New guidance for charities from the ICO and Fundraising Regulator (FR) on the ‘soft opt in’ permitting electronic fundraising/marketing messages

Detailed ICO guidance has been finalised and published, explaining how the regulator expects all organisations to meet expectations when handling complaints about data protection, a new right given to individuals from 19th June 2025 (introduced by last year’s Data (Use and Access) Act 2025).

In their published reprimand, the ICO illuminates what compliance safeguards it expects from all organisations – not only GPs – handling disclosures of information about health (‘special category’ data).

Last year’s DUAA updated several data protection law provisions. Regulations made on 29th January 2026 clarified the dates on which these changes come into force. Last Friday the ICO published a statement on the commencement dates. 

Last week, the Information Commissioner’s Office (ICO) published new guidance for the education sector, including independent schools, on sharing information to safeguard children and young people.  

 The Information Commissioner’s Office (ICO) last week announced having opened consultation with the voluntary/third sector. 

UK education sector at higher risk of cyber attack than other UK businesses – and what the ICO has to say

Last month, Navigator delivered a webinar for the third sector, explaining how the new Data (Use and Access) Act 2025 enables charities engaged in direct marketing and fundraising to rely on the “soft opt-in”.

On Monday this week, the ICO announced in the news section of its website that it has imposed an £18,000 fine on Scottish charity Birthlink, a charity specialising in post-adoption support and advice, for people who have been affected by adoption with a Scottish connection.

The UK Data (Use and Access) Act (DUAA) became law on 19 June 2025. From a compliance perspective, the new law will have limited impact on most organisations, although it is likely to require some updates and changes to some internal practices and current policies.

A new Code of Fundraising Practice comes into effect on 1st November 2025.  It applies to fundraising conducted by all charitable institutions and third-party fundraisers in the UK.

The UK’s government’s Department for Science, Innovation and Technology (DSIT) has finalised and published its Cyber Governance Code of Practice. This new Code is another part of the UK government's free resources, offered in conjunction with Cyber Governance Training, and the Cyber Security Toolkit for Boards, and the Cyber Essentials scheme.