Governance & compliance
Data protection & UK GDPR
Data protection worries some organisations more than it needs to, and reassures others who ought to worry more. We give clear, proportionate advice on the UK GDPR, so you handle people’s information properly without turning into a compliance department.
Who this is for
Charities, cultural organisations and creative businesses that hold personal data, which is all of them: supporters, audiences, participants, staff, volunteers and members.
Whether you need to get the basics right, answer a specific request, or deal with something that has gone wrong, we can help.
At a glance
- Privacy notices and policies people can follow
- Subject access requests answered on time
- Data breaches: deciding whether to report
- Data protection complaints handled properly
How we help
We advise at the level you need: privacy notices that fit your fundraising and marketing, data protection policies and retention that people can follow, and the lawful bases for what you do with personal data.
When something specific lands, we help you handle it: answering a subject access request on time, managing a data breach and deciding whether it must be reported to the Information Commission (ICO), and dealing with complaints and the exemptions that make requests tricky. We keep it proportionate to your size and risk.
Talk to us
Not sure where to start? Book an online appointment and we will point you to the right help.
Email hello@proartsplus.co.uk or call 0330 127 1414 during office hours.
How it works
- Map
We find out what data you hold and why. - Fix
We put the right notices, policies and habits in place. - Respond
When a request or breach arrives, we help you act quickly. - Review
We check things still work as you grow.
Requests and breaches both come with time limits, so get in touch as soon as one arrives.
Why ProArtsPlus
We give proportionate advice, not fear. The sector holds a lot of sensitive information about audiences, participants and supporters, and we help you protect it in a way that fits how you work and what you can afford.
Frequently asked questions
How long do we have to answer a subject access request?
There are strict time limits, and the rules on when the clock starts and when it can be extended are where these requests go wrong. Get in touch as soon as one arrives and we will help you meet the deadline.
When do we have to report a data breach to the ICO?
Without undue delay and, if feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people’s rights and freedoms. We help you make the call and, if needed, the report.
Do we need a complaints process for data protection?
Yes. People can complain to you directly if they think their personal data has been mishandled. You must make that easy, for example with a complaint form, and acknowledge each complaint. We help you set this up.
Do small charities have to comply with the UK GDPR?
Yes. The rules apply whatever your size, but what compliance looks like is proportionate to what you do. We help you do what matters rather than everything imaginable.
Do we need to pay a fee to the ICO?
Most organisations that process personal data must pay a data protection fee unless all their processing is exempt. We help you check.
Latest from our blog
-
Few perks of trusteeship feel as natural as a seat at your own charity’s opening night. You give your time for nothing,…
-
Coventry’s year as UK City of Culture brought a remarkable programme to the city. On 4th September 2026 the Charity Commission published…
-
The Charity Commission’s new Charity sector risk assessment, published this month, sets out the risks facing charities across England and Wales, and…
Not sure where to start?
Tell us what you are dealing with and we will point you to the right help.