GDPR does not expect charities to achieve perfection. It expects organisations to take reasonable and proportionate steps based on their size, activities, and risk.
For charities with limited resources, focusing on the basics makes a significant difference.
Practical steps that matter most
Charities should prioritise:
- Knowing what personal data they hold
- Understanding why they hold it
- Limiting access to those who need it
- Storing data securely
- Deleting data when it is no longer needed
These steps address the majority of GDPR risk.
Policies, awareness, and documentation
Simple documentation helps demonstrate compliance, including:
- Clear privacy notices
- Basic data protection policies
- Staff and volunteer awareness
- Incident reporting processes
Guidance from the Information Commissioner’s Office emphasises proportionality, particularly for charities and small organisations.
GDPR as an ongoing process
GDPR compliance is not a one-off exercise. It should be reviewed periodically, especially when:
- New systems are introduced
- Services change
- New types of data are collected
Support from an MSP can help charities stay on track without unnecessary complexity.
Want this looked after for you?
ABCOM has supported Sussex businesses and charities since 1996 and is an NCSC Assured Service Provider – Cyber Advisor (Cyber Essentials). Talk to a real person about your IT.
Also read
How ABCOM can help
Talk to a real person at our Burgess Hill office. We are an NCSC Assured Service Provider and have supported Sussex businesses since 1996.