Fundraising organisations must not share people’s personal data with third parties unless they have express consent to do so, following a change to the Code of Fundraising Practice.

An amendment to the Code, made by the Institute of Fundraising’s Standards Committee in early March, means that charities cannot share an individual’s personal data with third parties to use for marketing or fundraising purposes unless that person has explicitly consented.

The requirement will apply even if the charity in question is not receiving payment from the third party for the data.

The new rule states that charities will need the “explicit consent of that individual” to share their data with third parties.

It also defines “explicit consent” as: “an individual must have provided a positive indication that they agree to their personal data being shared. This could take the form of ticking an opt-in box, or another action that signifies agreement, such as oral confirmation, or the provision of contact details where the individual has been clearly informed that by giving these details they agree to their data being shared”.

The IoF promised changes to the Code relating to data swapping in January, but said at the time that it was “seeking legal advice about when to bring these changes in” and said it would only make alterations to the Code in concert with the Information Commissioner’s Office.

The ICO published a number of updates to its direct marketing guidance on 23 March.

Daniel Fluskey, head of policy and research at the IoF, said that the decision to amend the Code before the ICO had updated its marketing guidance was in order to be proactive about the issue.

He said the IoF showed the ICO a draft of the update, and was in consultation with it to make sure it “had no concerns and was consistent with its own guidance”.