Charity Privacy Notice UK: GDPR Guide for Trustees

What this document is

A privacy notice is the public-facing statement that tells individuals how your charity handles their personal data. It usually sits on your website, but it also needs to be referenced anywhere you collect data, including donation forms, volunteer sign-ups, newsletter opt-ins, event registrations and employment applications.

For a charity, the notice typically explains who you are as a data controller, what categories of personal data you collect, why you collect it, the lawful basis you rely on, who you share it with, how long you keep it, and what rights individuals have to access, correct or delete their data. It should also describe how someone can make a subject access request and how they can complain to the Information Commissioner's Office if they are unhappy.

The notice needs to be written in plain language. Burying the detail in legalese tends to attract criticism from regulators and puts off the very people you want to build trust with. Charities often deal with particularly sensitive information, so getting the notice right matters more here than in many commercial contexts.

How to use this document

1. Map your data first. Before you write anything, list every category of personal data your charity holds and where it comes from. Donors, gift aid records, volunteers, beneficiaries, staff, trustees, event attendees and mailing lists all need to be accounted for. You cannot describe what you do with data if you do not know what you have.
2. Identify your lawful basis for each activity. Under the UK GDPR you need a lawful basis for every processing activity. Charities commonly rely on consent, legitimate interests, legal obligation or, for some beneficiary work, vital interests. Getting this wrong is one of the most frequent mistakes, so think carefully about which basis fits each purpose.
3. Address special category and sensitive data. If your charity processes health information, religious beliefs, ethnicity data, or information about criminal convictions, you need additional safeguards and a specific condition for processing. Children's data also carries extra responsibilities. Where this applies, the notice must deal with it explicitly rather than in general terms.
4. Explain sharing, storage and retention. Be honest about who you share data with, whether that is a fundraising platform, a CRM provider, a professional adviser or a statutory body. If any of your providers store data outside the UK or EEA, you need appropriate transfer mechanisms in place and your notice must say so.
5. Publish, review and keep it current. A privacy notice is a living document. Review it at least annually, and whenever you change systems, add new services, or start a new type of fundraising. Trustees should sign off material changes, and the updated version needs to be easy for people to find on your website.

Common questions