What the 2025 Act means and how it can (and can’t) be used

By Sue White, Head of Information Law Services

The Data Use and Access Act (2025) introduced a significant, and long-awaited, shift for charities by extending the use of the ‘soft opt-in’ to the non-profit sector.  This part of the Act came into force on 5 February 2026 opening new doors for supporter engagement. But what does this mean in practice? When can charities rely on the soft opt-in, and when do they still need explicit consent?  

When marketing to individuals electronically, organisations must obtain opt-in consent as part of the Privacy and Electronic Communications Regulations (PECR). The only exception to this is where the ‘soft opt-in’ applies. Up until now, this has only been available for commercial purposes but has now been opened to charitable purposes.

When does the soft opt-in apply? 

A charity may send electronic mail for the purposes of direct marketing where all the below conditions apply: 

1. The communication must further one or more of that charity’s charitable purposes. 
2. The individual’s contact details must have been obtained directly by the charity when they expressed interest in the charity’s work e.g. signing up to volunteer, requesting information, donating etc. 
3. The individual must clearly be offered the chance to opt out at the point their data is collected, and at each subsequent communication. 

This means a charity could contact an individual, who has donated, with further messages, without asking for their consent, as long as the above criteria applies. 

Limitations of the Soft Opt-in 

Despite the benefits, the new soft opt-in comes with limitations: 

1. Charities cannot use the soft opt-in for individuals already on their database before this legislation came into force. Existing supporters will still require explicit consent for marketing as the lawful basis cannot be changed after personal data has been collected. 
2. Charities may need to maintain one list for supporters with consent and another for those acquired under the soft opt-in framework. 
3. Opting out must be easy, visible, and included in every communication. 

Practical Considerations for Charities 

When using soft opt-in, this should be clearly explained in the Privacy Notice.  

The soft opt-in relies on the lawful basis of Legitimate Interests. This means that charities need to undertake a Legitimate Interests Assessment to show how its interests in sending marketing communications balance against the rights and freedoms of individuals. The more reasonable, expected, and fair it would be for individuals to expect marketing from charities, the more likely it is for the Legitimate Interests Assessment to fall in the charity’s favour.  

This is a big development for charities and although it may be tempting to add all new contacts to mailing lists, it is important to note that the Act also increased PECR fines. This means that although the opportunities for marketing are greater, so are the consequences for getting it wrong! 

Further Help

If you found this useful and want to know more about how to send marketing communications lawfully, whether you’re from a charity or a commercial organisation, book a place on our next Lawful Digital Marketing and Consent course, being held online on 5 March 2026, 9:30am-1pm, or contact us on info@naomikorn.com for more information!