How the new data protection rules could impact charity fundraising

Disclaimer: Flow Strategies is not a legal advisory organisation, and the content of this blog post is provided for general informational purposes only. For specific legal advice or support, we recommend seeking guidance from a qualified legal professional.

The UK’s proposed Data Protection and Digital Information Bill is set to change how charities and non-profits approach fundraising, especially when it comes to direct marketing.

If you’re responsible for engaging with supporters or donors, you’ve probably heard about legitimate interest and consent—two important ways to legally contact individuals for fundraising purposes.

This article will focus on one key change in the new regulations: how legitimate interest and consent apply to direct marketing, including fundraising.

Let’s break down what these changes could mean for you and how your charity can stay compliant while continuing to raise essential funds.

What’s changing?

The new bill clarifies that legitimate interest can be used for direct marketing purposes—this includes fundraising. In simple terms, this means that charities might not always need explicit consent to contact individuals with fundraising appeals or newsletters, as long as they have a strong and legitimate reason to do so.

However, this doesn’t mean charities can send out mass emails to everyone. You’ll still need to carefully assess when it’s appropriate to use legitimate interest, and when consent is required. Here’s what you need to know.

What Is legitimate interest in direct marketing?

Legitimate interest is a legal basis for processing personal data under the UK GDPR.

It allows organisations, including charities, to process someone’s data (such as sending them an email or letter) if it’s in the organisation’s interest to do so—and if the individual’s rights and privacy aren’t negatively impacted.

The new bill provides more clarity on when legitimate interest can be used for direct marketing. For charities, this means you can rely on legitimate interest for sending fundraising communications as long as:

The recipient has an existing relationship with your organisation (e.g., they’ve donated or engaged with your charity before),
The communication is relevant to their previous support (e.g., a similar cause or event),
You’ve assessed that contacting them is reasonable and doesn’t override their right to privacy.

However, you still need to be careful. You must carry out what’s called a balancing test to ensure that your need to contact the person doesn’t outweigh their right to privacy.

How to use legitimate interest for fundraising

If your charity decides to use legitimate interest for fundraising communications, here are a few practical steps to follow:

1. Conduct a balancing test

Before sending a fundraising email or message, you must weigh your organisation’s need to contact someone against their right to privacy. This is called a balancing test. Ask yourself:

Is this communication expected? If someone has previously donated to your charity, it’s likely they expect to hear from you about similar campaigns.
Is it necessary to contact them? Consider whether sending this fundraising message is essential for your charity’s operations.
Will it negatively impact their privacy? Be mindful of how frequently you contact people and ensure you’re not being intrusive.

2. Document your decision

Once you’ve conducted the balancing test, document it. This shows that you’ve thought through the decision and can demonstrate compliance if needed.

Having a written record will protect your charity if someone ever questions why they were contacted.

3. Be transparent

Even if you’re relying on legitimate interest, it’s important to let your supporters know why they’re being contacted and how you’re using their data.

Update your privacy policy to explain that you may use legitimate interest for fundraising and ensure that every email or message gives recipients the option to opt out of future communications.

Transparency builds trust, and it’s a legal requirement to give individuals the choice to stop receiving marketing messages.

When should you use consent?

While legitimate interest is useful, there are times when consent is still the best or only option, especially under the Privacy and Electronic Communications Regulations (PECR).

Consent is required when:

You’re contacting someone for the first time who hasn’t engaged with your charity before,
You’re sending fundraising messages by text or email to individuals with no prior relationship,
You want to send general marketing that isn’t directly related to someone’s past support or donations.

Consent must be freely given, specific, and informed. This means that people need to actively agree to be contacted, usually by ticking a box or signing up to receive updates from your charity.

The soft opt-in: A special rule for charities

There’s one more thing to know: the new bill also includes an update to the soft opt-in rule, which is particularly helpful for charities.

The soft opt-in allows charities to send direct marketing (like fundraising appeals) to individuals without needing explicit consent if:

The person has previously engaged with your charity (e.g., they’ve donated or attended an event),
You’re contacting them about something similar (e.g., another fundraising appeal),
You gave them the option to opt out when they first provided their details and in every subsequent communication.

This means that if someone has already shown an interest in your charity, you can reach out to them again without having to ask for fresh consent each time, as long as you follow the rules.

Practical steps for charities

To ensure you’re using legitimate interest and consent correctly, here’s a quick checklist for your charity:

Review your data and identify which supporters you can contact using legitimate interest (those with an existing relationship) and which ones require consent.
Update your privacy policy and clearly explain how you process data under legitimate interest and make it easy for people to opt out of communications.
Conduct balancing tests before sending any fundraising messages using legitimate interest, conduct and document a balancing test to show you’ve considered the recipient’s privacy.
Maintain opt-out processes by ensuring that every email, text, or message includes a simple way for recipients to opt out, and promptly honour their preferences.
Train your team and ensure everyone involved in fundraising and marketing understands the new rules around legitimate interest and consent.

Conclusion

While the proposed changes to UK data protection laws offer greater flexibility for charities to use legitimate interest for direct marketing, including fundraising, it’s important to note that this bill has not yet been passed.

The Data Protection and Digital Information Bill is currently making its way through Parliament, and although it is expected to bring these changes into effect, the timing and final details may still shift.

This blog post provides guidance to help you prepare for when the bill is passed, ensuring your charity remains compliant and ready to adapt to the new regulations.

However, until the bill becomes law, the existing rules under the UK GDPR and PECR still apply, meaning that for now, charities must continue to rely on the current frameworks for legitimate interest and consent.

As the bill progresses, it’s essential to stay informed about any further developments or changes. For specific legal advice or to understand how these changes may affect your organisation in detail, we recommend consulting a legal professional.

By keeping up to date and planning ahead, your charity will be well-positioned to navigate these evolving data protection requirements while maintaining trust and transparency with your supporters.