What personal data do we actually hold?

England and Wales: This page sets out the position in full. Scotland: the same position, with no difference in principle. Data protection is reserved: UK GDPR, the DPA 2018, PECR and the ICO apply identically. Northern Ireland: the same position, for the same reason.

Map people, not software

Build your charity data map around people and purposes, not software. This is the one thing to get right. The manager or a trustee usually does it. The law behind it is UK GDPR, overseen by the ICO. The law is the same in England and Wales, Scotland and Northern Ireland.

This is the first data protection step in this hub. The steps after it build on the map, so start here even if you arrived looking for a later one.

Most charities start with their systems: the database, the shared drive, the email account, the filing cabinet. That feels natural, because systems are what you can see.

But the law does not ask about systems. It asks whose data you hold and why. The next step is to choose a lawful basis for each purpose.

You cannot do that against a list of software. “The shared drive” has no purpose. “Volunteer rotas” does.

So make each row a group of people and a reason. Where the data lives is a column, not a row.

The six rows to start from

Most charities hold data about the same six groups of people. This guide uses the same six rows in its table on how to establish your lawful basis for each purpose. So your map and that table line up row for row.

• Donors — gift records, thank-you letters, Gift Aid.
• Beneficiaries — the people your charity serves.
• Volunteers — contact details, rotas, references.
• Staff — contracts, payroll, pensions, right to work.
• Newsletter subscribers — names and email addresses.
• Event attendees — bookings and follow-up.

The six are a starting point, not a legal list. They come from this guide’s own table, not from the ICO.

Add a row for any group you hold that is not here, such as parents, hirers or trustees. Split a row where one group is used for two different things. Donors you thank and donors you research are two rows.

For each row, write down five things:

1. What you hold — the actual fields, not “contact details”.
2. Why you hold it — the purpose, in a sentence.
3. Where it came from — the person, or somewhere else.
4. Where it lives — every place, including paper and personal phones.
5. Who can see it — by role, not by name.

Mark the sensitive rows now

Some rows need more than an ordinary basis. Mark them on the map now, so step 2 does not miss them.

Special category data. This means health, disability and similar data. It needs an ordinary basis under Article 6 of UK GDPR plus a separate condition under Article 9.

A session note about a young person’s additional needs is special category data, even though it looks like any other line in a file. Mark the row. The lawful basis step sets out which condition may fit, and warns about the one that usually does not.

Criminal-record information. Staff and volunteer rows often carry it, because of criminal record checks. Mark those rows too, for the same reason. The condition that applies is decided at step 2, not here. What you may lawfully ask for in the first place is covered in Which level of criminal record check can I legally ask for?.

Is the data map a record of processing activities?

Not as this guide uses the term. Sector templates often call this document a “record of processing activities”, or ROPA, and present it as a fixed form the law prescribes.

This guide does not. The provision behind that name is UK GDPR Article 30, which also has a rule for small organisations. Article 30 has not been read for this guide. So we cannot tell you whether your charity must keep an Article 30 record, or what one must contain.

A data map is the charity’s own written record of whose personal data it holds and why, where it lives and who can see it. Call it a data map. Build it for the jobs in this hub. Do not describe it as a legal requirement, or its content as prescribed.

The map is also the draft of your notice

Your privacy notice is written from this map, two steps on. Two columns earn their place for that reason alone.

Article 14 of UK GDPR covers data you got from someone other than the person. It says the notice must tell them the categories of data concerned and the source it came from. That covers a referral from a school or GP, or a list from a partner. If the map records the source now, the notice can say it later.

The rest of what the notice must contain is set out on What must our privacy notice say?.

How to build the data map

1. Start with the six rows and add your own.
2. Ask the people who do the work. The volunteer coordinator knows what the sign-up form collects. The treasurer knows what the Gift Aid records hold.
3. Fill in the five columns for every row.
4. Mark special category and criminal-record rows.
5. Date it and name an owner. The map goes out of date the day someone adds a new form.

A spreadsheet is enough. The same map tells you whether you must pay the ICO fee or confirm your exemption, because the exemption test runs activity by activity. Next: What is our lawful basis, and is it consent?.

Common mistake: mapping by system instead of by person and purpose

The tools are what people can see, but the purposes are what the law cares about. A map that lists “the CRM” and “the shared drive” cannot be used at step 2. A lawful basis attaches to a purpose, not a piece of software. Build the map on the same six rows as the lawful basis table so the two line up.

Common mistake: not flagging special category data on the map

A beneficiary’s health or disability note looks like any other line in a case file. But it needs an Article 6 basis plus a separate Article 9 condition. The “not-for-profit bodies” condition in Article 9 is not a general charity carve-out, and step 2 explains why. Mark the row so the question gets asked.

Common mistake: calling the map a statutory record with a prescribed content

Sector templates present a ROPA as a fixed form every organisation must keep. UK GDPR Article 30 and its small-organisation rule have not been read for this guide. So this site cannot say whether your charity must keep one or what it must contain. Build the map for the purposes in this hub, and do not describe it as more than that.

Worked example

Tollgate Youth CIO has one employee, a team of session volunteers, a donor list and a newsletter for parents. It has never written down what it holds.

The manager starts a spreadsheet with one row per group: young people, parents, volunteers, the employee, donors and newsletter subscribers. For each row she writes what is held, why, where it came from, where it lives and who can see it.

The young people’s row includes session notes with health and additional-needs information. She marks it as special category data. The volunteer and employee rows record the outcome of criminal record checks, so she marks those rows too. The parents’ contact details came from the young people’s sign-up forms, so she records that as the source.

She calls the document a data map, not a ROPA. The outcome is a written map that step 2 can annotate with a lawful basis per row. The sensitive rows are marked so no condition is missed.