Making supporter choices clear, respectful and easy to manage.

For many people in charities, GDPR still feels like a set of rules designed to catch them out. It isn’t. At its heart, GDPR is simply about treating people fairly; telling them what you’re doing, respecting their choices, and keeping their information safe.

This module isn’t about legislation. It’s about people — and about helping your team understand how to handle supporter information in a way that builds trust instead of anxiety.

When consent is clear and permissions are up to date, everything becomes easier: communications land where they should, donors feel respected, and teams avoid guesswork. It’s not about perfection — it’s about getting the basics right, together.

---

Why this module matters

Permissions and consent shape almost every interaction a charity has with its supporters. When they’re handled well:

• supporters feel respected
• campaigns become more effective
• complaints fall
• your organisation stays on the right side of GDPR
• teams feel confident using data instead of worrying about it

Handled poorly, they create confusion, mistakes and risk — none of which are needed in an already stretched environment.

This module gives your team the clarity they need to act with confidence.

---

What we’ll cover in this module

By the end, your team will understand:

1. The difference between consent, legitimate interest and operational contact

(And why mixing them up creates unnecessary risk.)

2. How to record permissions in a clear, consistent way

No more guessing, no more “I think we can email them… right?”

3. How to manage supporter choices respectfully

Including opt-outs, channel preferences and special categories of data.

4. How this all links back to GDPR

In normal English, without legal jargon or panic.

5. What good everyday practice looks like

So that anyone — fundraiser, volunteer manager, comms lead — can feel confident updating records.

---

How this connects with other policies

Just like your data policy, this module links to the wider framework of how your charity works:

• your Privacy Notice (what you tell supporters)
• your Data Retention Policy (how long you keep information)
• your IT / Security Policy (who has access and how)
• your Fundraising or Communications Strategy (how you plan supporter journeys)

Permissions sit at the crossroads of all of these — so clarity here has a huge ripple effect across the organisation.

Lesson 6.1 — What Counts as Personal Data

A simple guide to what sits under GDPR (and why it matters to your charity).

Before we can talk about permissions, consent or supporter choices, we need to get clear on what actually counts as personal data. This is the foundation everything else builds on. And the good news? It’s much simpler than people think.

Personal data is anything that can identify a living person, directly or indirectly.
It includes obvious things like names and email addresses, but also information you might not immediately think of — notes, opinions, behaviours, photos, even a combination of small details.

Understanding this helps teams work with confidence. It reduces accidental risk and stops the “is this personal data?” guessing game we see in so many charities.

---

The basics: what personal data includes

Here are the categories in charity-friendly terms:

---

Why this matters for permissions & consent

Knowing what counts as personal data helps teams:

• understand when permissions apply
• avoid storing information in the wrong place
• treat notes and comments with respect
• feel confident about when GDPR actually matters
• avoid the myth that “GDPR stops us doing everything”

A confident team makes fewer mistakes — and communicates more effectively.

---

Quick clarity: what is not personal data?

Some common misconceptions:

• Anonymous survey responses (if truly anonymous)
• Aggregated reports
• Pure statistics
• Organisational / business information (“info@charity.org”)

If it can’t be tied back to a person, directly or indirectly, it’s not personal data.

Lesson 6.2 — Permissions & Consent: What They Actually Mean (and the Rules Behind Them)

A simple guide to supporter choices, lawful bases, and the different regulations that shape how charities communicate.

When teams talk about “permissions” or “consent”, they’re often talking about five different things at once — GDPR, PECR, the Fundraising Regulator, internal policies, supporter expectations… no wonder people get anxious.

Let’s strip it back.

At its core, permissions are simply about respecting supporter choices and using data in a fair, transparent way. The legislation and codes that surround this aren’t there to stop good fundraising. They’re there to help organisations build trust.

This lesson explains the different rules that touch charity communications, what they actually mean, and how they fit together.

---

The Foundations: What’s the Difference Between GDPR and PECR?

GDPR (General Data Protection Regulation)

GDPR sets the principles for handling personal data.
It answers questions like:

• Are we using data fairly?
• Are we being transparent?
• Are we keeping it safe and accurate?
• Do supporters have clear rights over their information?

It governs how you process personal data — whatever the channel.

GDPR = how we treat data.

PECR (Privacy & Electronic Communications Regulations)

PECR controls how you communicate with people via:

• email
• SMS
• phone (for some types of calls)
• cookies / tracking technology

PECR is about channels, not content.

PECR = how we contact people using electronic channels.

It’s possible to be GDPR-compliant but PECR-non-compliant, and vice versa — this is where confusion often begins.

---

Other Rules Charities Need to Know (Fundraising & Governance)

1. The Fundraising Regulator’s Code of Fundraising Practice

This governs:

• ethical fundraising
• transparency
• supporter care
• avoiding undue pressure
• respectful communication

It matters because it shapes the tone and approach to how you contact supporters — not just whether you’re legally allowed to.

2. The Charity Commission (UK) — Trustee Responsibilities

Trustees must ensure:

• personal data is used legally and ethically
• fundraising is carried out responsibly
• financial stewardship is sound

This ties permissions and consent back to governance.

3. PCI-DSS (Payment Card Industry Data Security Standard)

If your charity takes card payments, PCI-DSS applies.

It’s not just about secure checkout pages — it includes:

• no storing card details in spreadsheets
• no taking card details by email
• strict handling rules for telephone donations

This protects both supporters and organisations.

4. Data Protection Act 2018

This is the UK’s legal framework that sits alongside GDPR.
You don’t need to memorise it — just know that it reinforces GDPR principles.

5. Your Own Internal Policies

These often include:

• Privacy Notice (what you tell supporters)
• Data Retention Policy
• IT / Information Security Policy
• Safeguarding / Service-user Confidentiality
• Acceptable Use & Digital Communications

A strong permissions framework should align with all of these.

---

How Permissions Actually Work in a Charity

There are three everyday categories your team needs to understand:

1. Operational Contact

These are messages required to deliver a service or transaction.
Examples:

• Gift Aid queries
• Event logistics
• Volunteer rota updates
• Donation receipts

No consent required. No opt-in.

This is the charity fulfilling its role.

But — teams mustn’t stretch the definition.“Since you donated last week, here’s our newsletter” does not count as operational.

2. Consent (Opt-In)

Supporters clearly and actively say yes to specific types of communication.

Consent must be:

• freely given
• specific
• informed
• recorded
• easy to withdraw

Under PECR, consent is required for:

• email marketing
• SMS marketing

Under GDPR, consent is only one lawful basis — but for digital marketing it’s the safest default.

3. Legitimate Interest (LI)

This is where much confusion comes from, but it can be genuinely useful when handled well.

LI is appropriate when:

• the charity’s interest is reasonable
• the impact on the supporter is minimal
• the supporter would expect the communication
• you conduct a balancing test
• you offer a clear opt-out

Most commonly used for:

• postal fundraising
• contacting donors who have an existing relationship
• stewardship where someone hasn’t actively opted out

Channel rule:

• LI cannot be used for email or SMS fundraising under PECR.
• LI can apply to postal fundraising and some phone calls.

---

What about Soft Opt-In? (current proposals + future legislation)

Soft opt-in (sometimes called “pre-existing relationship rule”) is expected to be expanded in upcoming UK legislation.

The principle: If someone bought, donated, or engaged recently and gave their details, you may contact them about similar campaigns as long as they can easily opt out.

Currently applies to:

• Some email contact from commercial organisations
• Charities in limited circumstances (varies by legal interpretation)

Expected future:

• A clearer, charity-friendly version
• Likely allowing warm supporters to hear from you if they haven’t opted out

But until legislation changes, don’t rely on soft opt-in for charity email fundraising unless your legal team explicitly says so.

---

Where teams often get stuck

• “We have consent for post, so we can email them too, right?”
• “They donated last year — does that mean we have legitimate interest?”
• “They opted out of SMS, so can we call them?”
• “We have event data but no opt-in — can we use it for fundraising?”

These questions are normal. A clear permissions framework helps everyone make the right call.

---

A simple table your team can use

Contact Channel	Consent	Legitimate Interest	Operational Contact
Email	✔ Required	✖ Not allowed	✔ Delivery only
SMS	✔ Required	✖ Not allowed	✔ Delivery only
Phone	Often ✔ Required (TPS rules)	✔ In limited cases	✔
Post	Optional	✔ Common lawful basis	✔
In-person	Not required	✔	✔

Lesson 6.3 — The 8 Data Protection Principles (In Real Language)

A simple, human explanation of the rules that sit behind good data practice.

The 8 Data Protection Principles are the foundation of GDPR. They’re not meant to scare anyone or make simple tasks feel risky. Their purpose is to guide organisations — including charities — to use data fairly, safely and respectfully.

Think of these principles as a set of good habits rather than a list of punishments. When your team applies them, supporter trust grows, fundraising improves, and the organisation becomes less vulnerable to mistakes.

Let’s walk through each principle in plain English, with examples that make sense in a busy charity.

How these principles help your team

When staff understand these eight ideas, everything becomes clearer:

• teams make better decisions
• supporter trust improves
• data quality increases
• fundraising becomes smoother
• compliance becomes a natural by-product, not a fear

These principles are not hoops to jump through — they’re tools to help your organisation work better.

Lesson 6.4 — Practical Action: Consent Statements & Real-World Scenarios

Helping your team make confident, ethical decisions about supporter contact.

Consent, permissions and lawful bases can feel abstract until you put them into real examples. This final lesson makes things practical: what to say, how to record it, and how to interpret supporter choices in a way that respects their preferences without getting tangled in fear or legal jargon.

---

PART A — Three Strong Consent Statements

Below are three examples you can use or adapt. Each one includes why it works, how to interpret it, and what to record.

---

PART B — Legitimate Interest (LI) and Soft Opt-In

A clear, calm explanation your team can rely on.

Legitimate Interest (Current Legislation)

Charities can use LI only when all three conditions are met:

1. The charity’s interest is reasonable
2. The supporter would expect the contact
3. The supporter is not harmed or disadvantaged

✔ Channels where LI can apply

• Post (common)
• Some telephone calls (non-TPS numbers)
• In-person contact
• Operational contact alongside a transaction

✖ Channels where LI cannot be used

• Email marketing
• SMS marketing

If a channel is regulated by PECR, consent is the safest lawful basis.

Soft Opt-In (Future Legislation Direction)

Soft opt-in is expected to become more charity-friendly soon, but currently remains limited.

The principle:

If a person has recently donated, bought something, or engaged meaningfully, you may contact them about similar communications if they haven’t opted out.

Currently:

• Applies mostly to commercial organisations
• Charities must be cautious and seek legal clarity
• Never rely on soft opt-in for broad email fundraising campaigns until legislation changes

Expected future direction:

• Warmer, more flexible rules for charities
• Likely to allow stewardship + appeals to recent donors who haven’t opted out

For now: treat soft opt-in as a supplementary tool, not a foundation.

---

PART C — Real-World Scenarios

Use these to challenge thinking in your team. Each one includes an answer + explanation.

Wrap-Up: What Teams Should Remember

• Consent is opt-in, channel-specific, and must be recorded.
• Legitimate interest is useful but narrow — and never covers email/SMS.
• Soft opt-in is coming, but not here yet.
• Supporters should not be surprised by your contact.
• Stewardship ≠ marketing.
• When unsure: choose the most respectful option.

A confident team makes better decisions.