Soft-opt in guidance for charities omits initial collection requirement

In a post on his personal blog, Jon Baines highlights a potential compliance issue (first raised on LinkedIn by Adrian Beney) arising from new Fundraising Regulator (FR) guidance on the direct electronic marketing exceptions for charities under the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). 

Through an amendment in the Data (Use and Access) Act 2025 (DUA Act) that took effect in February 2026, charities can use the soft opt-in exception to send unsolicited marketing without prior consent, provided recipients were given a simple means to opt out when their details were initially collected.

However, FR's guidance suggests that charities can lawfully apply this soft opt-in during annual contact detail updates, despite not offering an opt-out when their details were first obtained. As Baines (and Beney) point out, the advice contradicts established practice, including a £13,000 monetary penalty issued to Honda by the Information Commissioner's Office (ICO) in 2017.

Baines added that the discrepancy appears to stem from the ICO not making this point clear in its charitable purposes soft opt-in guidance.

Baines notes that the ICO will, in all likelihood, have to clarify its interpretation of the statutory requirement, as the current wording may inadvertently encourage organisations to unlawfully target existing contacts who lack recorded marketing preferences.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.