Data protection in the UK: Charities anticipate green light to rely on direct marketing exemption

The charity sector has welcomed the Government’s adoption of a key amendment to the Data (Use and Access) (“DUA”) Bill. The approved amendment, put forward by Labour Peer Lord Vallance of Balham and sponsored by Lord Clement-Jones, will enable charities to send electronic communications directly to supporters of their cause without obtaining the specific consent of the recipient, as is currently the case. The amendment, if implemented, would provide an exemption similar to the ‘soft opt-in’ rule which presently applies only to commercial organisations under the Privacy and Electronic Communications Regulations 2003 (“PECR”). 

This article explores how this amendment came to be, its controversies, and what steps charities should take now to ensure they are best positioned to reap the benefits of this shift in handling their supporters’ personal data.

What does the amendment say? 

Section 114 in the current version of the DUA Bill amends Regulation 22 of the PECR by allowing charities to send direct marketing communications to individuals in cases where: 

1. this is done in pursuit of the charity’s charitable purpose(s); 
    
2. individuals initially provided their contact details to express an interest in or provide support to the charity; and 
    
3. individuals are presented with a simple way to opt out at the time their details are collected and in every subsequent communication.

As such, the draft legislation does not require the express consent of the individual to receive such communications. 

Background and controversies

This change follows some prior controversy surrounding charity fundraising and the extent to which charities should be able to send marketing emails to people who have not actively consented to receive them. The amendment has been spotlit on the political stage as well; it was initially incorporated into the Data Protection and Digital Information Bill put forward by the preceding Government. The current Labour Government subsequently introduced its own DUA Bill following the 2024 General Election, which noticeably failed to include the exemption. This decision was swiftly met with an outcry from charities and supporting organisations alike. 

Most notably, in November 2024 the Data & Marketing Association penned a letter on behalf of its charity members to the Secretary of State for Science, Innovation and Technology Peter Kyle MP, outlining their concerns with this withdrawal and urging the Government to reconsider. In its letter the DMA highlighted that its estimations show that the amendment would increase annual donations by £290 million, and that such increase is imperative to the continued survival of many charities in light of the mounting pressure exerted by the cost-of-living crisis. It follows that the mobilisation of key interest groups alongside political supporters significantly contributed to pushing the amendment over the line.

Elsewhere in the regulatory landscape, the Information Commissioner Office (“ICO”) has similarly embraced the amendment’s adoption, with the Information Commissioner stating: “I support this extension as it will help charities better communicate with people who support their purposes.” However, he cautions this by noting that “we would expect charities to consider implementation carefully, including their UK GDPR obligations.”

What now? 

The amendment is set to level the playing field between charities and commercial organisations as it relates to the collection of personal data for marketing purposes. As of 26 March 2025, the DUA Bill is currently in the Report Stage in the House of Commons, after which it will flow through to the final stages of assent. Assuming there are no major legislative delays, it is anticipated that the DUA Bill may be passed as early as May 2025. It is therefore important that charities start to prepare as soon as possible for this change. 

For charities wishing to make use of the new soft opt-in option, key points to consider include: 

• Forward-looking compliance strategy: The shift from the consent-only model to the soft opt-in exemption may be difficult to effect in practice as charities will only be able to rely on the exemption in relation to future supporters of their charity; legacy supporters would have provided their consent under the old model. Under data protection law data controllers cannot switch from consent as a lawful basis for data processing to a different basis, which in this instance would be the “legitimate interests” ground. Charities need to be aware of this and must ensure they are not relying on the soft opt-in exemption to process any of their legacy supporters’ data.
   
• Reviewing record-keeping and database management infrastructure: In light of the above, charities should consider whether their existing record-keeping and data management infrastructure is fit for purpose and make appropriate adjustments where necessary. As they will need to keep track of the different permission categories for their supporters’ data, they should ensure there is a division between the individuals whose data is being processed on the basis of the old consent model, as opposed to those whose data is being processed on the basis of the soft opt-in exemption. 
   
• Soft opt-in trigger: Considering a lot of charities are likely to deal with sensitive topics and support vulnerable individuals, they should carefully consider how they go about disseminating direct marketing communications. The amendment does not define what it means in practice for an individual to express an interest in or to provide support to a charity. As raised by the ICO, “it may not be appropriate to rely on the soft opt-in, for example where someone accesses an organisation’s crisis service and subsequently sending them direct marketing mail could result in harm.” Charities should contemplate what actions will appropriately trigger the soft opt-in exemption, and in what circumstances they may refrain from following up with direct marketing communications. 
   
• Conducting a Legitimate Interest Assessment: Relying on the soft opt-in exemption will mean that charities will be shifting their lawful basis for processing data from consent to legitimate interests. It follows that charities must conduct a Legitimate Interest Assessment which considers the purpose of such processing, its necessity and how it balances against individuals’ personal interests, taking into account that some recipients may be vulnerable or negatively affected by receiving such requests. The ICO has published comprehensive guidance on the legitimate interests basis available here.
   
• Updating privacy notices and signposting opt-out statements: It is imperative that charities review and amend their privacy notices to state the exact basis for processing their supporters’ personal data for direct marketing purposes. If this is not yet the case, any request to provide contact details on a charity’s website or in their direct communications should be accompanied by an opt-out statement and check-box which allows individuals to exercise their right to opt out of direct marketing.
   

Lastly, it is anticipated that the ICO and charity regulators such as the Charity Commission and the Fundraising Regulator will publish additional guidance on the implementation of the soft opt-in exemption as we near the effective date of the DUA Bill. The charity sector should ensure that they are keeping their eyes peeled for any further developments in this space and implement their new marketing strategies with care. 

Sources
Amendment 49 to Data (Use and Access) Bill [HL] to Data (Use and Access) Bill [HL] - Parliamentary Bills - UK Parliament 

DMA letter to Secretary of State Peter Kyle on behalf of the charity sector | DMA

Information Commissioner’s updated response to the Data (Use and Access) (DUA) Bill – House of Commons | ICO