ICO

The ICO regulates UK GDPR and the marketing rules in PECR. Its practical relevance to a small charity is immediate: the annual data protection fee, the rules on emailing supporters, and what to do in the first 72 hours of a data breach.

Charities are not automatically exempt from the data protection fee. The exemption depends on the nature of the processing, not on charitable status, and many charities that assume they are exempt are not. Check rather than assume.

The ICO runs a free helpline for small organisations, and publishes self-assessment tools. See the ICO fee for who has to pay and marketing consent for the rules on contacting supporters.