Q&A: What is the Board’s Role in GDPR Compliance?

Anyone in your organisation who handles personal data, whether from donors, volunteers, or service users, has a role to play in following GDPR. The charity’s board is responsible for setting the tone, creating policies, and shaping the overall approach. 

1. Oversight and Accountability 

In most charities, staff members are responsible for handling data. The board’s role in GDPR compliance is therefore to oversee staff actions and hold them accountable for maintaining good data practices. This is especially important for the executive director and other leaders. If the executive director fails to prioritise data security, the board must investigate the reasons and ensure improvements are made. For example, if strict budget limits prevent the purchase of software with appropriate security credentials, the board may need to adjust the budget.

2. Strategic Leadership 

While staff manage the day-to-day responsibilities of data collection, the board must set a long-term vision for how strong data practices support the charity’s operations. Depending on the size and complexity of the organisation, this may include appointing a data protection officer to coordinate compliance. Every charity, regardless of size, should have a data protection policy in place. Reviewing resources such as the Charity Governance Code can help the board establish guiding principles on why data security matters and shape the organisation-wide approach. Strategic leadership also involves scheduling regular reviews of the data protection policy to keep pace with changes in technology, regulations, and the charity’s needs.

3. Risk Management 

The board must evaluate the data security risks facing the charity, identifying which are most likely to occur, and which would have the greatest impact. This ensures the strategy focuses on the most significant threats. Even with robust safeguards, breaches can still happen. If a breach does occur, GDPR requires notification of all affected individuals within 72 hours. Given the short time frame, the board should prepare an incident response plan in advance, clearly defining responsibilities.

4. Culture and Training 

Enforcing a data security policy is much easier when the organisational culture prioritises privacy for donors. The board plays a key role defining the organisation’s culture. Charity governance training can help clarify what that culture should look like and how the board can shape it. The board is also responsible for deciding the type of training and who needs it. The charity fundraising team and anyone else working with donor data should undergo data security training. If you collect data from clients or service users, frontline staff and volunteers may need training as well. 

5. Monitoring Compliance 

Even the strongest GDPR strategy is ineffective if staff and volunteers fail to follow it. The board should regularly monitor data collection, storage, and usage across the organisation. If the executive director or other leaders do not comply, the board must act, whether by requiring further training or imposing consequences.