Do we need consent to ask beneficiaries about their outcomes?

England and Wales: This page sets out the position in full. Scotland: the same position — data protection is a reserved matter, so UK GDPR, the DPA 2018 and the ICO apply identically, including the February 2026 research rules. Northern Ireland: the same position, reserved in exactly the same way.

Three purposes, not one

Beneficiary data used for evaluation needs its own lawful basis, because evaluation is a different purpose from providing the service. Most small charities collect information once, at the start, and assume it covers everything. It does not.

This step assumes you have designed how you will collect the data and mapped what personal data you hold. Each category on that map gets a line here.

When you hold information about the beneficiaries you help, you are usually using it for three different things:

1. Providing the service — knowing who someone is, what they need, and how they are doing.
2. Fundraising — telling their story, or their numbers, to raise money.
3. Evaluation — working out whether the service changes anything.

Evaluation is the systematic assessment of whether a service worked and why — the same sense as in the bid’s monitoring and evaluation section. Each purpose must have its own lawful basis under UK GDPR. UK GDPR applies alike in England and Wales, Scotland and Northern Ireland, and the regulator is the ICO.

A basis that covers the first does not automatically cover the other two. The rest of this step follows from that.

Outcome information is often about health, disability or ethnicity. That makes it special category data. It must have a separate Article 9 condition on top of the basis.

Establish your lawful basis for each purpose sets out the conditions. Stories and photos used for fundraising have their own page: how to use beneficiary stories and images. That page also covers the Fundraising Regulator’s Code.

UK GDPR Article 89: deleted, not amended

Article 89 of UK GDPR was deleted, not amended, yet much published UK guidance on evaluation data still tells you to look at it.

The annotation on legislation.gov.uk reads, verbatim: “Art. 89 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 86(4)”. It took effect on 5 February 2026. The rules on research, archives and statistics now sit in a new Chapter 8A of UK GDPR. That is Articles 84A to 84C.

So a guide, template or course that reasons from Article 89 is reasoning from a repealed rule. Nearly all UK charity guidance on this still does. Check the date on anything you rely on.

What Chapter 8A is, and is not:

• It is not a lawful basis. “It’s for research” is never an answer on its own. You must still have an Article 6 basis. Special category data still needs its Article 9 condition.
• It can cover a charity’s own outcomes study. The Data (Use and Access) Act 2025 counts applied research as scientific research. A real evaluation may qualify. Routine monitoring with a new label does not.
• It expects the least identifying data that works. Under Article 84B, you may use data that names people only if the purpose cannot be met without it. If grouped or anonymous figures would answer the question, use those.

What if you act on one person’s score?

Acting on one person’s score takes that use outside the statistics route — a trap aimed squarely at how good charities work.

The statistics route has a condition. You must not use the data, or anything you produce from it, “in support of measures or decisions with respect to a particular data subject”.

Picture the ordinary case.

A project worker collects wellbeing scores for evaluation. One score is worryingly low. The worker arranges extra support for that person. That is exactly what a caring service does.

It also takes that use outside the statistics route. Acting on one person’s score is a decision about that person. So it needs an ordinary lawful basis for service delivery. If the score is health information, it needs an Article 9 condition too.

This is not an edge case. It will happen in almost any service that measures how people are doing.

So plan for it. Record the support-flagging use as service delivery, under its own basis, from the start. Then the evaluation use can stay clean.

Why consent is a poor default for evaluation

Consent feels like the ethical choice. For evaluation it usually is not the right one, for two reasons.

It is rarely freely given. Someone receiving help from you may feel they have to agree. A person “should not feel they have to agree as a condition of receiving help”, and consent that cannot be freely withdrawn is not consent.

A withdrawal years later holes the baseline. Evaluation often compares the same people over time. If consent is your basis, anyone can withdraw it at any point. The processing then has to stop. Establish your lawful basis for each purpose explains why you generally cannot switch to a different basis afterwards.

The standard after a withdrawal is reasonable steps, not guaranteed removal. You must stop active use. You cannot ignore the withdrawal because a report is already printed.

But you do not have to recall copies already handed out. The page on beneficiary stories and images sets out what reasonable steps look like.

None of this names the right basis for you. That depends on your charity. It means consent is a choice to make for a reason, not a box to tick by habit.

One more point: for genuine research, the 2025 Act lets consent be less specific where future uses are not yet known. That helps long-running outcome studies. It does not help routine monitoring.

Children and adults at risk

The same rules apply, with more care. Where a child is in a dependent position, give them time and the chance to talk it over with an adult they trust. For children, public task or a research basis is usually more appropriate than consent.

If outcome questions could reveal abuse or risk, your safeguarding policy decides what happens next, not your evaluation plan. Choose the right level of check covers where criminal-record information meets data protection. The People hub has its own pages on a safeguarding lead and on recruiting ex-offenders.

What to record for each category of beneficiary data

For each category of beneficiary data on your map, record:

1. The purpose — delivery, fundraising or evaluation. One line each; a category may have more than one.
2. The lawful basis for each purpose, and why you chose it.
3. The Article 9 condition, if the data is special category.
4. Whether evaluation uses the research or statistics route, and if it does, how you keep it away from decisions about individuals.
5. Where consent is the basis, how a withdrawal will be handled and what it does to your baseline.

This record feeds three other pages. Write the need statement and evidence it uses it when you put beneficiary data in a bid. Deliver against the grant and report on it relies on it when you report on a grant. Draft the narrative sections of your report relies on it when you write about achievements in the annual report.

Within this hub, the next step is to collect, store and analyse what you gathered, under the bases you have recorded.

Common mistake: reasoning from UK GDPR Article 89

Most published UK charity guidance on research and evaluation data still does. Article 89 was not amended — it was deleted on 5 February 2026 and replaced by Chapter 8A. Guidance built on it is built on a provision that no longer exists. This is a legal requirement, and UK-wide, since data protection is reserved.

Common mistake: flagging one beneficiary from an evaluation score while relying on the statistics route

It is a completely ordinary thing for a good charity to do. The statistics route requires that the data is not used “in support of measures or decisions with respect to a particular data subject”. Acting on one person’s score steps outside it. Record that use as service delivery, under its own basis.

Common mistake: collecting once and assuming it covers delivery, fundraising and evaluation

Small charities collect at intake and reuse. But these are three purposes, and each must have its own lawful basis. Outcome data about health, disability or ethnicity will often be special category data too, needing an Article 9 condition on top.

Common mistake: defaulting to consent for longitudinal evaluation

Consent feels like the ethical choice. But consent from someone receiving your service is not freely given, and a withdrawal years later holes the baseline. Explain to yourself why consent fits before choosing it — and ask the ICO rather than guessing.

Worked example

Saltmarsh Trust collects wellbeing scores from clients when they start and when they leave. The scores go into the annual outcomes summary. Then a project worker sees a worryingly low exit score. She arranges extra support for that client.

Saltmarsh’s data lead works through it. Three purposes are in play: providing the service, fundraising (the summary appears in appeals) and evaluation. Each gets its own lawful basis on the data map. Wellbeing scores are likely to be health information, so each basis also needs an Article 9 condition.

The support-flagging use is recorded as service delivery. It never relied on the statistics route, so acting on one person’s score breaks nothing. The evaluation itself uses grouped figures, which is all the annual summary needs.

Consent is not the basis for the evaluation. Clients receive a service from Saltmarsh, so their agreement is not freely given, and a withdrawal would hole the before-and-after comparison.

A colleague sends a training handout that cites Article 89. The data lead notes that Article 89 was deleted in February 2026 and takes nothing from it.