Compliance & GDPR
Smaller UK charities often operate under the impression that GDPR compliance is a burden reserved for large corporations with dedicated data protection teams. In reality, GDPR compliance for charities in the UK is a fundamental legal requirement that applies equally to organisations of all sizes—and the stakes for non-compliance are significant. Whether you're managing donor records, volunteer information, or beneficiary data, understanding your obligations under the General Data Protection Regulation isn't optional. This guide walks you through the practical essentials, helping you establish robust data governance without unnecessary complexity.
Many smaller charity leaders assume that GDPR applies only to commercial organisations processing vast quantities of personal data. This misconception can leave charities vulnerable to breaches, reputational damage, and regulatory enforcement action from the Information Commissioner's Office (ICO).
The reality is straightforward: if your charity processes personal data—whether it's donor names and addresses, volunteer contact details, or information about the people you support—GDPR applies to you. The regulation makes no exceptions based on organisation size or charitable status. The ICO has been clear that charities must meet the same standards as any other controller of personal data.
For smaller charities, the good news is that proportionality is built into GDPR. Your compliance obligations should be scaled to the amount and sensitivity of data you hold, and the risk your processing poses to individuals. A local foodbank with a spreadsheet of 200 donors faces different compliance requirements than a national mental health charity with detailed case files on thousands of service users—but both must have a defensible, documented approach.
GDPR is built on six core principles. Understanding these gives you the framework to make compliant decisions about data handling:
In practice, this means documenting your decisions. If you decide to keep a donor's details for five years after their last gift to enable re-engagement appeals, that's a legitimate decision—but you should be able to explain your reasoning if the ICO asks. If you process data about beneficiaries to measure your impact, that's lawful—provided people knew this when they shared information with you.
Before creating policies or processes, establish what data you actually hold. Walk through each department or function—fundraising, service delivery, volunteer management—and document:
This audit forms the basis of your Records of Processing Activities (ROPA)—a requirement under Article 30 of GDPR. For smaller charities, this needn't be elaborate. A simple spreadsheet documenting each type of processing is sufficient.
For charities, the most common legal bases are consent and legitimate interests. If you're asking donors or volunteers to share information, you typically need one of these:
Document which legal basis applies to each type of processing. This clarity protects you if questions arise later.
People must know what you're doing with their data. Write a privacy notice that explains:
Smaller charities often combine this into a single notice. Larger organisations might have separate notices for donors, volunteers, and service users. The key is that the language is clear and honest—avoid opaque privacy policy jargon.
This is where many charities struggle. Define how long you keep different types of data:
Once you've defined your schedule, you need a process for actually deleting data when the retention period ends. Many charities define this but then fail to execute it. Build deletion into your regular administrative routines.
GDPR compliance isn't just about policies—it's about protecting data in practice. Smaller charities often work with limited budgets for IT infrastructure, but you still need to meet baseline security standards:
If a data breach occurs—whether someone accidentally emails beneficiary details to the wrong address or a laptop containing donor records is stolen—you must report it to the ICO within 72 hours if it poses a risk to people. This sounds alarming, but the ICO recognises that breaches happen. What matters is how you respond: document the breach, assess the impact, and explain what you've done to prevent it recurring.
Finally, be prepared to respond when people exercise their data rights. Under GDPR, individuals can request a copy of the data you hold about them, ask you to correct inaccurate information, or request deletion. You must respond within 30 days. For smaller organisations, this is often manageable—build a simple process for handling these requests rather than treating each one as a crisis.
Compliance doesn't require perfection, but it does require a systematic approach. Many organisations find that working with experienced technology partners—like VantagePoint Networks, who support London-based professional
VantagePoint Networks is an independent senior IT and AI consultancy based in London. No account managers — every engagement is handled directly by the founder.
Book your free call →