Privacy notice

Every charity that holds personal data — donors, beneficiaries, volunteers, staff — must tell those people what it is doing with it. The privacy notice is how.

UK GDPR requires that the information is concise, transparent, intelligible and easily accessible, in clear and plain language. It must cover what data you hold, your lawful basis, how long you keep it, who you share it with, and the individual’s rights including access and erasure.

One notice rarely fits every audience — a beneficiary notice and a donor notice usually need different content. See writing your privacy notice. The ICO publishes a free template and runs a helpline for small organisations.