Lawful basis

Every use of personal data needs a lawful basis, chosen before the processing starts and recorded. Charities historically default to consent, which causes problems.

Consent must be freely given, which it is not where someone needs your service. A beneficiary asked to consent as a condition of receiving help has not freely consented. Legitimate interests, public task, contract and legal obligation frequently fit better.

Map each purpose to a basis and write it down — see establishing your lawful basis. The ICO runs a free helpline for small organisations, and the choice matters because it determines which individual rights apply.