Charity fundraising under the spotlight

By Phil Brining

Yesterday the BBC published a story putting charity fundraising under scrutiny. Having worked with a few large charities I can see the difficulties they face. Many charities employ third party collectors or agencies to engage the public and collect donations and/or introduce new regular donors. This is a pure out and out sales activity and one which is, in my opinion, not easy to manage as the charity is at least two steps removed from the actual sales effort. Coupled with that, in my experience the contractual arrangements of such activities is not well documented – particularly in respect of the legal relationship and responsibilities regarding data. We’ve found many instances of charities employing several data a processors with no data processing agreement in place and only very basic data protection provisions in a commercial agreement. In many cases the collector has proposed the commercial agreement which the charity has adopted to reduce its legal fees – but this is false economy as the agreements like this are stacked in favour of the collector and contain very weak data protection provisions.

Keeping a log of all such arrangements, using robust data processor agreements giving the charity the rights it needs to protect itself and members of the public is vital. We’re often asked to carry out due diligence on collectors for charities and have been on several site visits to assess their operations – particularly from an information governance and management control perspective. Pre-contract due diligence is another vital process that charities need to undertake.

In my experience charities generally expect collectors to behave responsibly and respectfully – but these are independent commercial sales operations that are usually incentivised by an income based on funds raised.

Contact Us

Send us a Message

Data Protection Project
GDPR Gap Analysis/Audit/Review
Outsourced Privacy Officer/DPO
Support Desk
SAR Support
Cyber Maturity Assessment
NIS Regulations
Information Governance Documentation
DataWise System

We are always happy to make contact with you by either phone, email or a face to face meeting at our office or yours. We work standard UK office hours – every week day 0830 to 1730.


We have been advising those people who have contacted us that they should make a complaint to the Information Commissioner’s Office (ICO) using this link  It would be helpful to the ICO if you knew the number that called you, the date and time of the call and what the call seemed to be about.

You might also want to register your phone number with the telephone preference service (TPS), a national suppression service which should cut down calls of this nature as it is not lawful to make unsolicited direct marketing calls to numbers registered on the TPS.  You can register your number here

We know that these kind of calls can be distressing and intrusive and you have our sympathy.  Please do not hesitate to contact us if you would like to discuss it with us otherwise we’d encourage you to report it to the ICO as notifying them of this kind of practice enables them to investigate and take enforcement action where necessary.  You can see the action that has been taken by the ICO here

Data Protection People Limited – March 2021