5. What UK Charities Get Wrong About GDPR and AI

The contents of this blog is for information purposes and does not constitute legal advice.

If there's one thing that stops charities from using AI, it isn't cost. It isn't skills. It's fear of getting GDPR wrong.

The 2026 Charity Digital Skills data shows that 43% of charities say data privacy and GDPR concerns are preventing them from adopting AI further.

And here's the problem: most of the fear of using AI is disproportionate to the actual risk. Not because data protection doesn't matter — it does, enormously — but because most charity AI use doesn't involve personal data at all. The sector is frozen at green-light tasks because it's imagining red-light scenarios.

This post explains where the real GDPR risks sit when charities use AI, where the risk is minimal, and — crucially — what free tools and guidance the ICO already provides that most charities aren't using. Because the regulator has done a significant amount of work to make compliance accessible, and it's sitting there waiting to be picked up.

The three tiers of AI risk for charities

We introduced this framework in Episode 1 of this series, but it's worth expanding here because it's the key to understanding where GDPR actually bites.

Tier 1: No personal data involved. This covers the vast majority of how charities use AI today. Drafting a newsletter about your services. Summarising a publicly available report. Structuring a grant application. Brainstorming social media content. Writing board paper agendas. Tidying up meeting notes that contain no names.

From a GDPR perspective, Tier 1 use requires no additional data protection action beyond your existing policies. You're not processing personal data. The AI tool is functioning as a writing assistant, not a data processor. Most charities could use AI for Tier 1 tasks tomorrow with zero regulatory risk — and this is where the bulk of the time savings sit.

Tier 2: Anonymised or aggregated data. Analysing service delivery trends from monitoring data where individuals can't be identified. Summarising survey responses. Looking at demographic patterns in your beneficiary base using aggregate figures. Generating insights from anonymised feedback.

Tier 2 is where things get more nuanced. Truly anonymised data falls outside UK GDPR entirely — if you can't identify anyone from the data, it isn't personal data. But anonymisation is harder than most people think. If your dataset includes "female, age 42, attended our Bristol service in March 2025," that might be enough to identify someone in a small charity's records. The ICO's anonymisation guidance is clear that if there's a reasonable likelihood of re-identification, the data is still personal data.

For Tier 2 use, the practical step is to review your anonymisation before inputting data into any AI tool. If you're genuinely working with aggregated numbers and no identifying detail, you're fine. If there's any doubt, treat it as Tier 3.

Tier 3: Personal data is involved. This means names, case notes, beneficiary records, safeguarding information, health data, donor contact details, or anything else that identifies or could identify a living individual. Entering Tier 3 data into a third-party AI tool like ChatGPT or Claude raises immediate GDPR questions about lawful basis, data processing agreements, international transfers, and data minimisation.

For most small charities, the answer to Tier 3 is straightforward: don't do it. Not because it's technically impossible to use AI with personal data compliantly, but because the compliance burden is disproportionate for a small organisation, and the use cases that require personal data in an AI prompt are rare (although please do share examples). The time saved by using AI to summarise a case file is not worth the governance overhead of making that processing compliant.

The point of this framework isn't to make Tier 3 seem terrifying. It's to make Tier 1 and 2 feel accessible — because they are.

What the ICO has already built for you

Here's what most charities don't know: the ICO has produced a substantial library of free tools, templates, and guidance designed specifically for small organisations — including charities. Most of it isn't AI-specific, but it provides the foundational data protection infrastructure that makes AI use straightforward. If your charity has this infrastructure in place, adding AI into your operations is a much smaller step than it feels.

Here's what's available and how it connects to AI adoption:

The Privacy Notice Generator (ico.org.uk/create-your-own-privacy-notice) A free online tool that creates a bespoke privacy notice for your organisation in under 15 minutes. It has a specific section for the charity and voluntary sector. If your charity uses AI tools that process any data — even if it's just staff email addresses for account setup — your privacy notice should reflect this. The generator won't add AI-specific language automatically, but it builds the foundation. You can then add a short paragraph about AI tool use (which tools you use, the fact that no personal data is entered, and that outputs are reviewed by staff).

The Data Protection Self-Assessment (ico.org.uk — checklists section) Free checklists for small and medium organisations, covering your obligations as a data controller. Completing this before you adopt AI tools means you'll know whether your baseline data protection is sound. There's no point worrying about AI-specific risks if your records of processing activities are out of date or your subject access request process doesn't exist.

The DPIA Template (available on the ICO's DPIA guidance pages) A sample Data Protection Impact Assessment template that you can download and adapt. If your charity is considering Tier 2 or Tier 3 AI use — meaning any AI processing that involves personal or potentially identifiable data — a DPIA is likely required. The ICO's template walks you through the process step by step: what processing you're doing, why, what the risks are, and how you'll mitigate them. For a small charity considering whether to use AI for anything beyond Tier 1, this template is your starting point.

The AI and Data Protection Risk Toolkit (downloadable Excel spreadsheet from the ICO's AI guidance pages) This is the most directly relevant resource and the least well-known. It's a practical self-assessment tool designed to help organisations audit the compliance of their own AI systems. For a charity that's moved beyond basic ChatGPT use into any form of automated analysis or decision-support, this toolkit helps you identify where data protection risks sit and what measures to put in place. It's designed around the AI lifecycle and links directly to the relevant sections of ICO guidance.

The AI and Data Protection Guidance itself (ico.org.uk/artificial-intelligence) A detailed guide covering how UK GDPR applies to AI, structured around the data protection principles. It covers lawful basis, purpose limitation, data minimisation, accuracy, storage limitation, and security — all applied specifically to AI systems. Note that this guidance is currently under review following the Data (Use and Access) Act 2025, and a statutory code of practice on AI and automated decision-making is in development. But the existing guidance remains the best available reference.

The Dedicated Small Business Helpline (0303 123 1113, option 4) A phone line staffed by ICO advisers who specialise in helping small organisations. If you've read the guidance and still have questions about whether your AI use requires a DPIA or what lawful basis applies, you can call and ask. This service exists and it's free.

So where does AI actually add risk beyond what the ICO materials cover?

If your charity has its data protection house in order — privacy notice in place, records of processing up to date, staff aware of their responsibilities — then adding AI into your operations introduces a small number of additional considerations that the existing ICO materials don't fully address. This is where a sector-specific approach adds value.

The third-party processing question. When you use ChatGPT, Claude, or any cloud-based AI tool, you're sending data to a third-party server. For Tier 1 use (no personal data), this isn't a GDPR issue. But if any personal data enters the tool, the AI provider becomes a data processor — and you need a data processing agreement. Most AI providers include this in their terms of service for paid tiers, but free tiers often don't offer the same contractual protections. The ICO's general guidance on data processors covers the principles, but translating this to the specific context of AI tool providers requires some interpretation that most charities aren't equipped to do alone.

The international transfer question. Most AI tools process data on servers outside the UK. For Tier 1 use, this isn't personal data so transfer rules don't apply. For anything involving personal data, the UK's international data transfer framework applies. The DUAA 2025 has amended some aspects of how international transfers work — but for most small charities, the practical answer is to avoid putting personal data into AI tools altogether, which sidesteps the transfer question entirely.

The accuracy obligation. UK GDPR requires that personal data is accurate. If you use AI to generate text about your beneficiaries or your services and that text contains errors — which AI tools routinely produce — you may have an accuracy problem if the output is treated as a record. This is why the human review requirement in your AI policy isn't just good practice — it's a data protection safeguard.

The model training question. Free-tier AI tools typically use your inputs to improve their models. This means anything you enter may be retained and used in ways you can't control. For personal data, this creates an obvious problem — but even for non-personal data, it means proprietary information about your charity's operations could end up in a training dataset. Paid tiers typically offer opt-outs from training data use, which is why your AI policy should specify which tier or plan staff are using.

The practical path: ICO materials first, then AI-specific guidance

The honest truth is that most charities don't need AI-specific GDPR guidance. They need basic data protection infrastructure — and the ICO provides everything required for that, free of charge. The sequence should be:

First, complete the ICO's Data Protection Self-Assessment. This tells you whether your foundation is solid. If it isn't, fix the basics before worrying about AI.

Second, run the ICO's Privacy Notice Generator and check that your notice is current. If you're using AI tools, add a sentence about them.

Third, if you're considering any AI use beyond Tier 1, download the ICO's DPIA template and the AI Risk Toolkit. Work through them. They're more detailed than you need for basic use — but they're the right tool if you're thinking about using data analytics or any processing that involves identifiable information.

Fourth, for the AI-specific layer — data classification for AI inputs, staff guidance on which tier of data can go where, the model training question, and the international transfer question — this is where sector-specific guidance adds value. The ICO's materials cover the regulatory framework. They don't cover the practical interpretation for a charity team that wants to know "can I paste this monitoring data into ChatGPT?" That translation — from regulation to Tuesday-morning decision — is what the toolkit's governance module is designed to provide.

The Data (Use and Access) Act 2025: one thing charities should know

One practical change that has flown under the radar: the DUAA 2025 introduced a "soft opt-in" for charity email marketing. Previously, charities generally needed explicit consent to send marketing emails. Under the new provision, if someone has supported your charity or expressed interest in your work, you can send them electronic marketing communications — unless they object. This doesn't change AI-related data protection, but it's directly relevant if you're building an email list (as you should be) and worth knowing about alongside AI policy development.

The bottom line

Data protection is genuinely important. But GDPR anxiety is costing the charity sector more than GDPR non-compliance. The ICO has built free tools that most charities aren't using. Most charity AI use involves no personal data and therefore no additional GDPR burden. And for the small number of use cases that do involve personal data, the path to compliance is documented, templated, and supported by a free helpline.

The fear is understandable. But the answer isn't to avoid AI. It's to understand where the line sits, use the free resources that already exist, and add sector-specific guidance where the ICO's materials stop.

Our free AI Readiness Audit includes a data protection readiness check. And Module 4 of the toolkit provides a data classification guide, a charity-adapted DPIA template, and the staff guidance that bridges the gap between ICO frameworks and daily practice. But start with the ICO materials — they're free, they're authoritative, and they're more accessible than most people expect.