What is our lawful basis, and is it consent?

England and Wales: This page sets out the position in full. Scotland: the same position, with no difference in principle. Data protection is reserved: UK GDPR, the DPA 2018, PECR and the ICO apply identically. Northern Ireland: the same position, for the same reason.

Consent is a one-way door

Consent is the one lawful basis for processing that the person can switch off. You cannot swap it for another afterwards. A lawful basis is one of the grounds in Article 6(1) of UK GDPR on which you may process personal data. Each purpose on your data map needs one.

If you have not yet listed those purposes, map what personal data you hold and why first. This page assumes the map exists.

Charities reach for consent because it feels safe. Years of fundraising rules taught them to ask. Trustees and managers have probably heard that you “don’t need consent”. Here is the reason that matters.

Once you rely on consent, the person can withdraw it at any time. When they do, the processing stops. You cannot then say you were relying on something else all along. The ICO‘s guide to lawful basis says so in terms, verbatim:

Even if the company might have originally relied on legitimate interests, they cannot do so at a later date… The company must stop using the personal information when someone withdraws their consent.

That is the whole argument. Consent hands the person a permanent off-switch you cannot take back. Use it where you need it. Do not use it as a default.

The ICO’s own advice points the same way, verbatim: “The UK GDPR sets a high standard for consent. But you often won’t need consent. If consent is difficult, look for a different lawful basis.”

Recognised legitimate interest: the new lawful basis

UK GDPR now has 7 lawful bases. The new one is Article 6(1)(ea), “recognised legitimate interest”. The Data (Use and Access) Act 2025, s.70(2)(b), inserted it. It has been in force since 5 February 2026 (SI 2026/82, reg. 2(c)).

So any training deck or policy that gives the older count is out of date. That includes almost every charity data protection course written before February 2026.

Both the new basis and ordinary legitimate interests are open to a charity. Both are barred to public authorities acting in their official tasks. But an ordinary charity is not a public authority under the Data Protection Act 2018. So both remain open to you.

Legitimate interests: three questions, answered first

For most charity purposes, the basis you will use is legitimate interests. Legitimate interests is the lawful basis for processing you need for your own or someone else’s legitimate interest. It does not apply where the person’s interests, rights or freedoms override that interest. It is not a free pass. The ICO sets three questions, verbatim:

1. Purpose: “Do you have a legitimate interest for using the personal information?”
2. Necessity: “Is your use of personal information necessary for that purpose?”
3. Balancing: “Do the person’s interests, rights or freedoms override the legitimate interest you’ve identified?”

The ICO’s guidance says you should answer all three before the processing starts, not afterwards. It is “not enough … to simply say that using personal information is in your legitimate interests.” Write the answers down. That written note is part of this step’s deliverable.

The lawful basis for each row of your data map

The lawful basis table takes the six rows from your data map and suggests a starting basis for each. It is this guide’s own synthesis, not an ICO table. The ICO publishes no charity-specific mapping.

The legal points under each row come from the Articles and the ICO’s general guidance. Matching them to a purpose is judgement. Your own facts may differ.

Row on your map	The basis most charities start from
Donors — gift records, thanking, Gift Aid	Legitimate interests; legal obligation for the Gift Aid element
Donors — wealth screening, data matching, profiling	Not legitimate interests without a very robust three-part test; explicit consent is likely to be needed
Beneficiaries — routine services	Contract where a service agreement exists, otherwise legitimate interests
Beneficiaries — health or disability data	An Article 6 basis plus a separate Article 9 condition (see the health data section)
Volunteers	Legitimate interests — volunteer agreements are usually not binding contracts
Staff	Contract for core terms; legal obligation for PAYE, pensions and right to work; legitimate interests for other HR
Newsletter subscribers	Legitimate interests may cover holding the data; whether you may email them is a separate question
Event attendees	Contract for the booking; legitimate interests for closely related follow-up

Public task, the basis public bodies use, is rarely available to a charity. And the newsletter row hides two questions. The basis covers holding the data. Whether you may email people is decided by the marketing rules, which Can we email our supporters without explicit consent? covers.

Wealth screening: the case this step is about

Screening donors’ wealth without telling them is not covered by legitimate interests. The ICO’s first penalties against charities show why. Those penalties came in December 2016, against the RSPCA and the British Heart Foundation. They screened donors’ wealth, traced lapsed donors’ contact details and shared donor data. Donors were not told.

That was not a security failure. It was a transparency failure, and it is a lawful basis failure. Because donors had not been told, legitimate interests did not cover what the charities did. That is why the wealth-screening row in the table says what it says.

Sector material often adds a second wave of penalties against more charities in 2017, with figures. This guide found no primary source for them. It does not repeat them, and you should not rely on them either.

Health data needs a second condition, and the charity one rarely fits

Health, disability and similar data are “special category” data. Such data needs an Article 6 basis and a separate condition under Article 9.

The trap is Article 9(2)(d), the “not-for-profit bodies” condition. It reads like a charity carve-out. It is not.

The condition applies only to a body “with a political, philosophical, religious or trade union aim”. And it reaches only members, former members or people in regular contact with the body.

A hospice’s patients are not its members. Its aim is none of those four. So this condition will not usually cover a charity’s beneficiary health data.

Look instead at the health or social care condition in Schedule 1 to the DPA 2018. Or look at its substantial public interest conditions. Those include safeguarding, and support for people with a particular disability or medical condition.

Criminal-record information needs its own basis and condition

The rows you marked for criminal record checks need the same care, one Article along. The Charity Commission for England and Wales puts the duty this way, verbatim: “If you ask applicants about their criminal records you must have a policy in place that sets out a lawful basis and condition of processing this information, to comply with the General Data Protection Regulations (GDPR).”

So this information needs a lawful basis and a condition of its own. It sits alongside the Article 9 question, not inside it.

No single condition is prescribed. Article 10 of the UK GDPR lets this information be processed only under official authority, or where the law authorises it. A charity does not normally act under official authority. So it needs a condition in Schedule 1 to the DPA 2018.

No provision, and no ICO guidance, names one condition for a charity’s check results. The ICO’s instruction is to “identify which of these conditions appears to most closely reflect your purpose”. Settle it before the processing begins, and write it down.

The candidates, and what each needs:

• Paragraph 18, with paragraph 36 (safeguarding children and individuals at risk): the processing must be necessary to protect a child or an adult at risk. It must also be done without consent for one of the reasons the paragraph lists. It needs an appropriate policy document.
• Paragraph 1 (employment): only where a law places the obligation on the charity as employer. It does not cover a volunteer, or a check the law does not require. It needs an appropriate policy document.
• Paragraph 10, with paragraph 36 (preventing or detecting unlawful acts): the ICO’s own worked example for a criminal record check uses it. It needs an appropriate policy document, except for disclosure to the authorities.
• Paragraph 29 (consent): not safe for a recruitment check. The ICO says consent you require for a check “would not be considered to be freely given and it could not be withdrawn”.
• Paragraph 31 (not-for-profit bodies): not a general charity condition, for the same reason as Article 9(2)(d) above.

This page does not choose among them for you. Which one fits depends on why you run the check. What you may ask for in the first place is covered in Which level of criminal record check can I legally ask for?. The policy itself is the People step on writing a recruitment-of-ex-offenders policy.

Record the basis on the data map

Add a column to your data map. For each row, record the basis, and the Article 9 condition where the row is marked special category. Where the basis is legitimate interests, attach the three-question note. Where it is consent, write down that withdrawal ends the processing and the basis cannot be switched.

That map is what your privacy notice will describe, two steps on.

Common mistake: choosing consent because it feels like the safe option

It comes from caution, and from years of fundraising rules that trained charities to ask. But consent is a one-way door. Once you choose it, you cannot fall back on legitimate interests later. When someone withdraws, the processing stops. Choosing consent when you did not need it hands the person a permanent off-switch.

Common mistake: working from training material with the old number of lawful bases

Almost every charity data protection deck was written before the change came into force on 5 February 2026. A new basis now exists: Article 6(1)(ea), recognised legitimate interest. So the count is one higher than older material says. Both it and ordinary legitimate interests are open to a charity.

Common mistake: wealth screening or profiling donors under legitimate interests without telling them

It feels like ordinary research on data the charity already holds. But it is the failure behind the ICO’s first penalties against charities. Donors of the RSPCA and the British Heart Foundation were not told, so legitimate interests did not cover it.

This guide’s table puts explicit consent as the likely basis. The 2017 figures often quoted with the case have no primary source, and are not repeated here.

Common mistake: relying on the “not-for-profit bodies” condition for beneficiary health data

It reads like a charity carve-out. It is not. This condition applies only to a body with a political, philosophical, religious or trade union aim. And it reaches only members, former members or people in regular contact. A hospice’s beneficiaries are not members. Use a health or social care condition, or a substantial public interest condition, instead.

Worked example

Saltmarsh Trust’s fundraiser proposes screening the donor database against external wealth data to pick out major-gift prospects.

The board asks the three questions before anything is done: purpose, necessity, balancing. This guide’s table puts wealth screening outside legitimate interests without a very robust test. It says explicit consent is likely to be needed. The ICO’s first charity penalties turned on donors not being told.

The board decides that the screening goes ahead only with explicit consent from donors who choose to take part. The minute records that withdrawal ends the processing, and that the basis cannot be switched later.

The outcome is a lawful basis against every purpose on the data map. The Trust also has a written legitimate interests note where that basis is used, and a minuted decision on the screening proposal.