The Institute of Fundraising (the ‘IoF’) has updated
its guidance, GDPR: The Essentials for Fundraising Organisations,
to take into account a number of questions the IoF has received
from fundraisers since the introduction of GDPR last May.
The guidance was originally published before GDPR came into
effect, and – although this should be viewed more as an
update than saying anything substantially new – the IoF hopes
that updating it will emphasise to fundraisers the importance of
regularly reviewing their data processing procedures and ensuring
they are operating in line with the law.
The focus of the guidance remains on how charities decide on
which lawful basis of processing personal data they should rely on
in a particular situation. In relation to fundraising activities,
other than unsolicited e-marketing regulated under PECR (see
below), this generally means a choice between individual consent or
legitimate interests. Ultimately, the guidance concludes that
