What Charities Need to Know About ‘Soft Opt-In’ & the DUAA Changes
31st October 2025
The rules around consent for charity marketing are changing. Under the Data (Use and Access) Act 2025 (DUAA), charities and non-profit organisations will soon be able to send unsolicited electronic mail (email) marketing without explicit consent. This extends the ‘soft opt-in’ clause from Regulation 22(3)(c) in the Privacy and Electronic Communication Regulations (PECR) 2003. The soft opt-in clause of the DUAA has not fully come into force at the time of writing (October 2025), but is expected to do so between now and June 2026.
What Does ‘Soft Opt-in’ Mean?
The ‘soft opt-in’ is an exemption that lets organisations send marketing emails or texts to existing customers and individuals with whom they have a pre-existing relationship without needing explicit consent. This only applies in certain situations, such as marketing similar products or services to ones that a customer has already purchased, and their contact information has to have been collected during the course of a sale or negotiations for a sale; it can not be relied on when contacting prospective customers, only existing contacts. Contacts must also have been given the opportunity to opt out of marketing communications at the time their data is collected. For example, if someone buys a car from a garage, providing the soft opt-in rules are followed, that garage can email the customer to offer related services such as MOTs or servicing. Soft opt-in was first established in PECR 2003.
Why ‘Soft Opt-in’ Matters
Historically, the soft opt-in could only be used by commercial organisations selling goods, products and services. The DUAA changed this and expanded the soft opt-in to allow charities and other non-profit organisations to send direct marketing via electronic mail (emails, texts, and social media messages) to individuals who have expressed an interest in, or offered to provide support to, their charity, without needing the person’s explicit consent first. This will help charities to contact more supporters and access more fundraising opportunities.
Soft opt-in only applies to electronic marketing, i.e. emails, social media messages, texts, rather than phone calls or postal marketing. Organisations still need to comply with their obligations under the UK GDPR and to process personal data for direct marketing purposes, regardless of the channel. A Controller would normally rely upon the lawful bases of ‘legitimate interests’ or ‘consent’. But remember, consent under the UK GDPR must be opted in; there is no equivalent to PECR’s soft opt-in in data protection legislation.
PECR & the Original Soft-Opt-In Rule
The soft opt-in rule, created under PECR 2003, allows businesses to contact existing customers about similar products or services they have purchased or enquired about before. The PECR legislation recognises that someone who has a business relationship with a Controller, i.e. the organisation processing the request, would not object to hearing more about said organisation, and would be happy to receive marketing information from said Controller about similar products or services. Because most charities do not sell goods or services, they were previously excluded from this exemption and had to rely on explicit consent.
What the DUAA Change Introduces for Charities
Under section 114 of the DUAA, charities and non-profit organisations can rely on a modified soft opt-in for electronic marketing. Charities can rely on this exemption only if all of the following conditions are met:
- The sole purpose of the marketing communications must be to further one or more of the organisation’s charitable purposes.
- The individual’s contact details were collected when they expressed an interest in the charity’s purposes or they offered support to further those purposes
- The individual was given the option to opt out when their details were first collected, and they are offered an easy way of opting out in every subsequent message, e.g. an ‘unsubscribe’ link in an email.
This change brings charity marketing in line with commercial practices, while still protecting individual privacy. An important thing to note is that this soft opt-in cannot be applied retrospectively – it only applies to contacts collected after the DUAA takes full effect and where the above conditions are met.
Practical Tips for Charities and Non-Profit Organisations
If you plan to use the charitable purpose soft opt-in for your organisation, you must update your privacy notice to tell people how you will be using their information. You can also review your supporter journeys to identify the points where people offer support or express interest, and be sure to offer the chance to opt out of marketing communications at this point. Test your opt-out mechanisms to ensure they are clear and easy to understand and use, and provide updated training to your fundraisers and marketing team. If you have a mailing list, you could separate it into pre- and post-change contact lists, as the soft opt-in clause cannot be applied retrospectively.
Even under the new DUAA legislation, charities and non-profits still need to abide by other legislation and data protection laws. It would still be inappropriate to use this lawful basis to contact vulnerable people, children, or service users where direct marketing could cause them harm – the ICO has published some guidance on this. If you are in any doubt about whether your marketing activities could be covered by this new soft opt-in, you could prepare a Legitimate Interest Assessment to document your lawful basis – the ICO has an interactive lawful basis tool that you may find useful. The ICO has also created a consultation on the new soft opt-in rules for charities – you can access it here.
The DUAA’s expansion of PECR’s soft opt-in marks a significant and positive shift for the charity sector. It offers greater flexibility to reach supporters while maintaining the safeguards of data protection law. With clear governance and transparent processes, charities can use this change to strengthen relationships and grow their impact responsibly. This is a valuable opportunity for charities and non-profit organisations, but the need for compliance is still there. See the ICO guidance highlighted above for more information, or for some more tailored advice, contact us here at Griffin House Consultancy.
Author: Mike Martin LLM
Mike is an information rights law specialist and one of the founding Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.
