Challenges Regarding Implementation Of DUAA Soft Opt-in For UK Charities

Challenges regarding implementation of DUAA soft opt-in for UK charities

With the ICO consultation on new direct marketing rules for charities under DUAA now open, the Withers data privacy team reports on challenges facing UK charities in implementing the new soft opt-in rules under DUAA.

Among the changes introduced by the Data Use and Access Act (DUAA) 2025, which amends the Privacy and Electronic Communications Regulations (PECR), an amendment that has received considerable coverage is the extension of the "soft opt-in" exemption under PECR to apply to UK charities.

The extension of the soft opt-in will allow UK charities to send direct marketing communications about their charitable purposes to individuals without consent, provided the individual's contact details are collected when the individual expressed or provided support for the charity (e.g. made a donation or volunteered in some capacity), an opt-out opportunity is given at the time of collection and in subsequent communications, and the fundraising/marketing is about the charity's existing objectives.

These changes under DUAA are likely to take effect soon - around January 2026 - and the Information Commissioner's Office (ICO) has released draft guidance on the new rules which is now open for consultation. While potentially helpful in clarifying an area of law that has been a source of frustration, whether this amendment to the law, and the extension of the 'soft opt-in' exemption, will be the golden goose for hard pressed fundraisers remains to be seen.

From our experience, these are a few of the challenges that might temper some of the enthusiasm we have seen regarding the extension of the 'soft opt-in' exemption from some other quarters:

• Forward looking change. It's crucial to understand that this change, when it takes effect, will not be applied retrospectively so where you hold the details of existing supporters on your database, you need to treat those are being covered by the previous opt-out default rule for e-marketing.
• Scope limitations of 'charitable purpose'. The charitable purposes soft opt-in cannot be used to promote third parties or commercial activities, so contact details collected in respect of a sale made by a charity's trading arm will not be automatically transferable to the charity for fundraising under the soft opt-in and vice versa. Your CRM system will need to be set up to support this distinction.
•  Appropriate documentation remains key. Remember, even when using the soft opt-in, you still need to have a documented a lawful basis for such processing under UK GDPR, which is likely to be legitimate interests (where you also need to have balanced your interests against the rights of individuals). Privacy notices must also be updated to reflect this reliance on the soft opt-in should you chose to start utilising it for new fundraising activities.
•  Suitable CRM systems. Switching to relying on this soft opt-in is optional and will probably take some internal thinking. The potential to reach a larger supporter audience is clearly appealing, but it also requires careful consideration given that you are now handling data collected under two contrasting consent regimes. Reviewing your internal record keeping and CRM systems is going to be vital, to see if they can handle the switch and clearly distinguish between these multiple requirements, depending on when data was collected, by which entity and what rules apply. There is also consideration to be given to how you sign-post any change to supporters who may still assume that the previous opt-out regime applies. In short – given the administrative burden - there is potentially a cost-benefit analysis that some charities may need to undertake in deciding whether to embrace the new rules or not. 

In summary, the charitable purposes soft opt-in presents a clear opportunity for charities if implemented correctly, but it requires some careful up-front planning, particularly regarding suitable internal processes and CRM system suitability, and may not be for everyone.

For advice on DUAA compliance for UK charities, wider data privacy compliance, or if you have any questions on this topic, please get in touch with your usual Withers contact or the authors of this article.

This document (and any information accessed through links in this document) is provided for information purposes only and does not constitute legal advice. Professional legal advice should be obtained before taking or refraining from any action as a result of the contents of this document.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.