COLLECTING
Only what you need
Data minimisation means personal data should be adequate, relevant and limited to what is necessary for your purpose.
Try a scenarioSmall groups hold more data than they think.
Names on a register, emails on a mailing list, phone numbers on a volunteer rota. The UK GDPR applies to them, and the Information Commissioner's Office publishes plain guidance on how to look after them.
- Collect only what you need
- Keep it only as long as needed
- Keep it secure
- What ICO guidance stresses
THE SHORT ANSWER
Collect less,
keep it safe.
This site is an independent guide, not legal advice.
It is not affiliated with any church, club, group or the ICO.
KEEPING
Not for ever
The ICO says you must not keep personal data for longer than you need it, and should review and erase or anonymise what you no longer need.
Four habits
BREACHES
The 72-hour clock
If a breach is likely to put people at risk, the ICO must be told as soon as possible and, where feasible, within 72 hours.
See the numbersGeneral information only, not legal advice. For advice on your own situation, speak to a qualified lawyer or a free advice service.
FOUR HABITS FROM THE ICO CHECKLISTS
Small steps,
fewer surprises.
These reflect points in the ICO's storage limitation checklist and principles guide. They are a starting point for a conversation in your group, not a compliance programme.
Know what you hold
List the personal data the group holds and why it needs each piece.
Decide how long
Agree standard retention periods where possible, and be able to justify them.
Review and clear out
Check periodically, and erase or anonymise data the group no longer needs.
Plan for a breach
Know who would assess the risk and report to the ICO within 72 hours if needed.
TWO NUMBERS WORTH KNOWING
Seven principles,
seventy-two hours.
One count of the rules at the heart of the law,
one deadline worth knowing before you need it.
7 principles
Key principles in Article 5 of the UK GDPR
Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
PRINCIPLES · ICO
72 hours
Time to notify the ICO of a reportable breach, where feasible
The ICO says you are legally required to meet this timeframe and should send what you have, adding details later without undue delay. Its online form takes about 30 minutes.
BREACHES · ICO
The ICO notes that the UK GDPR sets no specific time limits for keeping different types of data: it is up to each organisation, and depends on how long the data is needed for its purposes.
A QUICK SCENARIO CHECK
Which principle
is in play?
Pick an everyday situation for a volunteer tech group to see which part of ICO guidance it touches. The bar shows how urgently the guidance points to acting.
Based on ICO guidance on the data protection principles, storage limitation and breach reporting. The ICO says this guidance is under review after the Data (Use and Access) Act. General information only, not legal advice.
THE DATA PROTECTION FEE
Pay, or check
if you are exempt.
The ICO says that under the Data Protection (Charges and Information) Regulations 2018, organisations that use personal information need to pay a data protection fee unless they are exempt.
The regulations list types of processing that are exempt. As made in 2018, they include processing by a body not established or conducted for profit for establishing or maintaining membership or support, or providing activities for members. Check the ICO's current guidance for your own group.
In conversation
Questions people ask
Does data protection law apply to a small volunteer group?
The ICO's guidance is written for organisations that process personal data, and a group keeping names, emails or phone numbers is processing personal data. The seven UK GDPR principles apply to that processing.
How long can we keep a mailing list?
The ICO says the UK GDPR sets no fixed time limits. You must not keep personal data longer than you need it, should be able to justify how long you keep it and should review it periodically.
What counts as a reportable breach?
The ICO says you must assess the likely risk to people's rights and freedoms. If a risk is likely, notify the ICO as soon as possible and where feasible within 72 hours; it offers a self-assessment tool and examples.
Do we have to pay the ICO a fee?
Organisations that use personal information need to pay unless exempt, under the 2018 charges regulations. The regulations list exemptions, including one for certain not-for-profit membership and activity processing. Check current ICO guidance.
Has the law changed recently?
The ICO says its guidance is under review following the Data (Use and Access) Act, which became law on 19 June 2025, and may change. It publishes a page on planned guidance updates.
Sources
Each figure on this page comes from the sources below.