Data protection

If a charity holds personal data about individuals, it is likely to come under the scope of the Data Protection Act. 

If so, trustees must ensure the charity complies with the requirements of the Act and should put in place policies and procedures to ensure compliance.

The Data Protection Act is designed to protect the use of an individual’s personal information. The Act requires organisations, including charities and voluntary charities, to comply with certain provisions if they use or hold an individual’s personal data. Many charities that come under the Act must register with the Information Commissioner, apart from in some limited cases.

The Act includes restrictions on the use of data (for example, not giving the data to another charity without the individual’s consent, or using the data for a purpose other than that agreed with the individual). 

Special rules apply to “sensitive personal data” – for example covering health or ethnic origin. The Act also gives individuals the right to find out about the data held about them.