AI tools can save charities real time: drafting thank-you letters, summarising enquiries, tidying up messy data, or sorting a busy inbox. But the moment supporter, member or beneficiary data goes into an AI tool, data protection law applies, and some of that data may be among the most sensitive you hold.
This guide sets out the practical steps UK charities and membership bodies should take to use AI with personal data safely. It’s a plain-English overview, not legal advice.
The basics still apply
AI doesn’t change the core rules of UK GDPR. You still need:
- A lawful basis for using the data in this way
- Transparency: people should be able to find out, usually from your privacy notice, how their data is used
- Data minimisation: only use the data the task actually needs
- Accuracy: AI can get things wrong, so outputs need checking
- Security: the tool and the supplier behind it must protect the data properly
What AI changes is how easy it is to break these rules without noticing, for example by pasting a spreadsheet of donors into a free chatbot.
Recent changes in UK law
The Data (Use and Access) Act 2025 updated UK data protection law, with changes coming into force during 2026. Two are relevant to AI:
- Recognised legitimate interests: a new list of purposes, such as some safeguarding and security uses, where organisations no longer need to carry out the usual balancing test
- Automated decision-making: the rules on decisions made without human involvement have been relaxed for most personal data, but important safeguards remain. If a decision has a significant effect on someone, they must be told, be able to challenge it and ask for a person to review it. Stricter limits still apply to special category data such as health or religion.
The ICO has consulted on updated guidance on automated decision-making, so keep an eye on its website as this develops.
- Templates and draft wording
- Anonymised themes from feedback
- Public information
- Names and contact details
- Donation or membership history
- Enquiry emails
- Health, religion or ethnicity
- Safeguarding information
- Bank or payment details
Seven practical steps
1. Know which tools staff are using
Ask your team which AI tools they use and what for. Many charities discover staff are already using free chatbots with real supporter data, with good intentions.
2. Use business versions, not free consumer tools
Business versions of the main AI tools typically offer a data processing agreement and commitments not to use your data to train their models. Free consumer versions often don’t. Treat an AI provider like any other supplier that processes personal data.
3. Don’t share more than you need
For many tasks, such as drafting a letter template or summarising themes in feedback, you can remove names and contact details first. If the task doesn’t need personal data, don’t include it.
4. Take extra care with sensitive data
Health information, religious beliefs, ethnicity and similar special category data need a higher level of protection. This is common in health, faith and support charities. Avoid putting this data into general AI tools unless you’ve assessed the risk carefully and have the right safeguards.
5. Keep a person in the loop
Use AI to suggest, draft and sort, with a person making the decisions. Where AI helps decide something that significantly affects someone, such as eligibility for support, make sure a person reviews it and the individual can challenge it.
6. Do a data protection impact assessment when the risk is higher
If you’re planning something new and potentially high-risk, such as using AI to profile donors or prioritise beneficiaries, a DPIA helps you think through the risks and record your decisions. The ICO provides templates.
7. Update your privacy notice and policies
Explain in your privacy notice if you use AI in ways people wouldn’t expect, and give staff a short, clear policy on which tools they can use and for what.
Where AI genuinely helps charities
Used carefully, AI works well for:
- Enquiry triage: sorting incoming emails and forms and routing them to the right person
- Data clean-up: spotting likely duplicates and standardising names and addresses in your CRM, with a person approving changes
- Drafting: first drafts of thank-you letters, appeal copy and reports, which staff then edit
- Summaries: turning long documents, survey responses or meeting notes into key points
Running these tools on infrastructure you control, such as a self-hosted n8n workflow on UK servers, with business AI services that don’t train on your data, keeps you firmly in charge of where data goes.
Get practical help
We help UK charities and membership bodies use automation and AI safely, connected to CiviCRM and the tools they already use. See our automation and AI services, or book a free 30-minute automation review to talk through what would help your team.