Category: Special Category Data

Processing by Not-for-Profit Body

Also known as: Not-for-profit body condition, Article 9(2)(d) condition, Legitimate activities of a not-for-profit body

Simply put

This is one of the specific conditions that allows certain organisations, such as foundations, associations, and other not-for-profit bodies, to process sensitive (special category) personal data as part of their legitimate activities. It typically applies to bodies with a political, philosophical, religious, or trade union aim, and generally covers data about their members, former members, or people in regular contact with them. Even where this condition applies, appropriate safeguards must be in place and, in most cases, the data should not be disclosed outside the body without the individual's consent.

Formal definition

Under Article 9(2)(d) of the (UK) GDPR, the prohibition on processing special category data may be lifted where processing is carried out in the course of the legitimate activities, with appropriate safeguards, by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim. This condition is subject to conditions specified in the Regulation: broadly, that the processing relates solely to the members or former members of the body or to persons who have regular contact with it in connection with its purposes, and that the personal data is not disclosed outside the body without the data subjects' consent. As a condition under Article 9, it addresses only the additional requirement for lawfully processing special category data; a separate Article 6 lawful basis must also be identified, and practitioners should verify the exact statutory wording, any applicable member state or UK national derogations, and current regulator guidance, since these can affect scope and application. The precise contours of terms such as 'legitimate activities,' 'regular contact,' and 'appropriate safeguards' are subject to interpretation and further guidance.

Why it matters

Not-for-profit bodies with a political, philosophical, religious, or trade union aim frequently hold sensitive information about their members by the very nature of what they do. A trade union's membership list reveals union membership, a religious congregation's records reveal religious belief, and a political association's roster reveals political opinion, all of which are special category data under Article 9. Without a specific condition permitting this, the general prohibition on processing special category data would make it practically impossible for such organisations to operate. Article 9(2)(d) provides a targeted route for these bodies to carry out their legitimate activities.

The condition matters because it is narrowly framed and carries built-in limits that are easy to overlook. It generally applies only to processing relating to members, former members, or persons in regular contact with the body in connection with its purposes, and it typically prohibits disclosure of the data outside the body without the data subject's consent. An organisation that relies on this condition but then shares member data with external partners, or that processes data about people who are not members or regular contacts, may fall outside its scope. Because terms such as "legitimate activities," "regular contact," and "appropriate safeguards" are open to interpretation and further guidance, organisations should assess their reliance on this condition carefully rather than treat it as a blanket permission.

It is also important to remember that this is only one part of the compliance picture. Satisfying Article 9(2)(d) removes the additional barrier that applies to special category data, but a separate Article 6 lawful basis is still required, and appropriate safeguards must be in place. The exact statutory wording, applicable national or UK derogations, and current regulator guidance can affect how the condition applies in practice.

Who it's relevant to

Trade unions and staff associations

The fact of union membership is itself special category data. Trade unions and similar bodies typically rely on conditions such as Article 9(2)(d) to process membership records as part of their legitimate activities, subject to appropriate safeguards and the general restriction on disclosing member data externally without consent.

Religious, philosophical, and faith-based organisations

Congregations, faith communities, and philosophically-oriented associations often hold data that reveals religious or philosophical belief. This condition may allow them to process such data about members, former members, and regular contacts, though it does not remove the need for a separate Article 6 basis.

Political parties and campaign groups

Bodies with a political aim commonly process data revealing political opinions about their members and supporters in regular contact with them. They should assess whether their processing stays within the condition's scope, particularly regarding who counts as a member or regular contact and any disclosure outside the body.

Data protection officers and compliance leads in the third sector

Those advising not-for-profit bodies need to map processing against the condition's limits, membership relationship, purpose connection, appropriate safeguards, and the no-external-disclosure-without-consent rule, while confirming a valid Article 6 basis and checking current regulator guidance and any applicable national derogations.

Inside Processing by Not-for-Profit Body

Not-for-profit body context

GDPR provides specific accommodations for processing carried out by foundations, associations, and other not-for-profit bodies with a political, philosophical, religious, or trade union aim. These provisions recognise that such bodies routinely handle members' and contacts' data as part of their core activities. The reader should verify the precise conditions against the current official text of the Regulation.

Special category data condition

Article 9 generally prohibits the processing of special category data (which can include data revealing political opinions, religious or philosophical beliefs, or trade union membership) unless a specific condition applies. One such condition permits processing by a not-for-profit body in the course of its legitimate activities, subject to appropriate safeguards, and typically limited to members, former members, or persons in regular contact with the body in connection with its purposes.

Scope of persons covered

The accommodation generally extends only to data subjects who are members, former members, or individuals who have regular contact with the body in connection with its purposes. Processing relating to persons outside this group is not covered by this particular condition and would need a separate lawful route.

Restriction on disclosure

This condition typically does not authorise disclosure of the personal data outside the body without the data subject's consent. The internal-use limitation is a defining boundary of the concept, and practitioners should confirm the exact wording in the applicable text.

Separate Article 6 basis still required

Reliance on the not-for-profit condition addresses the Article 9 prohibition on special category data, but a distinct Article 6 lawful basis (such as consent, legitimate interests, or another applicable basis) is generally still required for the processing to be lawful. The two layers operate independently.

Appropriate safeguards

The condition applies subject to appropriate safeguards. What constitutes appropriate safeguards is context and risk dependent and may be informed by regulator guidance; the concept does not prescribe a fixed checklist in the Regulation text itself.

Interaction with national and UK law

This is an EU GDPR concept with a corresponding provision in the UK GDPR and its implementing legislation. Member state derogations and national implementing measures can vary the detailed conditions, so the position should be checked against the relevant national law.

Common questions

Answers to the questions practitioners most commonly ask about Processing by Not-for-Profit Body.

Does the not-for-profit exemption mean charities and similar bodies do not have to comply with the GDPR?

No. The provisions relating to processing by not-for-profit bodies do not create a general exemption from the GDPR. Such bodies remain controllers (or processors) subject to the core obligations, including the principles in Article 5, the requirement for a lawful basis, and data subject rights. The relevant provisions typically operate as a specific condition or narrow relaxation in defined circumstances, not a blanket carve-out. The precise scope should be verified against the current official text and any applicable member state implementing law.

Is consent always required when a not-for-profit body processes personal data of its members?

Not necessarily. Consent is only one of the Article 6 legal bases, and processing by a not-for-profit body may rely on another basis such as legitimate interests or contract, subject to assessment. Where the processing involves special category data under Article 9, an additional Article 9 condition is required beyond the Article 6 basis. The condition that may apply to certain foundations, associations, or not-for-profit bodies with a political, philosophical, religious, or trade union aim is generally limited to their own members, former members, or persons in regular contact, and does not extend to unrestricted disclosure outside that body. The applicable conditions should be confirmed against the current text.

Which categories of individuals can a not-for-profit body process under the relevant Article 9 condition?

The condition is generally framed around members, former members, and persons who have regular contact with the body in connection with its purposes. Processing under this condition typically must relate to those categories and should not be disclosed outside the body without the data subject's consent. You should map your actual contact populations against these categories and confirm the precise wording and any member state variation, since national implementing law can alter the position.

What safeguards should a not-for-profit body have in place to rely on this condition?

In most cases, reliance depends on the processing being carried out with appropriate safeguards, in the course of the body's legitimate activities, and limited to the defined categories of individuals. Practical measures generally include documenting the lawful basis and any Article 9 condition, restricting access, applying data minimisation and retention limits, and controlling disclosure outside the body. The specific safeguards required should be assessed against the risk of the processing and verified against the current official text and guidance.

How should a not-for-profit body handle disclosure of member data to third parties?

Where processing relies on the specific condition for not-for-profit bodies, disclosure of the personal data outside that body generally requires the data subject's consent. For disclosures that fall outside this condition, the body should identify a separate lawful basis and, for special category data, a separate Article 9 condition. Assess each disclosure on its facts, and be aware that additional obligations (such as transparency and, where applicable, transfer mechanisms for data leaving the relevant territory) may apply.

Does relying on this condition remove the need for a lawful basis under Article 6?

No. The condition relevant to not-for-profit bodies concerns the additional requirement for special category data under Article 9 and does not replace the need for an Article 6 lawful basis. A body must identify both an Article 6 basis and, where special category data is involved, a valid Article 9 condition. These operate together, and each should be documented separately.

Common misconceptions

The not-for-profit condition means such bodies do not need any other lawful basis to process members' data.

The condition generally addresses only the Article 9 prohibition on special category data. A separate Article 6 lawful basis is typically still required, so the body must identify and document an appropriate Article 6 route in addition to satisfying the Article 9 condition.

A not-for-profit body can freely share members' special category data with third parties because of this condition.

This condition typically does not permit disclosure of the personal data outside the body without the data subject's consent. The accommodation is generally confined to the body's internal legitimate activities, and external sharing usually needs a separate justification.

The condition covers everyone the body interacts with.

The condition generally applies only to members, former members, or persons in regular contact with the body in connection with its purposes. Data about individuals outside this group falls outside this route and would require another basis or condition.

Best practices

Confirm eligibility by documenting that the body qualifies as a not-for-profit with a relevant political, philosophical, religious, or trade union aim, and verify the precise conditions against the current official GDPR text and any applicable national implementing law.

Layer your legal analysis by separately identifying and recording an Article 6 lawful basis alongside the Article 9 not-for-profit condition, rather than treating the condition as a standalone basis.

Limit processing to the covered population, restricting reliance on this condition to members, former members, and persons in regular contact with the body, and use an alternative route for anyone outside that group.

Apply and record appropriate safeguards proportionate to the sensitivity of the data, treating these as context and risk dependent rather than a fixed set.

Do not disclose the data outside the body without the data subject's consent, and build a clear internal control to prevent onward sharing that this condition does not authorise.

Check for divergence between the EU GDPR, UK GDPR, and relevant national derogations, and revisit the analysis periodically as regulator guidance in this area may evolve.