NDA for UK Charities and Non-Profits: Protecting Donors, Partners and Sensitive Data

UK charities and non-profits operate in a world of pre-contractual disclosure: grant applications, corporate social responsibility partnerships, service delivery agreements, joint bids and technology collaborations all require sharing sensitive information before any formal agreement is signed. Without an NDA, a prospective partner, sponsor or contractor receives that information with no legal obligation to keep it confidential — leaving the charity exposed if the relationship does not proceed.

Why UK charities and non-profits need NDAs

A charity's charitable status does not automatically protect its confidential information. The Charities Act 2011 imposes duties on trustees to protect the charity's assets — and confidential information, proprietary methodologies, donor data and strategic plans are assets in the same way as equipment or intellectual property. Without a written contract, there is no binding obligation on a third party to keep information confidential.

The situations in which a UK charity typically needs an NDA before sharing sensitive information include:

• Corporate CSR and sponsorship negotiations: before a charity shares unreleased fundraising campaigns, audience insight data or co-branding plans with a prospective corporate partner.
• Grant applications and joint bids: when two charities or a charity and a public sector body co-author a tender or grant application and share programme methodologies, cost models and strategic plans.
• Technology and platform partnerships: when a charity licenses or co-develops a digital platform, beneficiary management system or EdTech product with a technology provider.
• Research collaborations: when sharing unpublished research findings, data sets or evaluation methodologies with a university, think tank or policy body.
• Commissioning and procurement: when a charity as commissioner shares specifications, pricing benchmarks or service delivery data with prospective providers before a contract award.
• Trustee recruitment: when a prospective trustee is given access to board papers, financial projections or strategic plans before formal appointment.

What a charity NDA typically protects

A charity NDA's confidential information definition should expressly cover the categories of sensitive information the charity actually handles. Generic definitions are weaker than specific ones. Common categories include:

• Fundraising strategies and donor data: donor acquisition and retention strategies, major donor pipelines, legacy programme plans, and the identities of named donors who have not consented to disclosure.
• Programme methodologies: proprietary service delivery approaches, intervention models, assessment tools and impact measurement frameworks.
• Financial and operational data: budget forecasts, reserve policies, cost-per-beneficiary data and grant pipeline information.
• Strategic plans: unreleased geographic expansion plans, merger or partnership discussions, campaign plans and product development roadmaps.
• Technology and systems: proprietary software, databases, beneficiary management systems and any EdTech or social technology platform the charity operates.
• Third-party confidential information: beneficiary personal data (which also requires a UK GDPR data processing agreement) and information shared in confidence by funders, partners or commissioners.

Trustees and board confidentiality

Charity trustees have a fiduciary duty to protect the charity's assets, which includes its confidential information. Board minutes, financial forecasts, governance discussions and strategic plans shared in trustee meetings are confidential by nature — but that implied confidentiality is strengthened by a written agreement.

For prospective trustees who are given access to board papers or financial information before formal appointment, a short one-way NDA is good practice. It makes explicit what information is confidential, how long the obligation runs, and what happens if the trusteeship does not proceed.

Once appointed, trustees are subject to the charity's governance framework — typically a code of conduct that incorporates a confidentiality obligation. Where a trustee also has a commercial relationship with the charity as a supplier or partner, a formal NDA covering that relationship is separately appropriate, to avoid mixing fiduciary and commercial duties.

Volunteers, staff and NDAs: who you can bind

Charities have a more complex workforce than many businesses: paid employees, self-employed contractors, short-term volunteers, long-term volunteers who may have ‘worker’ status, and specialist pro bono advisers. The right NDA — and the carve-outs required — differ by category:

• Paid employees: use an employee NDA, which must include statutory carve-outs for whistleblowing (PIDA 1998), victim reporting (Victims and Prisoners Act 2024) and regulator cooperation. Employees of charities have the same whistleblowing rights as any other worker.
• Contractors and consultants: use a freelancer NDA, which includes IR35 acknowledgement language, an IP assignment clause for work product, and PIDA 1998 carve-outs. Contractors who access donor data or beneficiary records should also sign a UK GDPR data processing schedule.
• Volunteers: volunteers are not employees. A simple one-way NDA or a freelancer-style confidentiality agreement is appropriate. Include PIDA 1998 carve-outs where the volunteer could be classified as a ‘worker’ — volunteers with structured, regular roles and some form of reward may qualify. Asking a volunteer to sign an employment NDA risks creating implied employment rights.
• Pro bono advisers: treat as contractors. A freelancer NDA or mutual NDA is appropriate depending on whether the adviser also shares their own sensitive information — for example, a law firm disclosing its precedent documents while advising pro bono.

Corporate partnerships and CSR sponsorship

Corporate and charity partnerships typically involve two-way disclosure: the charity shares unreleased campaign plans, beneficiary insight and co-branding proposals; the corporate shares its communications strategy, brand guidelines, employee engagement plans and sometimes commercial terms. A mutual NDA is appropriate from the first substantive meeting.

Large corporates may propose using their own NDA template. Review it carefully before signing: charity-specific carve-outs for Charity Commission reporting, HMRC and PIDA 1998 may be absent. The charity's own template, which already includes these carve-outs, is generally more appropriate. Where the corporate insists on using its own template, negotiate the insertion of the mandatory carve-outs before signing.

Multi-year partnership agreements often include a confidentiality clause within the main agreement. An NDA signed at the outset governs the pre-contract evaluation period; the partnership agreement's confidentiality clause governs the ongoing relationship. Both should be consistent in scope and duration.

What a charity NDA cannot lawfully restrict

Regardless of what the NDA says, certain disclosures cannot be contractually restricted by a UK charity NDA:

• Reporting to the Charity Commission: the Charity Commission of England and Wales (or OSCR in Scotland, CCNI in Northern Ireland) cannot be excluded from regulatory oversight by a private contract. Trustees, employees, volunteers and contractors retain the right to report serious incidents, governance failures and safeguarding concerns to the regulator.
• HMRC reporting: disclosure to HMRC for tax purposes — including reporting Gift Aid irregularities or charitable status fraud — cannot be prevented by an NDA.
• Whistleblowing under PIDA 1998: any qualifying protected disclosure to an appropriate person under the Public Interest Disclosure Act 1998 cannot be blocked. For workers (including some volunteers and contractors), this protection is statutory and overrides any contractual restriction.
• Reporting a criminal offence: any clause purporting to prevent reporting a criminal offence to the police or another appropriate authority is void as contrary to public policy.
• Safeguarding disclosures: disclosures to social services, the police or other agencies where there is a child protection or adult safeguarding concern cannot be prevented by an NDA. Clauses that purport to cover safeguarding situations are void and may breach the charity's statutory safeguarding obligations.
• Cooperation with the ICO and other regulators: cooperation with the Information Commissioner's Office, Competition and Markets Authority or any other regulatory body acting in the course of their statutory functions cannot be contractually restricted.

Which NDA template to use

NDASafe offers four variants that charities most commonly use:

• Mutual NDA (£29): use for corporate CSR partnerships, joint bids, research collaborations and co-delivery agreements where both parties share sensitive information.
• One-Way NDA, Disclosing (£29): use when the charity is the disclosing party — sharing grant application data, programme methodologies or strategic plans with a third party who is not disclosing anything in return.
• Freelancer NDA (£29): use for engaging contractors, consultants and specialist volunteers. Includes IR35 acknowledgement, IP assignment for work product and PIDA 1998 carve-outs.
• Employee NDA (£29): use for paid employees. Includes mandatory whistleblowing (PIDA 1998) and victim-reporting (Victims and Prisoners Act 2024) carve-outs, plus optional non-compete and IP-assignment blocks.
• Complete NDA Bundle (£79): all eight NDA variants. Suitable for charities that regularly engage a mix of corporate partners, contractors, employees and pro bono advisers.