Info Gov

The Information Commissioner's Office has published its finalised guidance on the "charitable purposes soft opt-in", a new provision under the Data (Use and Access) Act 2025 that gives charities greater flexibility to contact supporters by electronic mail without first obtaining their consent.

The change, which came into force on 5 February 2026, means that charities can send direct marketing by electronic mail - including emails, texts and direct messages on social media - to people who have expressed an interest in, or offered to support, an organisation's charitable purpose, without needing to obtain consent first, provided strict requirements are met.

The ICO published the final guidance on 28 April 2026, alongside updated guidance on direct marketing using electronic mail more broadly.

Under the Privacy and Electronic Communications Regulations 2003 (PECR), a "soft opt-in" exemption has long permitted commercial organisations to send electronic marketing to existing customers about similar goods or services without prior consent. The Data (Use and Access) Act 2025 extends this mechanism to charities, allowing them to contact people who have expressed interest in or offered to support a charity without needing their prior consent for marketing, providing they meet the necessary requirements.

The move, which it is claimed could benefit charities to the tune of £290m a year, is designed to bring third sector organisations into line with general businesses and provide more opportunities to stay in touch with supporters.

The final updated guidance includes anonymised examples and additional clarity in areas raised by respondents to last year's consultation (which received more than 140 responses) including how the provision applies to direct collections and the role of third parties.

The ICO takes a broad approach to what constitutes "expressing an interest" in a charity's purposes. The proposed approach suggests that if someone actively engages with a charity, they are likely to be expressing an interest, including someone signing up to a newsletter, signing up to a charity website, and even merely requesting information about a charity's charitable purposes. Similarly, someone "offering or providing support" covers a wide range of activities such as donating to a charity or volunteering.

Key requirements and safeguards
Organisations wishing to rely on the provision must observe several strict conditions. Charities must ensure people are offered clear opportunities to opt out when their personal information is first collected and in every communication they send. Crucially, the ICO has clarified that charities must not use the charitable-purpose soft opt-in to contact people whose details were collected before the new rule commenced.

The most appropriate legal basis under Article 6 of the UK GDPR for processing personal data using the soft opt-in exemption is legitimate interests, meaning charities should carry out a legitimate interests assessment to balance their interests against the impact on individual rights and freedoms.

Even where all the requirements are met, charities are reminded to consider whether it is appropriate to send marketing in a given case. Where contact details were obtained when someone was accessing a crisis intervention service, for example, subsequently sending them direct marketing could result in harm.

Emily Keaney, Deputy Commissioner for Regulatory Policy at the ICO, described the development as a positive step, adding that the guidance is designed to help organisations use the provision with confidence while ensuring that individuals' rights remain protected.

Gerald Oppenheim, Chief Executive of the Fundraising Regulator, welcomed the guidance, saying it provides valuable clarity for charities about how they may legally use the new soft opt-in provision and encouraging charities to familiarise themselves with it before deciding whether to make use of it. The Fundraising Regulator confirmed it is developing a further resource to complement the ICO's guidance specifically in the context of fundraising marketing.

Also in this section

May 26, 2026

Key Data Protection Issues for Automated Recruitment in the Public Sector

The need to recruit faster in a competitive market, the need to minimise costs in the recruitment process, and the need to secure the best candidate quickly, makes the use of AI an appealing option for any employer including public bodies. But there are pitfalls for the unwary write David Leach and Charlotte Smith.
May 08, 2026

Schools warned over AI blackmail threat as guidance urges rethink on pupil images

Schools across the UK are being urged to review or remove identifiable photographs of pupils from their websites and social media accounts, following warnings that criminals are using artificial intelligence tools to manipulate those images into child sexual abuse material (CSAM) and then threaten to release it unless a ransom is paid.
Apr 28, 2026

AI in Education: Why Data Protection Must Come First

Artificial Intelligence promises a lot. It can undoubtedly do amazing things. But secretly (or maybe not so secretly), it also makes us slightly nervous. Adam Halsey looks at what this means for schools, and why data protection needs to sit at the centre of any decision to use AI.
Apr 22, 2026

Preparing for the new complaints regime

From 19 June 2026, all organisations acting as data controllers are required to have in place an effective process to enable individuals to raise complaints about how their personal data is handled. Ashleigh Dibb looks at what this will mean in practice.
Apr 17, 2026

When data protection doesn’t protect you

Recently, the Information Commissioner’s Office published the outcome of a criminal prosecution. The title? Just two names: Christopher Munro and William Chipoma. No explanation. No softening. No anonymity. And that, in itself, is a powerful lesson in how data protection law really works.
Mar 27, 2026

Tribunal strikes out s.166 DPA 2018 application over medical records dispute

The First‑tier Tribunal has rejected a complaint against the Information Commissioner (ICO), deeming that an application under section 166 Data Protection Act 2018 against an ICO finding was seeking a ruling on the substantive merits of a complaint when s166 should only be applied to procedural defects in an ICO investigation.

InfoGov Masthead Newsletter 800