Donor data protection charity checklist for auction night

Donor data protection charity policies tend to be written for the office: a privacy notice, a retention schedule, an unticked box on the donate page. Then you run an auction, and by midnight the charity holds several hundred pieces of personal information nobody planned for.

This is about that night, not the law in the abstract. It is general information rather than legal advice, and the regime itself sits with the ICO and the fundraising code.

What does donor data protection charity guidance actually ask of you?

Four things, all practical. Collect only what you need, say what you are doing as you collect it, keep it secure, and get rid of it when the purpose ends.

The ICO’s data minimisation principle calls for adequate, relevant data limited to what is necessary. The Fundraising Regulator’s data privacy guide, updated in June 2026, is blunter: once the purpose ends you must destroy or delete, and it is not lawful to keep data just in case. The Code also asks you not to unreasonably intrude on anyone’s privacy.

None of that is hard. It fails on the night because nobody owned it.

What is on the bid sheet, and who picks it up?

A name, a table number, a phone number, and how much that person was willing to spend. At a silent auction, forty of those sheets sit unattended in a room full of strangers for three hours.

The ICO is explicit that the security principle covers physical measures as well as systems, and that many incidents come from hard-copy records being lost, stolen or incorrectly disposed of. A bid sheet abandoned at the end of a gala is all three waiting to happen.

Fix it with logistics, not policy. Number the sheets, and give one named volunteer the job of collecting every one, counting them against that list and putting them in a closed box. If a sheet is missing, somebody needs to know before the cleaners arrive, because accidental loss of personal data is a breach and the clock on it is 72 hours.

Why should nobody ever write a card number on paper?

Because the card security code must not survive the payment, and a biro does not know that. The PCI Security Standards Council’s guidance on telephone payments states that storing the three or four digit validation code after authorisation breaches PCI DSS requirement 3.2, even encrypted.

It still happens. The terminal loses signal mid-checkout, a queue builds, and a helpful volunteer says write it down and we will run it in the morning. Nobody is being careless. The charity is now holding live card numbers in a cash tin.

Three better answers, all duller. Hold the lot until the terminal recovers. Send a payment link the next working day against an invoice. Or put the guest on the venue’s terminal and settle with the venue afterwards.

The registration desk is where your mailing list gets decided

Everything about the follow-up email is settled in the ninety seconds a guest spends at the door, and almost nobody realises it.

Charities did gain real flexibility here. A charitable purposes soft opt-in commenced on 5 February 2026, with final ICO guidance in April 2026, and paying to take part in a charity’s fundraising event can count as support. It only works if the opt-out was offered when the details were taken. The ICO says staff taking details verbally should specifically offer that choice, and that an opt-out in a later confirmation email does not count.

So the clipboard matters more than the privacy notice. One line on the sheet, read out by whoever holds the pen: we will email you about our work unless you tick here.

The raffle stub is the same problem in miniature, usually a phone number on a cloakroom ticket. If you sell raffle prizes and want to keep those numbers, say so on the ticket book. If not, use stubs with nowhere to write one. A commission bid needs the same box and the same collection route.

Who gave you the corporate table’s guest list?

A company bought ten seats and emailed ten names, ten dietary notes and a wheelchair access request. Nobody on that list ever gave you anything.

You still owe those guests privacy information. Where data comes from a source other than the individual, the ICO’s timing is a reasonable period and no later than one month. Dietary and access notes can reveal health or belief too, which is more sensitive than a name on a seating plan.

The second trap catches more charities. The soft opt-in applies only where you obtained the details directly, and the ICO states it does not apply if someone else obtains them for you. A table host’s spreadsheet is not a mailing list. Put a sentence on the booking form asking the company to tell its guests who will hold their details.

What notice do people actually get about photography?

Usually a line in a joining email nobody opened. That is thin, and the fix costs nothing: put it on the ticket, in the joining instructions, and on a sign at the door naming who is filming, what the footage is for and how long it is kept. Tell the photographer where not to point the camera, which means the registration desk, the payment table and any screen showing bidder names.

The pledge moment deserves its own thought. A close-up of a guest raising a paddle records what that person gave, which is rather more revealing than a photograph of the dessert. If it is going in next year’s appeal, decide that before the shoot.

Who owns donor data protection charity duties for your suppliers?

You do. The charity is the controller, and the people you hired act on your instructions, which makes them processors rather than co-owners of anything.

Write it down. The ICO sets out what the contract must contain, including that no sub-processor is brought in without your written authorisation and that everything is deleted or returned at the end. Ask one question before you sign: after the event, can we export the lot, and will you delete your copy.

Then list who physically holds what. The platform has the bidder records. The AV company may have a running order with table names on it. The photographer has a memory card. I come off stage with a lot sheet on a clipboard, which is why it goes back to the charity’s named person rather than into my bag.

The volunteers’ own phones

Nobody writes a policy for this one. By the end of the night there is a WhatsApp group with twelve people in it, a photo of the bid sheet and a screenshot of the bidder list.

That is personal devices the charity does not control, and it will sit there for years. Decide in advance what may be posted in the group, normally table numbers and nothing else. Delete the group once reconciliation is done, and ask people to confirm the photos have gone.

What has to survive the night, and what gets shredded?

The Gift Aid trail survives. Almost nothing else does.

HMRC requires records providing an audit trail linking each donation to an identifiable donor who gave a valid declaration, and for a charitable company those tax records must be kept until six years after the end of the accounting period. The auction record, the pledge totals and the declarations are not yours to bin. My guide to pledge cards covers what those should capture.

Everything else has a shorter life, and the storage limitation principle expects you to justify the period you chose. Dietary notes die with the dinner. Working copies of the seating plan go once the room is cleared. Write those periods down before the event rather than guessing in January.

Shred, do not bin. The ICO’s security guidance asks specifically how you dispose of paper.

The end-of-night checklist

Give this to one person, on paper, with a pen attached.

1. Collect every numbered bid sheet and count them against the list.
2. Sweep the tables, the lectern, the desk and the toilets for stray paper.
3. Collect the raffle stub books and the absentee bid forms.
4. Check the cash tin for anything with a card number on it. Deal with it tonight.
5. Take back laptops, tablets and printed bidder lists.
6. Get the photographer and the AV crew to confirm what they are taking away.
7. Put all paper in one closed, labelled box and hand it to the named person. Not the boot of a car.
8. Post one message in the volunteer group: forward nothing from tonight.
9. Within 48 hours, type up what you need and shred what you do not.
10. If anything is unaccounted for, tell whoever makes the breach decision.

What I watch for in the room

The queue at checkout. I do 60 to 80 events a year, and that queue is where the evening’s data decisions actually get made, by a tired volunteer with a biro and a long queue behind them.

I would rather these questions were settled months out, next to the running order and the lot list. What are we collecting, who holds it, and how does a guest say no.

If you want the paperwork designed as carefully as the auction, that is part of what I do as auctioneer and host. Call 07596 851647.