Outsourced DPO for charities

Why charities are different

A charity’s data is unusual in two ways. First, it is often special category data: health conditions, disabilities, religious belief, sexual orientation, criminal records or safeguarding concerns about the people you support. Second, it is held by an organisation where the people carrying the legal accountability, the trustees, are volunteers, and where much of the day-to-day handling is done by other volunteers rather than employees.

That combination is exactly what UK GDPR’s DPO rules were designed for. Where your core purpose involves processing sensitive data about vulnerable people on any real scale, the law expects independent expert oversight. And even where the legal threshold is not met, a charity that cannot show who is responsible for data protection will struggle with funders, commissioners and the Charity Commission’s expectations on governance.

What an outsourced DPO does for a charity

The tasks are set by law, but how they land in a charity looks like this:

DPO task	In a charity setting
Inform and advise	Plain-English answers for staff, volunteers and trustees, without legal jargon
Monitor compliance	A yearly review of beneficiary, donor and volunteer processing against your policies
Advise on DPIAs	New case-management systems, donor databases, wealth screening and outreach tools
ICO contact point	Registered with the ICO as your DPO, so the regulator has a named professional to contact
Contact for individuals	Handling questions and subject access requests from beneficiaries, donors and ex-volunteers
Report to the top	A written report to the trustee board, at least annually

Because the DPO is external, the independence UK GDPR requires comes built in. Your chief executive or operations lead can keep making decisions about how data is used without being asked to mark their own homework.

Fundraising, marketing and PECR

Fundraising is where most charity data protection complaints begin. The rules that matter most:

• Direct mail can usually rely on legitimate interests, provided you assess that interest honestly, tell people in your privacy notice and honour opt-outs promptly.
• Email and text fall under PECR as well as UK GDPR, and generally need consent. The Data (Use and Access) Act 2025 extends the “soft opt-in” to charities for their own charitable purposes; the details of how and when you can rely on it are worth checking against current ICO guidance rather than assuming.
• Wealth screening and profiling of donors need a lawful basis, transparency in your privacy notice and, in many cases, a DPIA.
• The Fundraising Regulator’s Code of Fundraising Practice sets expectations on top of the law.

An outsourced DPO helps you settle these questions once, document the answers and stop relitigating them every campaign. Our GDPR for charities guide walks through the rules in more depth.

Beneficiaries, safeguarding and sharing

Charities routinely share information with local authorities, the NHS, schools and other charities. Each of those flows needs a lawful basis, a clear purpose and, where the data is sensitive, a special category condition. Safeguarding sharing has its own conditions in the Data Protection Act 2018, and getting that right matters because staff must never feel that data protection is a reason to withhold a safeguarding concern.

Your DPO helps you map those flows in your record of processing activities, put data sharing agreements in place where they are needed and train frontline staff on when sharing is expected rather than forbidden.

Volunteers

Volunteers handle personal data on your behalf, so they need the same basics as employees: a short induction on data protection, access limited to what they need, and a clear route to report a mistake. Because volunteers turn over more quickly than staff, we design these steps to be light enough to actually happen, and we help you keep a simple record so you can show a funder or the ICO that they did.

How the retainer works for a charity

We size the retainer to the charity, not to a corporate template. A small charity with one main database and occasional questions needs a light-touch arrangement. A national charity with regional teams, a helpline and a large supporter base needs more. Either way the fee is fixed monthly, agreed up front and reviewed annually, so trustees can budget for it in the same way as insurance or audit.

The first month is a baseline review: what data you hold, why, where it goes and where the gaps are. From there we agree priorities with you, register as your DPO with the ICO, and settle into a rhythm of monitoring, advice and reporting.

Related support

Charities often combine the outsourced DPO with Cyber Essentials, which funders and public-sector contracts increasingly require, and with a check of your ICO registration. Where a charity delivers health or care services under NHS contracts, the DSPT applies as well, and the DPO’s oversight feeds directly into its governance assertions.

If you would like to talk through whether a DPO is required for your charity, and what a proportionate arrangement would look like, get in touch for a free, no-obligation conversation.