Navigating GDPR and large language models: a practical guide for charities

This is the question we hear more than any other. A charity wants to use AI to analyse supporter feedback, personalise fundraising communications, or process beneficiary data at scale. They know this means sending personal data to a cloud API, probably hosted in the US. Their data protection officer says no, or says maybe, or says nothing because they're not sure either.

The result is paralysis. Charities that could benefit from AI with personal data don't, because the GDPR question feels too hard to answer. It isn't. The regulatory path is navigable, and charities are navigating it successfully right now. But you do need to understand the details.

This is not legal advice. It's practical guidance based on our experience helping charities work through these decisions, and on the ICO's own guidance on AI and data protection. For anything complex, especially involving special category data like health information, get legal advice specific to your situation.

You need a lawful basis, and it's probably legitimate interest

To process personal data through an AI tool, you need a lawful basis under UK GDPR. For most charity AI use cases, that's legitimate interest.

Consent sounds like the obvious choice, but it's usually impractical. You'd need to get explicit, informed consent from every person whose data you want to process through an AI tool, and they'd need to understand what that means. For analysing 5,000 survey responses or segmenting your donor database, consent doesn't scale.

Legitimate interest works, but you need to do the balancing test. This is a three-part assessment: is there a legitimate interest (yes, improving your services or fundraising effectiveness)? Is the processing necessary for that purpose (can you achieve the same result without sending data to an AI)? And does the individual's right to privacy outweigh your interest?

The balancing test is where charities need to think carefully. The ICO expects you to consider the nature of the data, what people would reasonably expect, and what safeguards you have in place. Processing supporter names and giving histories for donor segmentation is a different proposition from processing detailed beneficiary case notes. The more sensitive the data, the stronger your safeguards need to be.

Document the balancing test. A written record showing you considered the risks and made a proportionate decision is what the ICO looks for. It doesn't need to be lengthy. A page covering the purpose, the data involved, the risks to individuals, and the mitigations you've put in place is usually sufficient.

International transfers: the mechanisms exist

Most AI providers process data in the US, which means you're making an international transfer of personal data. UK GDPR requires adequate protections for this. The good news: there are established mechanisms.

The UK-US Data Bridge, which took effect in October 2023, allows UK organisations to transfer personal data to US companies that have self-certified under the Data Privacy Framework. If your AI provider is on the DPF list, this is the simplest route. You can check the list at dataprivacyframework.gov. Google is certified. OpenAI and Anthropic are not on the DPF list and instead rely on Standard Contractual Clauses (SCCs).

SCCs are pre-approved contract terms that provide legal safeguards for international transfers. All three major AI providers include them in their data processing agreements. Since the EU General Court upheld the EU-US Data Privacy Framework in September 2025, and the EU renewed the UK's adequacy decisions in December 2025 (extended to 2031), the legal landscape for UK-US data transfers is more settled than it has been for years.

You should still do a transfer impact assessment for transfers relying on SCCs. The September 2025 Latombe ruling provides helpful evidence for that assessment, because the court examined US surveillance safeguards in detail and found them adequate. That makes the baseline assessment for US transfers less onerous than it was in the immediate post-Schrems II period. One caveat: Latombe has appealed to the CJEU, so the framework could face further challenge at the higher court. For now, though, the legal position is solid.

API vs consumer: the distinction that matters

This is the point most charities miss, and it matters enormously.

When you use ChatGPT's free tier, Claude's free plan, or Google's Gemini app as a consumer, your inputs may be used to train future models. In August 2025, Anthropic updated its consumer terms so that free, Pro, and Max plan conversations can be used for training by default (users can opt out via a toggle, but it defaults to on). Google's free-tier Gemini goes further: conversations may be reviewed by human annotators, not just used for automated training. OpenAI uses free-tier ChatGPT conversations for training unless you disable the setting in Data Controls.

API access is fundamentally different. When your charity accesses AI through the API (or through enterprise products like ChatGPT Enterprise, Claude for Work, or Gemini through Google Cloud), the providers' data processing agreements explicitly state they will not use your data for model training. This is contractually binding.

The practical distinction: if your staff are pasting beneficiary feedback into the free version of ChatGPT, you have a data protection problem. If you're sending that data through the API with a proper data processing agreement in place, you're on much firmer ground.

What the DPAs actually say

We've read the data processing agreements from the three major providers. Here's what matters for charities.

Anthropic (Claude API, Claude for Work). Their Data Processing Addendum incorporates EU and UK SCCs. As of September 2025, API data is retained for 7 days by default, then deleted (organisations can opt in to 30 days if needed). AES-256 encryption at rest, TLS 1.2+ in transit. They will not use API customer data for model training.

OpenAI (ChatGPT Enterprise, API). European customers contract with OpenAI Ireland Ltd. API data retained for up to 30 days, then deleted (enterprise customers can request zero data retention). SCCs included for international transfers. They explicitly state: "We do not train on your business data." SOC 2 Type 2 and ISO 27001/27701 certified.

Google (Gemini API through Google Cloud, Workspace). Google's Cloud Data Processing Addendum covers Gemini API usage through Google Cloud and Vertex AI. Enterprise and Workspace data is not used for model training. For charities on Google for Nonprofits, Workspace AI features (including Gemini) are covered by Google's existing data processing terms. An important distinction: the free-tier Gemini API (through Google AI Studio) is not covered by the Cloud DPA. Google explicitly states that unpaid API inputs may be used for model improvement and may be reviewed by humans.

The common thread: all three providers offer GDPR-compliant terms at the API and enterprise level. None use API-tier data for training.

Data minimisation: only send what you need

This is where practical good sense meets legal obligation. UK GDPR requires you to process only the personal data necessary for your purpose. With AI, this means thinking about what you actually send to the API.

If you're analysing survey feedback for themes, do you need the respondents' names attached? Probably not. Strip them out before processing. If you're segmenting donors, do you need full addresses or just giving history and communication preferences? Send the minimum.

Pseudonymisation is your friend. Replace names with IDs before sending data for processing. Keep the lookup table locally. The AI doesn't need to know that Donor 47 is Sarah Thompson to identify that donors with her giving pattern are likely to respond to a specific appeal.

It genuinely reduces risk. If something goes wrong, the data exposed is less sensitive.

Structuring a proportionate DPIA

A Data Protection Impact Assessment is required when processing is likely to result in a high risk to individuals. Using AI with personal data at any meaningful scale probably qualifies.

A proportionate DPIA for charity AI use should cover: what data you're processing and why, the lawful basis and your balancing test, where the data goes and what protections are in place (DPA, SCCs, encryption), what data minimisation steps you're taking, how long data is retained by the provider, who has access to the outputs, and what the risks are to the individuals whose data you're processing.

This doesn't need to be a 40-page document. For straightforward use cases like donor segmentation or feedback analysis, a few pages covering these points is proportionate. The ICO wants to see that you've thought about it, not that you've written a dissertation.

Review it annually or when your processing changes significantly.

Getting this right without getting stuck

The worst outcome is a charity that never uses AI with its data because the regulatory questions felt too daunting to answer. We've seen organisations spend months in internal debate about whether they can process supporter data through AI, while their peers got on with it sensibly.

The regulatory path is clear: use API-tier products with proper DPAs, establish your lawful basis (probably legitimate interest with a documented balancing test), minimise the personal data you send, complete a proportionate DPIA, and update your privacy notices to reflect AI processing. None of this is novel data protection law. It's the same framework your charity already applies to any data processor, applied to AI providers.

If you're still unsure, start with a use case that involves minimal personal data. Analyse anonymised feedback. Summarise public documents. Draft communications from scratch rather than from personal data. Build confidence and capability before you tackle the harder cases involving beneficiary records or supporter databases.

The charities getting value from AI with their data aren't the ones that found a way around GDPR. They're the ones that worked through it methodically and found it was less of a barrier than they feared.