by james dungate
First tabled under the previous government, the Data (Use & Access) Act 2025 gained Royal Assent earlier this month, meaning it is now law. We’ve been looking into it – here are the key points!
Soft Opt-In:The Soft Opt-In principle, established in PECR (2003) is now extended to charities. This allows the sending of marketing emails without consent, so long as:
· You have an existing relationship with the supporter.
· You collected the data (i.e. it isn’t a purchased list).
· You are marketing similar products or services to what they previously engaged with.
· You offer an opt out.
This is an exciting development that will expand email lists. We recommend thinking about how you define “similar products or services” and if that is applied consistently across the business. It is also worth considering, if the individual wouldn’t give you consent to send an email, what do you need to do differently to get them to give time or money? It is generally better to have an engaged email list than a big one!
Other key points in summary…
Data Related Complaints: Charities must ensure that data related complaints are easy to submit and properly managed. This should be in place for most organisations already for stewardship reasons.
Recognised Legitimate Interests: There is a new concept of “Recognised Legitimate Interests” (RLI). This effectively permits certain common activities to be conducted on the basis of legitimate interests without necessitating a Legitimate Interests Assessment. The full list of RLI’s is not confirmed and will be steered by ICO (Information Commissioner’s Office) guidance, but is expected to include direct marketing.
AI: This is data in 2025, so of course there is an AI angle. The key point is that AI developers are able to use copyrighted content without permission – meaning that content might be used to train AI without the content creators receiving compensation. For more on how to use AI in fundraising, why not look at this blog from earlier this year?
It’s important to note that there is far more in this bill (we’ve saved a deep dive on the National Underground Asset Register for another day) than we’ve covered here – but these are the aspects that could impact the not-for-profit sector the most. We should also remember that the law doesn’t change the moment that a bill passes – rather, the provisions in the bill will come into force over the next 18 months, with the exact timings still to be confirmed.
So what can you do now? We understand there is a lot of sector enthusiasm for the soft opt in; we recommend anyone considering this can, today, conduct a Data Protection Impact Assessment (DPIA) to ensure they are clear about the implications of a change and ready to move, should they choose, when the bill comes into force.
