- Check your privacy policies and grant agreements.
- Check whether your 360Giving data could include personal data.
- Consider the responsible data implications of sharing data.
- Remove or anonymise personal data or get informed consent to share it.
- Decide whether to notify your grantees about your 360Giving data.
The data collected by funders about the awards made to grantees belongs to the funder, and information about organisations and the grants they receive is not personal data. However, grants to individuals, grants to smaller organisations, or named contact details for organisations, may contain or constitute personal data.
In general, open data should not contain personal or sensitive personal data that could allow a living person to be identified. Data to be published using the 360Giving Data Standard which does relate to identified individuals should be removed or anonymised to protect their privacy.
Although there are circumstances where publishing personal data is in the public interest, in the case of 360Giving data, personal data should only be included with the consent of the individual concerned.
The guidance below sets out what to consider when publishing your grant data openly for the first time, and notifying your grantees about your 360Giving data.
Checking privacy policies and grant agreements¶
If your organisation already announces details of grants through annual reports, web pages or press releases, you should already have processes in place that establish your rights to share this information publicly.
- Check the terms of your grant agreements for any existing clauses relating to publicity and disclosure of information about grants.
Reviewing your policies¶
When reviewing your grant agreement or terms and conditions:
- An explicit statement that public information might be shared in open datasets.
- A clear statement of scope (state whether you will release just summary information, or you will release detailed grant information, including payments and results).
- If applicable, a clear statement of any personally identifying information you plan to publish (e.g. names, addresses), and details of how grantees should opt-in, or opt-out of which data being shared.
- Statements that imply published information will only be used by specific partner organisations (as this restriction cannot be placed on openly licensed data).
Public vs personal information¶
Attention should be paid to any data you intend to publish which may be personally identifying under the Data Protection Act 2018, including:
- Grants to named individuals.
- The contact person, and their contact details, at an organisation you have funded.
- Personal/residential addresses, for example when an organisation is registered at a home address.
If you intend to publish information about individuals that could be personally identifying, you should either:
- Make sure you have explicit opt-in consent to publish this within an open dataset.
- Or remove or anonymise the information in line with the Information Commissioner‘s anonymisation code of practice.
If you do not intend to publish personal data¶
In general, information about organisations and the grants they have received can be published as open 360Giving data without concern.
However you should still check for personal data appearing by accident. For example descriptive text may include the names or contact details of individuals involved in a project or organisation.
- Check Title, Description and Recipient Org:Description fields, as well as recipient or beneficiary location data, to ensure that this information, on its own or when combined, cannot be used to identify the individual concerned.
- Pay particular attention to any text fields where the source information is entered by applicants via an online application form, especially if the text does not get checked and edited during the grant assessment process.
If you need take further steps to anonymise or remove potentially identifying data, make a note of the changes you make to ensure these checks and steps are taken each time you publish new data.
Organisations registered at a home address¶
If the address of an organisation is a private home address, which can be the case for grassroots or informal groups and small registered charities, this information is not suitable for inclusion in 360Giving data in full.
Redacting street-level addresses, and including only the postal town and the postcode may be sufficient to prevent the information from identifying an individual. However the appropriate approach to redaction will depend on the context of the data, for example by only including the first digits of the postcode if the address is in a sparsely populated rural area.
Some publishers avoid the possibility of publishing home address data by sharing recipient location data using geocodes instead of address information.
This option has been used by funders who frequently fund smaller or informal groups where there is a high likelihood of home addresses appearing in their data. This approach also suits funders who award large volumes of grants where distinguishing which recipients use home addresses would be challenging or time-consuming.
For further information see our guidance about how to convert postcodes into geocodes.
There can be cases where grant data is sensitive for reasons other than privacy. For example, the address of a women’s refuge might be inappropriate to include in data about a grant to that organisation.
Consider whether any of your grant data might contain other sensitive information, and make sure you have a process in place to review and redact it (or seek consent to publish) where required.
Sharing Data Responsibly – A Conversation Guide for Funders is designed for funders and grantmakers who want practical advice on how to treat their grantees’ data responsibly. Published by the Ariadne Network and Engine Room, this report is aimed at Human Rights funders working internationally, but has relevant information for all other types of funders.
Access the Responsible Data guide.
The guide follows the grant management cycle, providing information to guide decisions at each stage:
- Data collecting: managing data in the application, monitoring and reporting phases.
- Storing grantee data: how to provide clear information on which data is collected and why, and how you will store it.
- Sharing and publishing information: sharing and publishing information in a considered, responsible way.
Notifying grantees about your 360Giving data¶
Even if you will not be sharing personally identifying information and so do not need to gather extra consents, you may wish to let your grantees know about your 360Giving publication, as a courtesy. This can also be a good opportunity to solicit any updates from them.
For example, in your communication with grantees you could cover the following:
What data will be published?
The data will include the name of the grant recipient organisation, amount, date and a brief description of the purpose of the grant. (This section should be updated to reflect the fields included in your data.)
How will data be published?
The data will be available to download from our website (insert link). The data will then be available for tools that use open data, for example GrantNav. This is a tool created by 360Giving, but anyone could create a tool that uses the data.
Why are you publishing data in this way?
We are proud to be associated with our partner organisations and this is a way to share information about our collective work that can support learning and better decision-making in the charitable giving sector. Publishing open data about grants awarded in this way complements the news shared about the partners’ work and achievements.
For more information about the 360Giving initiative visit their website: https://www.threesixtygiving.org/
If you do intend to publish personal data¶
We encourage publishers to carefully consider the value of publishing any personal information as part of their 360Giving data and discourage sharing of special category data (including racial or ethnic origin and health information).
Before making a decision on including personal data:
- Review the ICO’s Key definitions of the data protection act to understand the difference between non-personal data, personal data and sensitive personal data;
- Review the ICO’s Guide to data protection to understand your organisation’s obligations;
- Ensure your organisation has the power to share the data.
Grants to named individuals¶
The 360Giving Data Standard was designed for publishing data about grants awarded to organisations, however it is possible to publish grants awarded to individuals as well.
In this case, all personally identifying data should be appropriately anonymised unless informed consent to publicly share the information has been given by the individual concerned.
Examples of how to anonymise personally identifying data include:
- Replacing individual names with ‘Grant to individual’.
- Redacting street-level addresses, and including just postal town or the first part of the postcode (known in the UK as the Outward code) or converting postcode data into geocodes. Note: the appropriate approach to redaction will depend on the context of the data.
- Replacing individual contact person names with their roles (e.g. Project Manager) and generic email addresses.
Seeking consent to include personal data¶
In cases where you do wish to seek permission to include personal or sensitive personal information in your 360Giving data, it is important to make sure grantees are aware of:
- The specific scope of personal data to be published.
- The terms under which it will be made available as open data.
You can find a definition of personal data and sensitive personal data – known as special category data – on the Information Commissioner’s website.
For example, if you were looking to publish names and abbreviated location information, you might include:
“We are seeking your permission to include the contact person for your grant and the first part of your postcode (known as the Outward code), alongside other general grant information, as part of open data about our grant making. This information will be included in a public dataset under an open license. This means that any third party is free to access and re-use the data.“
You will need to write the permission request based on the particular data you plan to publish.
Consider including additional fields in your internal data systems to log:
- When a grant record includes personal, or personally identifying, data (e.g. an individual’s residential address as the registered address of a charity; grants to named individuals) or otherwise sensitive data (e.g. grants to a refuge or other location that should not be disclosed for safety reasons).
- Whether or not consent has been obtained.
Be aware that consent can be withdrawn at any time so you will also need to put in place processes to trigger a change to your open grants data if that happens.
360Giving has a Take Down policy which sets out how we respond to requests to remove any published data linked from our Data Registry and loaded into our tools. Read the 360Giving Take Down policy.
Start by publishing what you can¶
You can still take steps toward publishing your data, even if you find that there are some data protection policy issues to address. Consider which fields and grant records are not affected by any barriers, and move forward with publishing these. The learning from this process can then be applied back to other grants once the policy issues are resolved.
Example open data policy¶
An example of an open data policy is available, written by some of the experts who helped create the 360Giving Data Standard. It can be used as a template for any organisation’s data policy and adjusted to reflect specific circumstances and needs.
Adopting an open data policy for your organisation will help to guide the checks you make before publishing data, and record the range and type of changes that may need to be made to your grant information before sharing it openly.
Further information about data protection¶
If you want to discuss this data protection guidance and how it relates to your specific circumstances, please contact 360Giving Helpdesk via firstname.lastname@example.org.
Read our guidance about how to prepare your grants data ready for publishing as 360Giving data.