Data Protection in the Charity Sector: What Can Irish Charities Learn from the DPC?

Charities are built on trust. People give them their money, their time – and often deeply personal information

But what happens when that information is lost, disclosed, or simply not properly understood?

Recent Data Protection Commission (DPC) cases involving charities provide some uncomfortable lessons. The problems aren't always sophisticated cyberattacks. Sometimes they're much more basic: unclear responsibilities, inadequate contracts, poor staff awareness, and organisations not knowing exactly what personal data they hold.

If you work for a charity, sit on a board, or are responsible for GDPR compliance, these cases are worth paying attention to.

18 charities. One data processor. A lot of questions

One of the most striking DPC cases involved 18 organisations in the charity sector that used the same external data processor.

The processor suffered a cyberattack. Data was exfiltrated, a database was deleted and a ransom demand was made.

But the cyberattack wasn't the only problem.

When the DPC looked at the organisations' GDPR arrangements, it found a number of weaknesses.

Only 8 of the 18 organisations could confirm that they had an existing data-breach incident response plan.

Several organisations could not confirm what categories of personal data they held.

Most did not have an appropriate Article 28 controller-processor agreement with the processor.

And some organisations had not carried out a Data Protection Impact Assessment (DPIA).

The DPC's findings provide a useful reminder that outsourcing your data processing doesn't mean outsourcing your GDPR responsibilities.

The supplier problem

Charities increasingly rely on external providers.

Cloud storage.

Fundraising platforms.

CRMs.

Email marketing systems.

Website providers.

Payroll systems.

Volunteer-management platforms.

The list goes on.

It's tempting to think:

"The supplier is a big company. They deal with GDPR."

But GDPR doesn't work that way.

If your charity is the controller, you still have responsibilities for the processing you have instructed your processor to carry out.

That means asking some fairly basic questions:

What personal data are we giving them?

Why do they need it?

Where is it being stored?

Who can access it?

Are there sub-processors?

What happens if they have a breach?

Do we have an appropriate Article 28 agreement?

The DPC's charity-sector case shows why these aren't theoretical questions.

It doesn't always take a hacker

When people hear "data breach", they often imagine ransomware or a sophisticated cyberattack.

But one DPC charity case involved something considerably simpler.

An email newsletter was sent using CC rather than BCC.

The result?

Recipients could see the email addresses of other people who had received the newsletter.

The DPC also identified poor awareness of data protection responsibilities among staff and volunteers.

The organisation subsequently introduced data protection training for staff and volunteers and established a management role with responsibility for data protection compliance.

This is a useful lesson for charities.

Your biggest data-protection problem may not be the hacker trying to break into your system.

It may be the perfectly well-intentioned volunteer who doesn't realise that putting 80 email addresses into the CC field discloses them to everyone on the list.

Volunteers are part of your data-protection system

Charities depend heavily on volunteers.

But if volunteers handle personal data, they are also part of the organisation's data-protection environment.

They may have access to:

• mailing lists;

• donor information;

• membership information;

• photographs;

• event registrations;

• beneficiary information;

• spreadsheets; or

• email accounts.

The DPC's case involving the newsletter demonstrates why organisations need to think about data protection awareness across the organisation, rather than assuming that GDPR training is simply an HR exercise for employees.

A useful question for charities is:

If a volunteer started tomorrow, would we know exactly what personal data they are allowed to access – and what they are not allowed to access?

Do you actually know what data you hold?

This sounds obvious.

But it is one of the most important questions a charity can ask.

The DPC's investigation involving the 18 charities found that several organisations could not confirm the categories of personal data they held.

That matters because you cannot properly protect information if you don't know what information you have.

A charity may have information scattered across:

• email accounts;

• shared drives;

• cloud systems;

• paper files;

• spreadsheets;

• fundraising databases;

• volunteer records;

• HR systems;

• old laptops; and

• third-party platforms.

And some charities deal with particularly sensitive information.

Vulnerable people. Sensitive information

Charities can process information about some of the most vulnerable people in society.

Depending on the charity's work, that might include information about health, disability, family circumstances, financial difficulties or other highly personal matters.

Some of this information may constitute special-category personal data under Article 9 GDPR.

That raises the stakes.

A lost donor mailing list is a problem.

A disclosure involving sensitive information about a vulnerable service user can be something very different.

The DPC has specifically highlighted the processing of personal data relating to vulnerable people and special-category data in its charity-sector work.

251 breach notifications

There is also evidence that data breaches are not simply an occasional problem for the charity sector.

In its 2024 Annual Report, the DPC reported receiving 251 GDPR breach notifications from the voluntary and charity sector.

Across all sectors, the DPC received 7,346 GDPR breach notifications.

The DPC also reported that 50% of breach notifications arose from correspondence being sent to the wrong recipient.

That doesn't mean that charities are necessarily more likely to experience a breach than other sectors.

But it does demonstrate something important:

Data breaches are an everyday operational risk.

And many don't require sophisticated technology.

Sometimes they require only the wrong email address.

The retention problem

There is another question charities should be asking:

How long are we keeping this information?

It is surprisingly easy for charities to accumulate personal data.

A volunteer leaves.

A donor stops giving.

A member hasn't been involved for years.

A service user's case is closed.

An old spreadsheet remains on a shared drive.

Nobody deletes it because nobody is quite sure whether it can be deleted.

And so it stays there.

For another year.

Then another.

The GDPR's storage limitation principle means personal data should not be kept indefinitely simply because it might be useful at some point in the future.

The Charities Regulator also advises charities to consider what personal data they hold, why they hold it, and how personal data is obtained, stored and removed.

Good retention isn't about deleting everything as quickly as possible.

It's about being able to answer:

Why are we still keeping this?

What about fundraising?

Fundraising creates another significant area of data-protection risk.

Charities may hold information about donors, including names, addresses, email addresses, telephone numbers, donation histories and communication preferences.

The Charities Regulator's fundraising guidance highlights issues including transparency, data minimisation, retention, security and marketing preferences.

That means charities should be able to explain:

Why are we contacting this person?

What information are we using?

What is our lawful basis?

Have we respected their marketing preferences?

How long are we going to keep the information?

These aren't just questions for the fundraising department.

They are governance questions.

What can a charity do?

The good news is that GDPR compliance doesn't have to mean creating a mountain of paperwork.

Start with the basics.

1. Map your personal data

What information do you hold?

Where is it?

Who has access?

Who is it shared with?

2. Review your suppliers

Make a list of the external organisations processing personal data for you.

Then ask whether your contractual arrangements properly reflect GDPR requirements.

3. Check your volunteers

Do they understand the information they can access?

Do they know what they can and cannot share?

Do they know what to do if they make a mistake?

4. Review your retention

Look at old databases, spreadsheets, email accounts and paper files.

Ask the uncomfortable question:

Why are we still keeping this?

5. Have a breach plan

Don't wait until a breach happens to decide who should be contacted.

The DPC's finding that only 8 of the 18 charities in one case could confirm that they had an existing breach response plan is a useful warning.

6. Think about vulnerable people

If your charity works with vulnerable individuals, consider whether your security measures and procedures are appropriate for the sensitivity of the information involved.

Data protection is a governance issue

Perhaps the biggest lesson from the DPC's charity-sector cases is that GDPR shouldn't sit in a drawer labelled "compliance".

It needs to be part of how the organisation operates.

Trustees need to understand their responsibilities.

Managers need to understand the risks.

Staff need to know what to do.

Volunteers need appropriate guidance.

Suppliers need to be properly managed.

And someone needs to have clear responsibility for data protection.

The DPC's cases show that the problem isn't necessarily that charities don't care about data protection.

Often, the problem is that good intentions haven't been translated into systems, procedures and accountability.

The trust behind the data

At the end of the day, charity data isn't really about databases, spreadsheets or email addresses.

It's about people.

A donor trusting you with their contact details.

A volunteer trusting you with their information.

A service user trusting you with details about their circumstances.

And, in many cases, a vulnerable person trusting you with some of the most private information about their life.

That trust is worth protecting.

Good data protection isn't simply about avoiding a GDPR breach.

It's about making sure that the people who trust your charity have good reason to continue doing so.

Is your charity confident about its data protection?

If you aren't sure what personal data your charity holds, who can access it, how long it should be retained, or whether your third-party suppliers are properly managed, a GDPR health check can help identify the gaps.

A practical review can look at:

• Data mapping

• Privacy notices

• Retention and deletion

• Data breaches

• Staff and volunteer training

• Processor agreements

• Data subject rights

• Information security

• Fundraising and marketing

• GDPR accountability

Good data protection doesn't have to mean unnecessary bureaucracy.

It means putting proportionate systems in place to protect the people your charity exists to support.