GDPR and Data Protection Compliance for UK Charities | LegalDocuments.co.uk

Overview

UK GDPR, sitting alongside the Data Protection Act 2018, is the framework that governs how organisations in this country handle personal data. It replaced the EU version after Brexit but kept most of the substance intact, so the obligations you may have read about pre-2021 still largely apply.

For charities, the law treats you the same as any other data controller, your not-for-profit status doesn't buy you a lighter touch. If you collect names, email addresses, giving history, medical details, safeguarding notes or employment records, you're processing personal data and the rules bite.

The framework covers how you gather information, what you tell people about it, how long you keep it, who you share it with, and how you respond when someone asks to see or delete what you hold. It also sets out special protections for sensitive categories such as health data, religious beliefs and children's information, all of which many charities handle routinely. Getting a clear grip on what you hold and why is the foundation everything else sits on.

Key steps

1. Map what personal data you actually hold. Before you can comply with anything, you need an honest picture of the information flowing through your charity. Walk through donor databases, Mailchimp lists, volunteer spreadsheets, CCTV footage, safeguarding files, HR records and anything sitting in trustees' personal inboxes. Note what you collect, where it lives, who can see it and how long it stays.
2. Identify a lawful basis for each processing activity. Every time you use personal data, UK GDPR requires one of six lawful bases, typically consent, contract, legal obligation, vital interests, public task or legitimate interests. Charities often rely on legitimate interests for fundraising communications and consent for marketing emails, but you need to document which basis applies to which activity and be ready to justify it.
3. Update your privacy notice and internal policies. People whose data you hold have a right to clear information about what you're doing with it. Your privacy notice should be written in plain English, cover each processing purpose, explain retention periods, and set out how someone exercises their rights. Back this up with an internal data protection policy that staff and volunteers actually read.
4. Build a process for data subject requests. Individuals can ask to access their data, correct it, delete it, restrict its use, or object to processing. You generally have one calendar month to respond, and getting it wrong is one of the most common triggers for ICO complaints. Decide now who handles these requests, how you'll verify identity, and where you'll look to gather the relevant records.
5. Strengthen security and plan for breaches. Technical and organisational measures need to be proportionate to the risk, encryption, access controls, secure disposal of paper records, staff training, and MFA on cloud accounts are all sensible starting points. Put a breach response plan in writing so that if something goes wrong, you know who decides whether to notify the ICO within the 72-hour window.