We process personal data in order to carry out our function as the independent regulator of Charities for England and Wales. Our objectives, functions and powers are set out in the Charities Acts 1992, 2006, and 2011. References to ‘the Charities Acts’ in this document mean those acts.
You can find out further information about what we do on our about us page.
This privacy notice
This privacy notice explains how we process your personal data. It also sets out some of your rights and entitlements in respect of that personal data. It is written to be as easy to read as possible and does not provide exhaustive detail of every aspect of how we collect or use your personal data.
It is important to understand that in certain circumstances, and only where it is necessary to do so, the Commission has the power to collect, process and further disclose personal information without your knowledge and consent. You can find out more about the personal data we process in this privacy notice.
This notice does not address processing for Human Resource (‘HR’) purposes. If you’re applying for a job or contract with us, if you work for us, or if someone you know works for the Charity Commission, you may wish to read our privacy notice for employees, workers and contractors which is available on our the staff intranet for Charity Commission employees.
We have also prepared more detailed privacy notices for some of the things we do.
If you need further information about the use of your personal data or to exercise your statutory rights please email RIGA@charitycommission.gsi.gov.uk
The personal data we process
We have set out below some of the types of information we collect and where we collect it from. We’ve also explained below whether you have to provide certain information to us.
The personal data we collect and process will vary depending upon the type of interaction we have with you, but it can include particularly sensitive personal data such as information about religion, sex, ethnicity, health and criminal convictions. Data such as this is known in legal terms as ‘special categories of personal data’. References in this document to particularly sensitive personal data include references to special categories of personal data and criminal conviction data.
We may not always be able to provide you with full details of the sources and types of information we collect and the list set out below might not be complete. This is because disclosure might allow individuals and organisations to avoid complying with their legal requirements and to evade detection by learning our techniques and sources. But, if you require further information about the data we hold about you then can email us at RIGA@charitycommission.gsi.gov.uk.
We collect and process a variety of different types of personal data including:
identity details: such as your name, alias, title, date of birth and gender
contact details: including your home and professional addresses, email addresses, and telephone numbers
details of organisations you’re involved with: this might include information about your employer, professional organisation, your connection to a potentially charitable organisation or an organisation seeking registration as a charity, or where you spend your free time. It might also reveal or include particularly sensitive personal data such as your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, or information about your health or genetics
financial, employment, salary, travel and taxation information: including bank or credit card statements, records from HMRC, records of expenditure, HR or employment records
criminal conviction data and information relating to alleged unlawful conduct: this might include your criminal record, or intelligence from regulators or law enforcement agencies
technical data: IP addresses are collected in furtherance of our regulatory objective to ensure that charity registration is proper, and is not being used in a way which would enable fraudulent abuse or misconduct
Where do we get information from?
We collect personal data from a variety of sources including:
Directly from you
We collect data directly from you, for example when you fill out an online form, complete a paper return or correspond with us verbally or through email, post, phone or similar media. When you use our online services we collect technical data from users which we use to improve how our digital services function. This is explained in more detail in the section on technical data above and the section on cookies below.
From organisations you’re involved with
We will collect personal data from organisations you are involved with, for example when an annual return is filed or a serious incident is reported. This may include all of the categories of personal data section above, some of which may not be publicly available.
From members of the public or third party organisations
We receive personal data from members of the public or third party organisations. For example by way of an unsolicited report, disclosure or complaint, or where we request, direct or use our regulatory powers to require that certain information is provided to us.
This information may be obtained electronically, on paper or through verbal contact with a charity, or organisations with which a charity is involved. This personal data may include both financial and non financial information about you and may include sensitive personal data including all of the categories of personal data referred to above, some of which may not be publicly available. We also may generate personal data by associating findings from our regulatory work with data we already hold about you.
We also receive a limited amount of personal data from third party organisations in order to assist us in keeping up to date, develop policy and forecast future trends. This includes press cutting services and other services which provide reports and analysis.
From other government departments, regulators, law enforcement agencies and similar organisations
We share and receive information from these types of organisation because it helps us to fulfil our functions.
For some organisations, including the Insolvency Service and Companies House, we regularly and routinely collect large amounts of data so that we can data match against the data we hold. The information we receive and data match includes identity details, contact details, information about insolvency, criminal conviction data and details of alleged wrongful conduct.
We also share and receive information in response to specific requests or disclosures. This may include all of the categories of personal data referred to above, some of which may not be publicly available. We have Memoranda of Understanding or contracts with some organisations where the sharing of data occurs on a regular basis
From publicly available sources
We collect personal data from publicly available sources such as websites, statutory registers and public records.
This may include all of the categories of personal data referred to above, some of which may not be publicly available.
When you need to provide information and what happens if you do not
The information you need to provide depends on the nature of your interaction with us.
If you are a trustee or hold a senior management role in a registered charity or a registerable organisation, you may be required to provide us with certain information pursuant to the Charities Acts. Failure to comply may be a criminal offence. Find out more about registration and reporting requirements.
If you want us to take a particular step or action in respect of a charity (for example waiving automatic disqualification as a trustee, or approving a payment), you may need provide certain information to us so we can decide whether to take the step or give or withhold our consent. If you don’t provide the information we require, we may not be able to assist you.
We may specifically direct or order you to provide us with certain information using our powers in the Charities Acts. If we exercise those powers you are required to comply and failure to provide the information may be a criminal offence. We will tell you when we are exercising our powers under the Charities Acts when we make the request. You can find further information about some of our information gathering powers at Sections 47 & 52 of the Charities Act 2011.
If you want us to provide you with information, for example pursuant to the Freedom of Information Act 2000 (‘FOIA’) or under our statutory powers, we may need you to provide us with contact details so that we can seek clarification or provide you with the information requested. If you don’t, we may not be able to provide you with the information you need.
If you respond to a consultation or participate in working parties, committees or similar activities convened by us you will be asked to provide personal data (such as contact or identity details) as part of your participation. This is to help us develop high quality policies and guidance and to better understand and work with the sector. If you do not provide this personal data we may not be able to take your contribution into account or give it the same weight as if you had provided personal data to us.
If you are seeking employment with us, or if you want to enter into a different type of contract with us, it may be necessary for you to provide us with certain information in order to enter into that contract. If you don’t then we may not be able to contract with you or offer you employment.
Why we process personal data
We process personal data to fulfil our statutory functions. Our processing can be divided into three broad categories:
Processing that supports our statutory objectives, functions and duties
We process personal data in order to carry out our function as the independent regulator of Charities for England and Wales. Our objectives, functions and duties are set out in the Charities Acts.
This includes things like:
- increasing public trust and confidence in charities
- promoting awareness and understanding of the operation of the public benefit requirement
- promoting compliance by charity trustees with their legal obligations in exercising control and management of the administration of their charities
- promoting the effective use of charitable resources
- enhancing the accountability of charities to donors, beneficiaries and the general public
- determining whether institutions are or are not charities
- identifying and investigating apparent misconduct or mismanagement in the administration of charities and taking remedial or protective action in connection with misconduct or mismanagement in the administration of charities
- giving information or advice, or making proposals, to any Minister of the Crown on matters relating to any of the Commission’s functions or meeting any of its objectives
Our functions, objectives and duties necessarily include:
- conducting research; such as thematic reports into accounts, or into public trust and confidence in the charity sector
- developing guidance to assist charities and trustees better comply with their duties under charity law
- operating an International Programme to assist charities operating internationally, including in high-risk areas. We organise workshops and events to facilitate the programme, which aims to educate, inform and provide guidance for charities who operate overseas
Find out more about our objectives, functions and powers
Processing in our wider capacity as a government department and a public authority and in order to comply with the obligations which arise in that capacity
We process personal data in order to fulfil our wider role as a government department and as a public authority. This includes things like: sharing information with other public authorities pursuant to the Charities Acts, complying with the Public Records Act, complying with the principles of open justice and open government, and responding to requests under the FOIA.
Processing in our capacity as a large organisation and employer
We also process personal data in order to ensure that we have the resources and staff we need to carry out our work.
This includes things like processing financial information about our staff and suppliers; supporting staff members who have health problems, accidents or injuries; the recruitment and selection of staff; and providing references and pension information about staff who were previously employed by us.
Why we collect personal data
We generally only collect personal data where it is necessary to directly support or facilitate our statutory objectives and functions, or in our capacity as a large organisation and employer.
We don’t often collect personal data solely for the purpose of fulfilling our wider role as a government department or public authority, although we may do so where we need certain information in order to comply with a request or legal obligation. For example, we may need your contact details in order to provide you with information requested pursuant to the FOIA, or in order to provide statistical returns to central government.
How we process data after collection
We may further process information we collect for a different purpose, so long as that purpose is compatible with the purpose for which the information was collected, or where we are otherwise permitted or required to do so by law. Where necessary and permitted by law, we carry out this processing without your knowledge or consent.
This means that information provided for one of the three broad reasons set out above may be used for any of the other reasons, even if the relevant charity is no longer registered or you are no longer involved with it.
Some common examples of this are:
in the course of an investigation into apparent misconduct or mismanagement or in response to a request for information from a member of the public we may use information received in respect of an application for charity registration, for a waiver or for approval for a specific step; or information provided to us pursuant to a legal obligation (for example accounts or reports of serious incidents)
we may share your personal data (including particularly sensitive types of personal data):
- with other government departments, public authorities, regulators and judicial and quasi-bodies and for special categories of personal data only where it is necessary in the substantial public interest to do so; or
- where we are obliged to do so by law, for example in response to a FOIA or Environmental Information Regulations (EIR) request or a request made under the Charities Act, for example, to see the governing document or accounts for a charity
Legal basis for processing
We process personal data in a variety of different ways. The table below sets out the legal bases we rely on for processing.
We may process your personal data on more than one basis depending on the purpose for which we are using your data. Please email us at RIGA@charitycommission.gsi.gov.uk if you need details about the specific legal basis we are relying on to process your personal data.
It is rare that we rely on your consent to process your data. However, where we do, you have the right to withdraw your consent at any time. You can find out more information about exercising your rights further on in this privacy notice.
When we process special category data we do this in accordance with our policy, which defines when and how we may process this data in the substantial public interest.
Who we share your personal data with
We may share your personal data (including particularly sensitive types of personal data):
- to the public on our website
We routinely publish (and make available for re-use) certain personal data on our website. This includes trustees’ names, the name and address of the designated charity contact, auditor or independent examiner, and information contained in charities’ annual accounts. We also publish reports at the conclusion of investigations and inquiries and a register of removed and disqualified trustees.
We also publish information about our staff and expenditure in order to comply with the central government corporate transparency commitments. This includes information about our workforce, suppliers and expenditure. In some cases details of individual transactions or contracts may be published in full. You can read more about our transparency commitments on GOV.UK. We also routinely publish responses we receive to consultations.
- where it is necessary to share the information in order to further our statutory objectives or functions
We may need to share personal data with third parties in order to further our statutory objectives or functions. For example, in the course of an investigation into alleged financial misconduct, we might provide your personal data to a bank so that we could establish whether they held relevant information. If we receive a report of misconduct, we may need to share information with a registered organisation you’re involved with. Where appropriate we may also share larger datasets and carry out data matching with other organisations.
- with other government departments, public authorities and regulators
The Charities Acts and in particular sections 54-59 of the Charities Act 2011 permits us to disclose information held by us to any relevant public authority if the disclosure is made for the purpose of enabling or assisting the relevant public authority to discharge any of its functions, or if the information so disclosed is otherwise relevant to the discharge of any of the functions of the relevant public authority. We have agreed a ‘Memorandum of Understanding’ or legal agreement with some organisations to facilitate compliant data-sharing where it is undertaken on a routine basis.
As a consequence, where it is necessary and proportionate to do so, we may share particularly sensitive types of personal data pursuant to the powers granted to us in the Charities Acts.
We may also share information with other government departments, public authorities and regulators in our capacity as a large organisation and employer. For example we may share taxation information with HMRC or information about conduct with a professional body.
In response to requests for information, for example pursuant to the FOIA, the Environmental Information Regulations (EIR), Re-use of Public Sector Information Regulations (RoPSI), or our common law powers of disclosure. We are required in certain circumstances to disclose certain information in response to requests made by members of the public. This includes documents which are filed with the Commission such as governing documents, accounts or minutes of meetings.
Once we disclose information in this way it is treated as being disclosed to the ‘world at large’. This means the recipient may publish it further, for example in a newspaper or blog.
- with third party processors and service providers
We use third parties and service providers to process some personal data on our behalf.
- IT and similar service providers acting as processors
- professional advisers acting as processors and as joint controllers including lawyers, auditors and insurers based in the United Kingdom who provide consultancy, legal, insurance and accounting services
We require all third parties to respect the security of your personal data and to treat it in accordance with the law
We do not allow these third parties to use personal data for their own purposes and we only permit third party processors to process personal data for specified purposes and in accordance with our instructions.
to a court, tribunal, party or prospective party where the disclosure is necessary in order to exercise, establish or defend a legal claim
where we are ordered to by a court or tribunal or where we are otherwise required to do by law
International transfers of personal data
We do not routinely transfer information outside the European Economic Area (EEA). We would only transfer information outside the EEA where such a transfer was necessary for important reasons of public interest or otherwise necessary for the establishment, exercise or defence of legal claims.
Where there is no adequacy decision by the European Commission in respect of that country we will put in place appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection. If you require further information you can request it from the DPO (see below)
How long we retain personal data for
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
It is important to note that in certain circumstances we retain personal data received in connection with a particular charity even after a person’s involvement with a charity has ended and after the charity is no longer registered.
Information about us
Our Data Protection Officer (DPO) is a permanent employee of the Charity Commission. Our DPO is responsible for monitoring our compliance with data protection legislation, and is the point of contact for concerns you may have over how we are processing personal data, and any incidents you wish to report to us.
The Charity Commission DPO contact details are:
Data Protection Officer
The Charity Commission
35-36 Upper High Street
The UK supervisory authority for data protection is the Information Commissioner’s Office (‘the ICO’). We are registered with the ICO under registration number [Z5640596].
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), and more information can be found on their website.
Your legal rights as a data subject
Under certain circumstances, you have rights under data protection laws in relation to your personal data.
You should be aware that these rights are subject to the restrictions set out Part 2 of Schedule 2 to the Data Protection Act 2018.
In particular they do not apply to personal data processed for the purposes of discharging functions conferred on the Charity Commission by or under the Charities Act 1992, 2006 or 2011 where exercising those rights would prejudice the proper discharge of those functions.
You will not have to pay a fee to access your personal data (or to exercise any of your other rights). But, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We may also refuse to comply with your request in full or in part where disclosure would prejudice a Police inquiry or would be contrary to law, for example, it would be in breach of the Proceeds of Crime Act or money laundering regulations.
The right of access to your personal data
You have the right to receive confirmation as to whether or not personal data about you are being processed, and, where that is the case, access to that personal data and certain information, including:
- the purposes of the processing
- the categories of personal data concerned
- the recipients or categories of recipients to whom the personal data have been, or will be disclosed, in particular recipients in third countries or international organisations
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
- where the personal data were not collected from you any available information as to their source
- the existence of automated decision-making, including profiling; and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
Please note that this right is subject to certain exemptions and it may not be available in all cases.
The right to rectify your personal data
You have the right to rectification of inaccurate personal data concerning you without undue delay. This includes the right to have incomplete personal data completed.
The right to erasure of your personal data
You may have the right to require us to erase your personal data without undue delay if:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
- you withdraw your consent (if given) and there is no other legal ground for the processing
- you object to further processing and there are no overriding legitimate grounds for the processing
- the personal data have been unlawfully processed
- the personal data have to be erased for compliance with a legal obligation to which we are subject
The right to object to processing of your personal data
You have the right to object to the processing of your data and if you do, we may be prevented from further processing your personal data unless certain conditions are met.
The right to restrict processing of your personal data
In certain circumstances you may have the right to restrict further processing of your personal data and if you do, we may only further process your personal data for storage, with your consent, for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
The right to data portability
Where you have provided information to us and where that information is processed by automated means pursuant to a contract, you may have the right to have that information provided to you in a machine-readable format. This so you are able to re-use your personal data across different services.
Exercising your rights
If you wish to exercise any of the rights set out in this privacy notice, please contact the Records, Information Governance and Assurance team by emailing RIGA@charitycommission.gsi.gov.uk.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We will usually ask you to provide one form of proof of identity and one form of proof of address. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within 28 days. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
We may not always be able to release all of the information you have asked for. This might be because certain information is exempt from release to the public.
In some circumstances we may be able to review the outcome of your request within 28 days of it being issued. Please email RIGA@charitycommission.gsi.gov.uk if you think our decision making about what information we release is incorrect.
It helps us if you tell us why you think our decision is wrong and exactly what additional information you would like us to release.
We use Google Analytics software on Charity Commission platforms to collect information about how users are accessing our website. This information relates to the following:
- the pages you visit
- how long you spend on each page
- how you got to the site
- what you click on while you’re visiting the site
- what links you open in emails from us
This information is generated by the cookie about your use of the website and will be transmitted to and stored by Google on servers in the United States. Such information will include details of your browser (for example Chrome or Safari) and your geolocation (to the nearest country/city). The data we collect on user behaviour is used by us to improve our services. For example, so that they are intuitive, accessible and fulfil their function. We retain the data for up to 38 months for this purpose. This period runs from the last point at which the webpage was accessed. No data from cookies which could identify you, such as IP addresses, are collected by Google Analytics.
- enquiry form
- amend governing document
- close a charity (dissolution)
- change name
- raise concern
- apply to make a moral payment
- appoint a member of staff as a trustee
- decision review
- dispose of charity land to a connected person
- employ a trustee
- employ a person or organisation who is connected to a trustee
- employ someone who is connected to a trustee
- employ someone who is or was a trustee
- linking charities
- notification of a charity merger
- pay less than £1000 to a trustee
- pay a trustee for providing a service
- pay a trustee for serving as a trustee
- pay a trustee compensation to replace or part replace lost income
- spend permanent endowment
- transfer assets to another charity
- using charity or charitable in non-charitable company name
- vest charity land in the Official custodian
- waviers form
- CIO form
- administration clause
- dissolution clause change
- main charity name change
- object clause change
- trustee benefits clause change
- change and upload governing document
- working name change
- register a charity
- financial reporting (SORPs)
- annual returns
The cookies Google Analytics use are:
||This lets us know if you’ve visited before, so we can count how many of our visitors are new to our services
||This works with _utmc to calculate the average length of time you spend on our pages
||This works with _utmb to calculate when you close your browser
||When you close your browser
||This tells us how you reached our services (for example from another website or a search engine)
Cookies collected by Government Digital Services
The GOV.UK website, which is run by Government Digital Services (GDS), hosts all Charity Commission content and guidance and also uses Google Analytics software. You can find further information on the data collected by GDS in their cookies policy.
Find out more about privacy information from Google Analytics.
Find out more from the Information Commissioner’s Office about how to manage cookies.