Section 164A for charities and community groups
Charities are controllers and have no exemption under section 164A. The extra difficulty is that complaints often reach volunteers rather than staff, and a complaint received by a volunteer is received by the charity.
Does section 164A apply to you?
If your charity decides what donor, beneficiary, member or volunteer data to hold, it is the controller, regardless of income or number of staff.
The complaints you are most likely to get
- Fundraising appeals to donors who asked to stop, or to lapsed donors
- Beneficiary case notes shared more widely than expected
- Photos of beneficiaries or service users in newsletters and appeals
- Volunteer records kept indefinitely after they stop volunteering
- Wealth screening and donor research the donor did not expect
Channels to watch
The 30-day clock starts when a complaint reaches your organisation by any route, so every channel below needs a named owner.
- The main charity inbox, often staffed part time
- Volunteers at events, shops and collections
- Trustees' personal email addresses
- Post to a registered office nobody visits daily
- Social media accounts run by volunteers
Worked examples
| What arrives | How to treat it |
|---|---|
| A donor tells a shop volunteer they want no more appeal letters and are unhappy about the last three | A complaint received that day. The volunteer needs a one-line habit: write it down, send it to [name] today |
| A service user asks why their case notes were discussed with a partner organisation | A complaint about sharing. Check your data sharing agreement and what was actually shared |
| A former volunteer asks why they are still on the rota system | A complaint about retention. Answer with your actual retention rule, or set one |
A minimum viable process
- Publish a complaints route with an electronic option and another means. Use the complaints policy template.
- Add the section 164A wording to your privacy notice and your subject access request template. Use the privacy notice wording.
- Log every complaint with the date it was received. Use the complaints log template.
- Acknowledge within days, not weeks. See the 30-day acknowledgement rule.
- Investigate, update the person, decide, tell them the outcome and signpost the ICO. See how to handle a data protection complaint.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.