Privacy Policies for Charity Fundraising in the UK | LegalDocuments.co.uk

Overview

A privacy policy for charity fundraising is a public-facing notice that explains how your charity collects, uses, stores, shares, and deletes personal information relating to donors, supporters, beneficiaries, volunteers and anyone else whose data you handle in connection with raising funds. It is the document the ICO expects you to point people to when they want to understand what you are doing with their information, and it is the first place a curious donor will look if they have any concern about being added to a mailing list or receiving a phone call.

A good policy goes beyond a list of categories. It tells the reader, in language they can actually follow, why the charity holds their data, what lawful basis it relies on, who the data may be shared with (including processors such as fundraising platforms, mailing houses or analytics providers), how long it is kept, and what rights the individual has to access, correct, restrict or delete their information.

For charities running events, legacy campaigns, raffles or door-to-door collections, the policy should reflect each of those activities rather than treating fundraising as one undifferentiated activity.

Key steps

1. Map the data you actually hold. Before drafting anything, list every category of personal data your charity collects through fundraising. That includes donor names, addresses, payment details, Gift Aid declarations, communication preferences, event registrations, legacy enquiries, and any profiling or wealth screening you carry out. You cannot describe what you do honestly until you know what you do.
2. Identify your lawful basis for each activity. Under the UK GDPR you need a lawful basis for processing personal data, and the right one varies by activity. Processing a donation might rely on contract or legal obligation, sending marketing emails will usually rely on consent, and analysing donor history for fundraising may rely on legitimate interests subject to a documented balancing test.
3. Draft in plain English, not legalese. The ICO is clear that privacy information must be concise, transparent and intelligible. Write as if you are explaining the policy to a longstanding supporter over a cup of tea. Use headings, short paragraphs and examples. Avoid lifting boilerplate from another charity's website without checking whether it actually reflects what you do.
4. Address consent and PECR rules for marketing. The Privacy and Electronic Communications Regulations sit alongside data protection law and govern electronic marketing. Your policy should explain how supporters can opt in or out of email, SMS, telephone and postal communications, and reflect the Fundraising Preference Service. Make it genuinely easy for someone to change their mind at any time.
5. Review, publish and keep it under review. Place the policy somewhere obvious on your website, link to it from donation forms, event sign-ups and email footers, and revisit it whenever you launch a new fundraising channel, change supplier, or adopt new technology such as AI-driven donor analytics. A privacy policy that has not been touched for three years is rarely accurate.

Common questions