Data Protection Policies for Charities: A Practical Guide | LegalDocuments.co.uk

Overview

A data protection policy is the charity's written statement of how personal information is handled from the moment it comes in to the moment it is securely destroyed. It is an internal document rather than a public-facing notice, although it sits alongside the privacy notice you show to supporters and service users.

The policy explains the lawful bases the charity relies on, who is responsible for compliance, how data subject rights are dealt with, and the controls the organisation uses to keep information safe. For most charities it also covers training, supplier due diligence, retention periods and breach reporting.

A well-drafted policy does three jobs at once. It evidences accountability to the Information Commissioner's Office, which is a core requirement of the UK GDPR. It gives trustees comfort that they are meeting their governance duties. And it gives the people who actually handle the data, often volunteers with no formal legal training, a plain-English reference they can use when they aren't sure what to do.

Key steps

1. Map what personal data the charity actually holds. Before writing a policy, list every category of personal information the charity processes and where it sits. Include donor databases, CRM systems, mailing lists, HR files, volunteer records, beneficiary case notes, CCTV and anything held by third-party processors. Without this picture, the policy will be generic rather than useful.
2. Identify your lawful basis for each processing activity. Under the UK GDPR you need a lawful basis for every use of personal data, and a separate condition if special category data is involved (for example health or safeguarding information). Charities commonly rely on consent, legitimate interests, legal obligation or contract. Record the reasoning for each, because the ICO expects to see this.
3. Set retention periods and deletion routines. Decide how long each type of record is kept and why. Gift Aid records have tax-driven retention rules, employment files have their own timelines, and safeguarding records often need to be held much longer. Build a schedule into the policy so information isn't kept indefinitely by default, which is a common audit finding.
4. Define roles, training and breach response. Name the person accountable for data protection (a DPO if required, or a trustee lead if not), set out expectations for staff and volunteer training, and write a clear breach procedure covering internal escalation and the 72-hour ICO notification window where the threshold is met. Keep a breach log even for incidents that aren't reportable.
5. Review, approve and refresh the policy regularly. The policy should be formally adopted by the trustees, communicated to everyone who handles data, and reviewed at least annually or whenever systems, suppliers or activities change materially. Treat it as a living document, a policy that never changes is usually a policy nobody is reading.

Common questions