Principle 5: Data

Charities must comply with the latest regulations around the collection and storage of data, particularly with UK GDPR. Leaders should apply “legitimate interest” when appropriate, ensuring collected data is relevant and accurate, and the data collection is fair and open.

Charities should always clearly communicate and maintain the value of “opting-in” for supporters to enhance their communications. “Opt-in” options should be consistent across all platforms to avoid user confusion, and there should always be an easy-to-identify opt-out option.

Charities should only retain necessary information and regularly review and remove data that no longer serves a specific purpose.

Charities, charity employees, and volunteers should practice caution when inputting data into AI models. Sensitive data should only be entered if the model does not use that data in an insecure manner (i.e. using it to inform future outputs which become generally or publicly available) as this could violate privacy and undermine trust in the charity.

Charities will likely hold existing data, such as donor, supporter, and attendee data. Leaders should work to understand where that data is held, how to access it, and how to generate actionable insights from it.