Responsible AI & Data Protection for Charities

Charities process special category data as their core business. Health conditions, disability, ethnicity, safeguarding referrals, domestic abuse, addiction. Almost every charity AI deployment triggers DPIA obligations that most organisations have not addressed. And 76% of organisations have one person or fewer responsible for data protection.

The gap is widening. Only 19% of charities are reviewing data protection, security and safeguarding as they adopt AI, down from 36% the year before, even as adoption climbs. Data privacy and GDPR concerns are the third biggest barrier to AI adoption in the sector.

This full-day session covers the specific data protection obligations that apply when your charity uses AI. You will learn when a DPIA is legally required and complete one during the session using your own tools and data flows. We cover how the ICO defines 'meaningful human involvement' in automated decisions, the DUAA 2025 changes to automated decision-making rules, the charity soft opt-in for electronic marketing, recognised legitimate interests for safeguarding, and the Fundraising Regulator's December 2025 AI guidance on donor data in AI tools.

We also cover what is coming. Regulations that came into force in May 2026 require the ICO to produce a statutory code of practice on AI and automated decision-making. A statutory code carries legal weight that ordinary guidance does not. Courts and the ICO must take it into account. Charities that build their documentation now will not be scrambling when it lands.

Some areas have no charity-specific guidance at all. Adult safeguarding and AI is one. The Mental Capacity Act interface is another. We help you build proportionate internal standards that will hold up if the regulator asks questions.