Compliance · Data protection

GDPR for community groups

UK GDPR for the volunteer treasurer with a membership spreadsheet and a Mailchimp list. The minimum you have to do, what the ICO actually expects, and the 2026 changes.

Last updated 17 May 2026·7 min read

The short answer

Any community group that processes personal data (members, donors, volunteers, beneficiaries — names, emails, addresses, DOB) is a data controller and must comply with the UK GDPR and the Data Protection Act 2018.

For a typical small charity, that means: register with the ICO (£40/year Tier 1 charity fee, usually); identify a lawful basis for each kind of processing; publish a privacy notice; respond to data-subject requests within a month; and report breaches within 72 hours where they meet the threshold.

From 5 February 2026, charities can email or text supporters who have shown an interest in their charitable purposes without prior consent, under the new charitable-purpose “soft opt-in” introduced by the Data (Use and Access) Act 2025 — important new flexibility for charity marketing.

The six UK GDPR principles

Every charity processing personal data must follow the six principles in UK GDPR Article 5:

Lawfulness, fairness and transparency. A lawful basis for each use; clear privacy notice
Purpose limitation. Collected for specified purposes; not used for incompatible new purposes
Data minimisation.Don't collect more than you need
Accuracy. Keep records up to date; correct errors when found
Storage limitation.Don't hold longer than necessary
Integrity and confidentiality. Reasonable security: passwords, access controls, encryption where appropriate

Lawful bases for processing

UK GDPR Article 6 lists six lawful bases. Most small-charity processing falls under one of these three:

Consent. Required for direct-marketing emails and texts (Privacy and Electronic Communications Regulations 2003, PECR). Must be specific, informed, freely given and unambiguous; pre-ticked boxes are not consent.
Legitimate interests.The charity has a legitimate reason that isn't overridden by the individual's rights. Use for member administration, fraud prevention, internal record-keeping. Requires a documented Legitimate Interests Assessment (LIA).
Legal obligation. Where processing is required by law — gift aid records for HMRC, accounting records under Charities Act 2011, DBS records.

Three further bases (vital interests, public task, contract) apply occasionally. For special category data (health, religion, ethnicity, sexual orientation, etc.) you need a lawful basis and a separate Article 9 condition — typically explicit consent or substantial public interest.

The charitable-purpose soft opt-in (from 5 February 2026)

The Data (Use and Access) Act 2025 amends PECR to introduce a charitable-purpose “soft opt-in” for direct marketing. Charities may send electronic direct marketing (email, text, social-media DM) to people who have expressed an interest in, or offered or provided support for, the charity's charitable purposes — without prior consent — provided:

The sole purpose is to further the charity's own charitable purposes
A clear opt-out is offered at point of collection and in every subsequent communication
The contact details were collected on or after 5 February 2026 (not retrospective)

The ICO published final guidance on 28 April 2026. This is a material relaxation of the prior position; build the opt-out into your data-capture forms now.

The ICO data protection fee

Most data controllers (including charities) must pay an annual fee to the Information Commissioner's Office (ICO).

Tier 1 — £40/year for most small charities (and the standard small organisation tier). Registered charities qualify for the Tier 1 fee even if they would otherwise fall into Tier 2 or 3 on size criteria.
Exemptionmay apply for very small not-for-profit organisations whose processing is limited to membership administration and record-keeping — check the ICO's self-assessment tool.
Failure to pay is enforceable; the ICO has issued fines against small organisations for non-payment.

Data subject rights

Individuals have eight UK GDPR rights. The ones most likely to come up at a small charity:

Right of access (DSAR). Anyone can ask for a copy of the personal data you hold about them. Respond within one calendar month; no fee for most requests. The Data (Use and Access) Act 2025 codified the “reasonable and proportionate searches” position — you don't have to turn the office upside down for a trivial request.
Right to rectification. Correct inaccurate data within one month.
Right to erasure (“right to be forgotten”). Limited circumstances (no longer needed, withdrawn consent, unlawful processing). Records you must keep for legal reasons (gift aid, accounting) can be retained.
Right to object to processing, especially direct marketing — absolute right for marketing, must stop immediately.

Breach reporting

Personal data breaches that pose a risk to individuals must be reported to the ICO within 72 hours of becoming aware. Breaches likely to result in high riskto individuals must also be reported to the individuals themselves “without undue delay.”

What counts as a breach: lost laptop, accidental email of a members' list to the wrong recipient, server compromise, theft of donor records. Most small-charity breaches are human error and most don't cross the “risk to individuals” threshold — but errors involving sensitive categories, large data sets, or potential for harm should be reported.

A small-charity GDPR action list

Register and pay the ICO fee (£40 Tier 1 for most charities)
Document what personal data you hold, the source, the purpose, the lawful basis, the retention period
Publish a privacy notice on your website and have a printed version available
Identify a data protection lead — usually the treasurer or secretary at small-charity scale (DPO role only mandatory for public authorities and large-scale monitoring)
Review consent records for direct marketing — replace pre-ticked or stale consents
From February 2026: update data-capture forms to support the new charitable-purpose soft opt-in
Have a breach response procedure — who is told, who decides on ICO notification, who notifies individuals
Train trustees and staff briefly — most small-charity breaches are human error

Related guides

Sources

UK General Data Protection Regulation; Data Protection Act 2018
Data (Use and Access) Act 2025 — Royal Assent 19 June 2025; charitable-purpose soft opt-in commences 5 February 2026
Privacy and Electronic Communications Regulations 2003 (PECR)
ICO charity guidance and data-protection fee self-assessment
ICO breach reporting guidance — 72-hour deadline
ICO updated DUAA guidance (published 28 April 2026)