What must our privacy notice say?

England and Wales: This page sets out the position in full. Scotland: the same position, with no difference in principle. Data protection is reserved: UK GDPR, the DPA 2018, PECR and the ICO apply identically, and the charity soft opt-in expressly covers bodies on the Scottish Charity Register. Northern Ireland: the same position, and the soft opt-in expressly covers Northern Ireland charities too.

Write it after step 2, not before

Write the charity privacy notice after you have established your lawful basis for each purpose, not before. A privacy notice is the information UK GDPR says you must give people about how you use their personal data. The rules are the same in England and Wales, Scotland and Northern Ireland. The manager or the trustees usually write it.

The notice describes your processing. So it cannot be written until you know what that processing is, and on what lawful basis you do it.

This is why copying another charity’s notice goes wrong. Suppose it says “consent”, and you rely on legitimate interests. Then the copied notice either gets what you do wrong, or it commits you to consent. The ICO’s guide to lawful basis says you generally cannot switch to another basis later.

Write it from two documents: your data map and the basis you recorded against each row. The step before this one, pay the ICO fee or confirm your exemption, works from the same map. Settle it first, so the notice and the registration describe the same processing.

What a charity privacy notice must contain

UK GDPR Articles 13 and 14 set out the content. Both Articles have been read for this guide. They split the content into three groups. Each group has its own list, taken from the Articles.

Content that every notice must give, under both Articles:

• who you are, and how to contact you (and your representative or data protection officer, if you have one)
• the purposes you use the data for, and the lawful basis for each
• the legitimate interests you pursue, where you rely on them
• who you share the data with, or the kinds of recipient
• any transfer outside the UK, and the safeguards in place
• how long you keep the data, or how you decide
• people’s rights: access, rectification, erasure, restriction, objection, portability, and to withdraw consent
• the right to complain to the ICO
• any automated decision-making or profiling, with meaningful information about the logic and the consequences

The retention line is required. It points to your own retention schedule, which you write when you set your data retention schedule.

Two more items when the data came from someone else

Article 14 covers data you did not collect from the person themselves. Examples are a referral from a school, a list from a partner charity, or a parent’s details given on a child’s form. For that data the notice must also say:

• the categories of personal data concerned
• the source it came from, and whether that was a publicly accessible source

This is why the data map has a “where it came from” column.

One more item when you collect it from the person

Article 13 covers data you collect from the person directly. For that data the notice must also say whether giving it is a statutory or contractual requirement. It must also say what happens if they do not give it.

When you need not repeat it

You do not have to give people information they already have. Article 14 also has a narrow exception for research, archiving and statistics. It turns on what is proportionate. Neither is a reason to skip the notice.

How it has to read

The ICO’s guidance requires privacy information to be:

• concise
• transparent
• intelligible
• in clear and plain language
• easily accessible

It also recommends testing the notice on the people it is for. And it recommends a review whenever your purposes change. A notice written for a lawyer fails the test as surely as one that leaves an item out.

Newsletter: two questions, not one

Charities often treat the newsletter as one question. It is two.

• Holding the data is an Article 6 question. Your lawful basis covers it.
• Emailing people is a separate question, decided by PECR, the marketing rules.

Since 5 February 2026, PECR has had a charity soft opt-in (reg. 22(3A), inserted by the Data (Use and Access) Act 2025, brought into force by SI 2026/82). It lets a charity email some supporters without consent. But one of its conditions reaches back to the sign-up form.

The person must have been given “a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of their contact details for the purposes of direct marketing by the charity, at the time that the details were initially collected”.

So the sign-up form must offer the opt-out, and the notice must say so. The marketing rules themselves are on Can we email our supporters without explicit consent?. This page owns only the sentence in the notice.

Check it against a subject access request

A subject access request is a free test of the notice. The ICO’s guidance on subject access requests lists extra information you owe the person when they ask for their data. That list mirrors what the notice says. The ICO says you can point to the notice where it already covers it.

That makes a free check. Read your notice as if answering a request. If a requester would be owed something the notice leaves out, that is a gap. The request itself is covered in Someone has asked for their data. What now?.

Next: What goes in a charity data protection policy?. The notice is your promise to the outside world. The policy is the internal manual that keeps it true. If the charity claims Gift Aid, finish the donor row of the notice before you design a compliant Gift Aid declaration. The declaration collects each donor’s name and home address.

Common mistake: copying another charity’s notice before the lawful basis decisions are made

Charities treat the notice as boilerplate, not as a description of what they do with data. But it has to reflect the basis chosen for each purpose at step 2.

Suppose a copied notice says “consent” for processing you run on legitimate interests. It then either gets what you do wrong, or commits you to consent. The ICO says a basis generally cannot be switched later.

Common mistake: working from a sector checklist instead of the Articles

Checklists of “things your notice must contain” are widely shared and look official. In fact Articles 13 and 14 themselves set the content. They split it three ways:

• the common content
• two items only for data you got from someone else
• one item only for data you collected from the person

A flat list cannot tell you which items apply to which data. Check your notice against all three groups.

Common mistake: describing email marketing as a lawful basis question only

Holding data and contacting people feel like one task. They are two questions. Article 6 governs holding the subscriber data. PECR governs whether you may email them.

The charity soft opt-in also requires that a simple way to refuse was offered when the details were first collected. So the sign-up form and the notice both need to say so.

Worked example

Tollgate Youth CIO drafts its first privacy notice.

It works from its data map and the basis recorded against each row.

The notice covers each group: young people, parents, volunteers, the employee, donors and newsletter subscribers. For each, it says what is held, why, on which basis, who it is shared with, how long it is kept and what rights apply. It adds the contact details and the right to complain to the ICO. It checks the lines on transfers and automated decisions against what Tollgate does.

The parents’ details reach Tollgate on their children’s forms, not always from the parents themselves. So for that row the notice adds the categories of data and where they came from. For the details it collects directly, it says which are needed to run a session and what happens if they are not given.

For the newsletter, the notice states the refusal option the soft opt-in needs. The sign-up form offers it. Then Tollgate reads the draft as if answering a subject access request. It fills any gap it finds.

The outcome is a published notice, linked from every form that collects personal data.