Does our charity legally need a written data protection policy?

England and Wales: This page sets out the position in full. Scotland: the same position, with no difference in principle — data protection is reserved, and both the fee and the exemption rules are UK-wide. Northern Ireland: the same position again, for the same reason.

Does UK GDPR require a written policy?

Only where proportionate. Under UK GDPR, a charity must have written data protection policies only where they are proportionate to its processing. This page is for trustees anywhere in the UK, because data protection is reserved. The Information Commissioner enforces it, not the Charity Commission.

Like the other policy pages in this hub, it assumes you have already mapped your governing document.

Ask “do we need a data protection policy” and you are asking two questions with different answers.

The first is about the document. UK GDPR requires a controller to implement data protection policies only “where proportionate in relation to processing activities”. That is a real condition, not a polite hedge.

A volunteer-run charity holding one mailing list processes hardly any data, at low risk. It may sit outside the trigger entirely. A charity running a service for adults at risk, with case records and staff files, does not.

The second is about money. The Information Commissioner’s Office charges an annual data protection fee. The duty to pay it turns on whether you process personal data at all. It does not turn on whether you wrote anything down.

The cheapest tier is £52 a year. A charity can have an excellent policy and be in breach because it never paid. It can also be compliant on the fee with no policy at all.

The practical order is the reverse of the one most people expect. Check the fee first. It is the duty with a hard answer, a due date and a bill. The step that settles it is pay the ICO fee or confirm your exemption.

What does “where proportionate” mean?

It is a test of your processing: how sensitive the data is, how many people touch it and what a leak would do. The wording is worth taking seriously in both directions. It excuses a very small, very low-risk processor from holding a written policy. It equally catches a charity that has grown past that point and never revisited the question.

The test is about your processing, not your size in the abstract. Ask:

• what kinds of people you hold data about
• how sensitive the data is
• how many people touch it
• what would happen if it leaked

A charity with donors, beneficiaries, staff and volunteers on four different systems is not a low-risk processor, whatever its income.

The accountability principle is the UK GDPR rule that a controller must be able to demonstrate its compliance. It is not conditional at all. You have to be able to show compliance whether or not you wrote a policy.

That is why a charity can hold a policy and still be non-compliant. The document is evidence of the thing, not the thing.

Are charities exempt from the ICO fee?

No. Charity status caps the fee at the lowest tier. It does not exempt a charity from paying.

This is the most useful correction on the page. It has two halves.

The charity rule and the exemption are different animals. The charity rule caps a charity at the lowest fee tier however large it gets. It does not excuse payment.

The exemption excuses payment entirely. Any controller can use it. It turns on the purpose of the processing, not on legal form. Being a charity gets you the cap. It does not get you the exemption.

Then comes the mechanic almost everyone misses. The Regulations say, verbatim:

“A data controller must comply with the requirements of this regulation unless all of the processing of personal data they undertake is exempt processing.”

All of it. One non-exempt activity removes the exemption for the whole organisation. That could be a single CCTV camera, or a donor database that does not fit one of the exempt purposes. The ICO’s own checklist adds that the not-for-profit limb is lost entirely if the organisation:

• runs CCTV
• provides services outside its stated aims
• trades or shares personal data

Most charities holding donor and beneficiary and staff data will fail that all-or-nothing test.

Two figures are worth keeping in view. The smallest tier applies to an organisation with no more than 10 staff or no more than £632,000 turnover. Either one qualifies you. And the charity cap means the tier above is not a cliff a charity can fall off.

One warning about checking this yourself. The as-made text of the Regulations on legislation.gov.uk still shows the old fee figures. You only reach the current ones by selecting the revised version.

The ICO’s own general FAQ page for other service activities has also been seen carrying a stale figure. So two official sources disagree, and one is out of date. That is why the fee is a on this site rather than a number typed into a sentence.

The board’s adoption decision

This step is the board’s adoption decision: whether a written policy is proportionate for this charity, and a minute recording the answer either way. It is deliberately not the policy itself.

The content belongs to Running the organisation — Write your data protection policy. That content covers:

• lawful bases
• retention
• subject access (see handle a subject access request)
• breach handling (see handle a data breach)
• the new statutory route for someone to complain to you directly about your data protection practices

Read it next if the answer here is yes. Read it anyway if the answer is no. Several of those duties apply whether or not you hold a policy document.

Does the annual return ask about data protection?

No. Data protection is not one of the annual return’s named policy questions. The Commission’s annual return asks whether each of 13 named policies and procedures was in place at the end of the period. Its guidance says it expects most charities to have 6 of them.

Data protection is on neither list. It is not one of the named questions, nor one the Commission says it expects.

That is not permission to skip it. The duty comes from somewhere else: data protection law and the ICO, not the charity regulator.

This explains a pattern worth recognising. A charity can answer every policy question on its annual return correctly and still be in default on this one. The form that prompts most trustees to think about policies never mentions it.

Common mistake: treating the written policy as the whole of compliance

The policy is the part people can see, so it becomes the thing people check. The accountability duty underneath is unconditional. The policy is required only where proportionate. A charity can hold a policy and still be non-compliant, or be compliant without one.

Common mistake: confusing the policy with the ICO fee

Both feel like data protection admin, so they get filed together. They are separate duties. The fee is a payment obligation with no policy component at all. It is the one with a bill attached and a date on it.

Worked example

Wrenfield Village Hall is run entirely by volunteers and holds one thing: a mailing list of people who book the hall. It has no written data protection policy and its committee has never discussed one.

On the policy, Wrenfield is probably fine. A written policy is required where proportionate to the processing. A single low-risk mailing list is close to the floor of that test.

The committee’s job is to minute that they considered it and concluded it was not proportionate. That minute is the deliverable. It is what makes the decision reviewable later if the charity grows.

On the fee, Wrenfield is the one to check. The hall takes bookings, keeps contact details and sends the odd notice. The whole question is whether every one of those activities falls inside an exempt purpose. The test is all-or-nothing. If any of it does not, the fee is due.

That is the more likely enforcement point of the two. It costs one small annual payment to close.

With the data protection decision minuted, the next policy in the sequence is the complaints procedure.