LAWFUL BASIS
Decide why first
You need a lawful basis before you use anyone's information, and you must document it. There are seven, and none is better than the others.
Check what you holdWHAT THE ICO SAYS
Every list is
personal.
An email address can be personal information.
Check what you hold
KEEP IT SAFEand only what you need
- Know your lawful basis
- Mind the CC line
- Act fast on a breach
- Simple habits for small groups
A volunteer tech group soon collects names, emails and notes about who needs what help. The Information Commissioner's Office has plain guidance for small groups and clubs on handling that safely.
Updated
THE SHORT ANSWER
Hold less,
send carefully.
The ICO's advice covers small charities,
groups and clubs as well as businesses.
GROUP EMAILS
The BCC trap
The ICO has seen hundreds of breach reports where senders misused BCC. For bulk emails it suggests mail merge or a bulk email service.
Habits to try
SENSITIVE DETAILS
Some data needs more care
Information revealing religious beliefs or health is special category data and needs an extra condition as well as a lawful basis.
See the numbersGeneral information only, not legal advice. For advice on your own situation, speak to a qualified lawyer or a free advice service.
WHAT ARE YOU HANDLING?
How careful
does it need?
Pick the situation closest to yours. The bar shows how much extra care ICO guidance points to.
Based on ICO guidance on lawful basis, special category data, email security and breaches. General information only, not legal advice.
TWO NUMBERS WORTH KNOWING
Seven reasons,
seventy-two hours.
One figure on how you may use information,
one on how fast to act when it goes wrong.
7
Lawful bases in article 6 of the UK GDPR
Consent, contract, legal obligation, vital interests, public task, recognised legitimate interest and legitimate interests. The ICO updated its guide in April 2026 for the Data (Use and Access) Act.
LAWFUL BASES · ICO
72 hours
Time to tell the ICO about a likely-risk breach
Where feasible, report within 72 hours. The ICO says you can add details later, as long as you do so without undue delay.
BREACH REPORTING · ICO
Not every breach must be reported: the duty applies where a risk to people is likely. Small groups can also check whether they need to pay the ICO's data protection fee, as the 2018 regulations exempt some organisations.
FOUR HABITS FOR A SMALL GROUP
Safer lists,
calmer sessions.
These come straight from ICO guidance and suit a volunteer group with no IT department.
Write down why you hold it
Note your lawful basis and purpose for each list before you start using it, and put them in your privacy information.
Use mail merge for group emails
The ICO suggests bulk email or mail merge services, or separate emails for a small number of people, rather than relying on BCC.
Set a CC warning
Many email systems can alert the sender when the CC field is used, a simple guard the ICO lists.
Plan for a slip
Agree who will assess a breach and contact the ICO, so the 72-hour clock does not catch you out.
FAITH AND INFERENCE
What a list
can reveal.
The ICO's own example says a post about visiting a place of worship is unlikely, by itself, to be special category data. It becomes special category if someone infers a person's religion or treats them differently because of it.
The ICO also notes that religion or belief is both an Equality Act protected characteristic and special category data, so take extra care with any list that records it.
Questions
Questions people ask
Is an email address personal information?
Yes, if a living person can be identified from it directly or indirectly. The ICO says an address that clearly relates to a named person is personal information.
Is using BCC enough for a group email?
Not always. The ICO says BCC is not enough on its own to protect people's information, and you should use alternatives to BCC for anything sensitive.
Do we need consent for everything?
No. Consent is one of seven lawful bases and none is better than the others. The right one depends on your purpose and your relationship with the person.
What counts as special category data?
It includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health, sex life and sexual orientation.
What if we email the list by mistake with everyone in CC?
That discloses everyone's addresses. Assess the risk; if a risk to people is likely, report it to the ICO within 72 hours where feasible. The ICO has fined organisations for this.