabilities or safeguarding needs can meet that test, and many charities that do not still appoint a DPO voluntarily because funders and trustees expect clear accountability. If you appoint one, the legal requirements on independence and reporting apply in full. Our guide Do you need a DPO? explains the test, and our outsourced DPO for charities page explains the outsourced option.

Volunteers

Volunteers who handle personal data need the same basics as staff: a short data protection induction, access limited to what their role needs, a clear route to report a mistake, and a record that these steps happened. Because volunteers change more often than employees, keep the process light enough to run every time. Our guide to staff data protection training applies equally to volunteers.

Sharing data with other organisations

Charities routinely share data with local authorities, the NHS, schools, other charities, funders and commissioners. Each flow needs a lawful basis, a purpose and, where the data is sensitive, a special category condition. Regular sharing should be covered by a data sharing agreement, and reports to funders should be anonymised wherever the funder does not genuinely need identifiable data. Safeguarding sharing has its own conditions, and staff must understand that data protection is not a reason to withhold a safeguarding concern.

Individuals’ rights

Beneficiaries, supporters and ex-volunteers all have rights of access, rectification, erasure and objection. The one that causes most work is the subject access request, which must be answered within one month. Have a procedure and a named owner before the first difficult request arrives. Our SAR guide and free SAR procedure are the starting point.

Breaches

Personal data breaches must be assessed promptly and reported to the ICO within 72 hours where they are likely to result in a risk to individuals. For a charity holding beneficiary data, a lost laptop or a misdirected email can easily meet that test. Serious incidents may also need reporting to the Charity Commission as a serious incident report. Keep a breach log even for incidents you decide not to report. See our guide to data breach reporting.

What trustees are accountable for

Under charity law, trustees are responsible for the charity’s compliance with the law, including data protection. In practice that means trustees should be able to show that the charity has: a RoPA, privacy notices, a data protection policy, a lawful basis for its fundraising, a trained workforce including volunteers, a breach procedure, a way to handle rights requests, and a named person responsible for all of it. A short annual report to the board on data protection is the simplest way to evidence that oversight.

A practical checklist

1. Build or update your RoPA.
2. Check and pay the ICO fee.
3. Decide, and record, whether you need a DPO.
4. Settle your fundraising lawful bases and update the privacy notice.
5. Put a short induction and access rules in place for volunteers.
6. Document your regular data sharing.
7. Adopt a SAR procedure and a breach procedure.
8. Report to trustees at least once a year.

How we can help

We work with charities of all sizes on proportionate data protection: a fixed-fee GDPR audit that gives trustees a clear picture, an outsourced DPO for charities where independent oversight is required or wanted, and hands-on help with DPIAs and subject access requests. Many charities combine this with Cyber Essentials to meet funder requirements. Get in touch for a free, no-obligation conversation.