GDPR

Introduction

The General Data Protection Regulation (GDPR) has been a pivotal regulation since it came into effect on May 25, 2018. While the headlines often focus on how GDPR impacts large corporations, charities and volunteer organisations are equally affected. Understanding your responsibilities is crucial to maintain trust with your supporters, beneficiaries, and volunteers. Here’s a guide to what GDPR means for you and how to ensure your organisation is compliant.

What is GDPR?

GDPR is a data protection law designed to give individuals more control over their personal data and how organisations handle it. It applies to any organisation that processes personal data, regardless of the organisation’s size or revenue. As a charity or volunteer group, you collect data such as names, addresses, contact details, and sometimes even sensitive information. This makes you subject to GDPR regulations.

Key Responsibilities Under GDPR

Here are some of the main responsibilities your charity or volunteer organisation must consider:

  1. Data Lawfulness, Fairness, and Transparency
    • You must have a legal basis for collecting and processing personal data. Common legal bases for charities include obtaining consent from data subjects or processing data in line with legitimate interests, such as raising funds for your cause.
    • Be transparent about why and how you collect data. This means updating your privacy policies and clearly explaining what data you collect, how it will be used, and who it will be shared with.
  2. Data Minimisation
    • Only collect data that is necessary for your purposes. For instance, if you’re running a volunteer recruitment campaign, collecting a name, email, and phone number may be sufficient, rather than gathering unnecessary details.
  3. Accuracy
    • Ensure that the personal data you hold is accurate and up-to-date. For example, regularly review and update your supporter database, especially if you use it for communications or fundraising.
  4. Data Storage and Security
    • Implement appropriate technical and organisational measures to secure personal data. This may include encrypting sensitive data, using secure servers, and training staff and volunteers on data protection best practices.
    • Conduct regular risk assessments to identify and mitigate vulnerabilities in your data handling processes.
  5. Rights of Data Subjects
    • GDPR gives individuals various rights, including the right to access their data, correct inaccuracies, erase data, and restrict processing. Be prepared to handle such requests promptly and within the required timeframes (typically one month).
  6. Data Breach Notification
    • If a data breach occurs and it poses a risk to the rights and freedoms of individuals, you must report it to the Information Commissioner’s Office (ICO) within 72 hours. You should also notify the affected individuals if the breach is serious.

Specific Considerations for Charities and Volunteer Organisations

  • Consent for Fundraising: If you rely on consent to send marketing or fundraising communications, ensure that you have clear, explicit, and verifiable consent from individuals. This could involve updating your mailing lists and getting fresh consent if necessary.
  • Children’s Data: If you work with children or young people, extra care must be taken. You may need parental consent for processing a child’s data, depending on the nature of the data and the child’s age.
  • Sensitive Data: If you collect sensitive data, such as health information for volunteer safety, this must be handled with additional security measures and a higher degree of accountability.

Practical Steps to Ensure Compliance

  1. Conduct a Data Audit: Review the data you currently hold, understand why you have it, and ensure it’s necessary for your operations. Identify any gaps in compliance and take steps to address them.
  2. Update Your Privacy Policies: Make your privacy policies accessible and understandable for your supporters, beneficiaries, and volunteers. This transparency fosters trust and demonstrates your commitment to GDPR.
  3. Train Your Team: Ensure staff and volunteers understand GDPR requirements and are trained to handle personal data responsibly.
  4. Appoint a Data Protection Lead: This may be an official Data Protection Officer (DPO) if your organisation’s data processing is extensive, or a staff member responsible for ensuring GDPR compliance.
  5. Review Third-Party Contracts: If you share data with third-party processors (such as a cloud service for email newsletters), ensure they also comply with GDPR. Have data processing agreements in place to clarify responsibilities.

Common Pitfalls to Avoid

  • Assuming GDPR Doesn’t Apply to You: Even small organisations must comply with GDPR if they handle personal data. Ignoring your responsibilities could result in penalties.
  • Over-Reliance on Consent: While consent is crucial, it’s not always the most appropriate legal basis. For some activities, legitimate interests or contractual necessity might be better suited.
  • Lack of Security Measures: Data security should be a top priority. Don’t assume that basic measures are sufficient; invest in regular updates and staff awareness.

Conclusion

GDPR compliance may seem daunting, but it ultimately benefits both your organisation and the people you serve. By respecting privacy and handling personal data with care, you build trust and strengthen relationships with supporters, volunteers, and beneficiaries. Prioritising data protection is not just a regulatory requirement—it’s a step towards more ethical and responsible operations.

If you’re unsure about any aspect of GDPR, consider consulting legal professionals or data protection experts to ensure your organisation is fully compliant.