The Data (Use and Access) Act 2025 (DUAA) introduces a welcome reform that will reshape how charities manage their marketing communications and uphold data protection rules.
The Privacy and Electronic Communications Regulations 2003 (PECR) require organisations to obtain a person’s explicit consent to send them electronic direct marketing communications. Commercial organisations benefit from a soft opt-in exemption which allows them to send electronic marketing communications to customers who have supplied their contact details as part of an earlier purchase or negotiation. Charities however have not been able to rely on this exemption to send fundraising messages to supporters about the initiatives they are undertaking.
As noted in our previous article on this legislation, the DUAA amends the PECR rules to allow charities to benefit from the soft opt-in exception to contact individuals who have expressed an interest in or offered to support a charity without needing their prior consent to send them direct marketing by emails and text messages. To rely on the exemption all of the following must apply:
- The sole purpose of the direct marketing is to further one or more of the charity’s purposes.
- The charity obtained the individual’s contact details through the individual expressing an interest in the charity’s purposes or offering or providing support to further one or more of those purposes.
- The individual is presented with a simple means of refusing the use of their contact details for the purposes of direct marketing at the time their details are collected and in every subsequent communication.
Practical implications of these changes
- The wording of the legislation suggests that it is not retrospective. Charities therefore cannot rely on the exemption to send communications to individuals who supported the charity before the relevant provisions in the DUAA take effect. That means maintaining two parallel marketing lists:
(a) One for the people who have given consent under current rules.
(b) Another for new supporters whose details will qualify for the charitable soft opt-in.
This could create confusion for charities, and it does seem to reduce the usefulness of the new regime.
- We recommend periodically reviewing and updating privacy notices to clearly state the legal basis for using personal data for direct marketing and specifying the types of communications that supporters will receive. Opt-out statements and easy unsubscribe/update your preferences mechanisms will also need to be added to all webpages and materials sent to supporters.
- Where a charity proposes relying on legitimate interest as its basis for processing, it should conduct a legitimate interest assessment to assess its interests and balance them against the impact on individual rights and freedoms.
- Charities should also review the updated guidance from the Information Commissioner’s Office (ICO) and the Fundraising Regulator once it becomes available. The Fundraising Regulator has already published its response to the ICO’s consultation on the introduction of the soft opt-in exemption to charities and believes it represents a “welcome opportunity” but made clear that “charity trustees, their staff and fundraisers will need to exercise caution and maintain vigilance when using soft opt-in”.
Is this a positive development?
These changes are designed to help charities strengthen engagement with supporters who have shown interest in their work and improve fundraising efforts, so should be good news. However, it is worth remembering that although the charity soft opt-in may be legally available, it might not be appropriate in some instances. For example, contacting someone on a charity’s database who previously sought confidential support from the charity could cause them distress or harm.
The DUAA is now law, but not all provisions are in force yet, including the changes relating to the charitable purpose soft opt-in. These changes were expected to come into force later this month. Charities should be preparing for the changes. We recommend that charities should consider whether the soft opt-in exemption is right for your organisation. If you have questions about how the soft opt-in exemption might apply to your organisation, please do not hesitate to contact our Commercial & Technology team at [email protected].
