What goes in a charity data protection policy?

England and Wales: This page sets out the position in full. Scotland: the same position — data protection is a reserved matter, so UK GDPR, the DPA 2018, PECR and the ICO apply identically. Northern Ireland: the same position, reserved in exactly the same way.

The new complaints route to put in your policy

Your charity data protection policy now needs a route for people to complain to the charity directly. Almost nobody has one yet. The policy comes after you write your privacy notice: the notice is the promise, and the policy is how you keep it.

The Data (Use and Access) Act 2025 inserted new sections into the Data Protection Act 2018. They give a person a statutory right to complain to the controller directly. That means your charity, not only the ICO. The duty is the same across the UK. It concerns the trustees who adopt the policy and the manager who runs it.

Organisations must have an accessible complaints process. The Act’s example of “facilitating” a complaint is a complaint form that can be filled in electronically. They must acknowledge a complaint within 30 days. They must then respond, or tell the complainant the outcome, without undue delay.

This duty is not in the future; it is already in force. It came into force on 19 June 2026. So a charity without a working process is already in breach, not merely behind schedule.

The change was recent and quiet. Almost no small charity has closed the gap yet. The gap is cheap to close. Name an owner, describe the route, and set the acknowledgement clock to the 30-day period.

What the policy is for, and what it is not

A data protection policy is the charity’s internal manual for handling personal data. It says who does what, and when, to keep the privacy notice’s promise true. The privacy notice answers a different question. It is the outward promise: what UK GDPR requires you to tell the people whose data you hold. Mixing up the two is a common mistake.

Whether the charity needs the policy in writing at all is a board decision, covered in adopt a data protection policy.

The policy says who handles a subject access request, who handles a breach, and who handles a complaint under the new complaints route. The first two have steps of their own. Establish how you handle a subject access request, and establish how you handle a data breach.

What goes in a charity data protection policy

The safest structure the research supports is simple. Name an owner, a review date, and the people responsible for access requests, breaches and complaints.

No law or regulator sets the content of a data protection policy. The law does set the content of a privacy notice. So there is no official checklist. A template that presents one is offering its own view.

Check the lawful bases the policy names

If the policy names or explains lawful bases, check them against the current law. UK GDPR now recognises 7 lawful bases for processing personal data, not six. The DUAA 2025 inserted the new one, “recognised legitimate interest”. It has been in force since 2026-02-05. Old training notes or templates that still say “six lawful bases” were written before this change.

Absence of basic policy and training is what enforcement turns on

In its charity enforcement cases, the ICO keeps returning to one pattern. It is not a sophisticated attack, but the absence of basic written policy, training and governance. Its monetary penalty notice against Central YMCA named three failures that contributed:

• no written email-security policy
• a secure tool that existed but went unused
• training that was assigned but never checked for completion

That gives a good test of whether this step is done. An adopted document that nobody has been taken through protects little more than none at all. Name who is briefed on the policy, and record it in the minutes. That record is part of the deliverable.

Next: How long should we keep everything? The retention schedule is the first procedure the policy relies on.

Common mistake: having no accessible complaints route, or not acknowledging complaints in time

The duty is new and almost no small charity has noticed it yet. A statutory right to complain to the controller now exists. It comes with an accessible route, an acknowledgement period, and a duty to respond without undue delay.

It came into force before most charities last reviewed their policies. So a charity without a process is already in breach. The gap is near-universal but cheap to fix.

Common mistake: expecting a statutory checklist of what the policy must contain

UK GDPR does set the content of a privacy notice, and people mix up the two documents. No law or regulator sets the content of a data protection policy, as distinct from the notice. The policy is the internal manual. The notice is the outward promise. A template that offers a statutory checklist is offering its own view.

Common mistake: adopting the policy and never training anyone on it

People treat the document as the whole deliverable. In its charity enforcement cases, the ICO stresses one common thread: the absence of basic written policy, training and governance. How advanced any attack was is not the point.

In its Central YMCA penalty, the ICO named three contributing failures. There was no written email-security policy. A secure tool was available but unused. And nobody monitored whether training was completed.

Worked example

Wrenfield Village Hall’s committee adopts a one-page data protection policy. The policy names an owner and a review date. It assigns who handles a subject access request, who handles a breach, and who handles a complaint under the new complaints route. The policy sets acknowledgement within the period the DUAA duty sets.

It does not pad the policy with a content list the research cannot source. The outcome is an adopted policy with a named owner and a working complaints route. The minutes note who has been briefed on it.