Aipedia: Charities and trustees

AI donor profiling and wealth screening

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Charities can use AI for prospect research and donor segmentation if they are transparent, keep human oversight of automated fundraising decisions and comply with UK GDPR. ICO fines that follow cannot be covered by insurance bought for trustees under Charities Act 2011 s.189.

Part of: AI in Charities and trustees

In short

Fundraising teams use AI to screen supporters for wealth, score propensity to give and segment databases. The Fundraising Regulator's AI guidance asks charities to cover AI processing in their privacy notice, keep non-public information out of public AI tools and keep human oversight of automated fundraising decisions. UK GDPR Articles 22A to 22D, in force since 5 February 2026, add safeguards for significant decisions based solely on automated processing. The charitable soft opt-in also applies from that date. Charities Act 2011 s.189(2)(a) means ICO fines cannot be covered by trustee indemnity, although civil claims and defence costs may be, depending on the wording.

How charities use AI for donor research

Data-led fundraising has moved from spreadsheets to AI models. Charities and their agencies use AI to:

screen supporter databases against public information to identify major donor prospects;
score each supporter's propensity to give, upgrade or leave a legacy;
segment supporters and choose who receives which ask;
summarise what is publicly known about a prospect before a meeting.

This is profiling of personal data, often without the supporter's knowledge. The Information Commissioner's Office regulates it.

The duties that apply

Transparency: the Fundraising Regulator's AI guidance says privacy notices should cover AI processing and charities should know how each tool uses, stores and shares data.
Public tools: do not put non-public information into publicly available AI tools.
Human oversight is needed for automated fundraising decisions.
Automated decisions: UK GDPR Articles 22A to 22D, inserted by DUAA 2025 s.80 and in force since 5 February 2026 under SI 2026/82, set safeguards where a significant decision about a person is based solely on automated processing. Whether a fundraising decision is significant depends on its effect on the individual; take advice if a model decides who is excluded or treated differently without human review.
Soft opt-in: the charitable purpose soft opt-in for electronic marketing applies from 5 February 2026, only to charities and not retrospectively (Birketts summary).
The ICO's AI guidance covers fairness and transparency in AI processing.

What can go wrong

Illustrative scenario: a charity's agency uses an AI tool to wealth-screen its whole database and to flag supporters who might be persuaded to increase their gift. The privacy notice says nothing about profiling or AI. A supporter makes a subject access request, sees the profile, and complains to the ICO and the press. The ICO investigates and the board learns the agency also uploaded the database to a tool whose terms let the provider reuse the data.

Other risks: a propensity model that systematically targets older or vulnerable supporters, segmentation that relies on inferences people would not expect, and electronic marketing sent on a soft opt-in basis to people whose details were collected before it applied.

How insurance usually responds

Charities Act 2011 s.189(2)(a) says insurance bought for trustees from charity funds cannot cover criminal fines or regulatory penalties, so an ICO fine stays with the charity. Civil claims are different: compensation claims from supporters and the cost of responding to a breach may fall under cyber cover, and some D&O wordings pay defence costs for regulatory investigations. See GDPR fines versus civil claims and cyber insurance and AI risks.

If a supporter or regulator alleges the trustees failed to oversee the charity's data practices, charity D&O may respond, subject to the terms and any data protection exclusion. Cover for the charity's agency sits with the agency's own PI.

Practical controls

Update the privacy notice to describe profiling and AI processing.
Carry out a data protection impact assessment before wealth screening.
Check each tool's terms on data reuse and storage.
Keep a human review step before any automated decision that excludes or treats supporters differently.
Confirm marketing consent bases, including when the soft opt-in started to apply.
Bring agencies within your AI policy.

How Apex helps

Apex arranges D&O and trustee indemnity for charities, and a broker can check how data protection claims and investigations are treated across your policies. See the AI in charities hub.

Sources

Frequently asked

Is wealth screening allowed for charities?

It can be lawful, but it is profiling of personal data. The Fundraising Regulator expects privacy notices to cover AI processing and human oversight of automated fundraising decisions, and UK GDPR transparency rules apply. Carrying out a data protection impact assessment first is a sensible step.

Do Articles 22A to 22D apply to donor scoring?

They apply where a significant decision about a person is based solely on automated processing. Most scoring feeds human decisions, but a model that alone decides who is excluded or treated differently could engage them. Take advice on your own use.

Can trustee indemnity pay an ICO fine?

No. Charities Act 2011 s.189(2)(a) bars insurance bought under that power from covering criminal fines or regulatory penalties. Civil compensation claims and defence costs may be covered under cyber or D&O, depending on the wording.

Does the soft opt-in let us email past supporters?

The charitable purpose soft opt-in for electronic marketing applies from 5 February 2026, only to charities, and is not retrospective, according to a Birketts summary. Check how and when each supporter's details were collected before relying on it, and take advice on the conditions.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.