The Data Use and Access Act—changes to the soft opt-in rules for charities explained

The soft opt-in is an exemption under PECR that allows organisations to send electronic marketing (such as emails and texts) without first obtaining UK GDPR-standard consent, provided certain conditions are met.

Currently, it can only be used in situations where someone’s contact details have been collected in the course of the sale (or negotiation for the sale) of goods or services. In those situations, the soft opt-in allows organisations to market similar products or services on an opt-out basis.

Since most charities do not sell goods or services commercially, they have not been able to use the soft opt-in. Instead, charities have had to get affirmative opt-in consent from individuals before being able to send electronic marketing communications.

No. The new provision will only apply to organisations defined as charities under section 1 of the Charities Act 2011 in England and Wales, or the equivalent legislation in Scotland and Northern Ireland. 

If your organisation is unsure whether it meets the legal definition of a charity, you should seek legal advice before changing your approach.

Charities will be able to rely on the soft opt-in when all three of the following conditions are met:

1. purpose: the sole purpose of the communication is to further one or more of the charity’s charitable purposes as defined in law
2. source of contact details: the contact details were collected when the person expressed interest in the charity’s purposes or offered support to further those purposes
3. opt-out: the person was given the chance to opt out when their details were collected and is offered an easy opt-out (e.g. an unsubscribe link) in every subsequent message

This change could be highly beneficial for charity marketing and fundraising teams. Potential benefits include:

• growing mailing lists without relying solely on opt-in tick boxes
• reducing supporter drop-off during sign-up processes
• keeping in touch more easily with individuals who have engaged with your charity’s work (e.g. people who make one-off donations, people who volunteer at an event, supporters take part in challenge or fundraising events)

While this is an exciting development for charity marketing and fundraising teams, it’s important to note that the changes will not apply retrospectively. 

Data protection law is clear: if you told individuals their data would only be used with consent, you cannot switch to a different lawful basis later. This means the new soft opt-in approach can only be used where contact details are collected after the new rules take effect, and in compliance with the conditions set out above.

While some parts of the DUAA came into force immediately, these changes will require further secondary legislation to bring them into effect. Currently, government guidance indicates that this will happen in around December 2025.

To make the most of the change when it comes into force, charities should use the next few months to:

• review supporter journeys to identify points where people express interest or offer support
• design and test opt-out mechanisms to ensure they are clear and user-friendly
• update privacy notices and opt-out wording
• train fundraising and marketing teams on the new rules
  segregate pre-change and post-change contact lists to avoid compliance breaches

The DUAA introduces a range of other changes that are outside the scope of this article, including in the areas of scientific research, automated decision-making, cookie compliance and subject access requests. It also introduces some new requirements, including around handling of complaints about personal data use.

If you would like tailored advice on these changes and how they apply to your organisation, our data protection and charity law team can help you prepare with confidence.

Carla Whalen is a partner in the charity and not for profit law team, specialising in employment and data protection law and advising charities and not for profits with people issues, including employee, volunteer, trustee, and member & beneficiary concerns.