GDPR in Grantmaking: how funders handle applicant personal data lawfully

How does GDPR apply to grant programs?

The General Data Protection Regulation (GDPR) applies whenever a grant program collects personal data on individuals in the EU or EEA. That covers a great deal of what an application contains: applicant names, contact details, CVs, financial information, and sometimes special-category data such as health or demographic details.

Its reach is broad. A funder processing the personal data of people in the EU is subject to GDPR regardless of where the funder itself is based, so international grantmakers are rarely outside its scope simply by being headquartered elsewhere.

‍

What does GDPR require of a funder?

The foundation is a lawful basis for processing. Under Article 6, a funder must be able to point to a valid basis, most often the applicant's consent, contractual necessity, or a legal obligation, and should identify and document which basis applies before collecting data, rather than assuming consent covers everything.

Beyond a lawful basis, GDPR requires data minimisation (collecting only what is genuinely needed), transparency about how data will be used, defined retention periods, and respect for data-subject rights, including the ability to delete personal data on request.

‍

How is GDPR different from due diligence?

The two are easy to conflate but address opposite concerns. GDPR is about protecting the applicant: how their personal data is collected, secured and retained. Due diligence is about scrutinising the applicant: verifying that a prospective grantee is legitimate and suitable to fund.

A program needs both, and they can pull in different directions. Due diligence may want to gather more information about an applicant, while GDPR pushes toward collecting only what is necessary, which is exactly the kind of tension a documented data policy is there to resolve.

‍

Building GDPR compliance into a grant platform

Handling these obligations by hand is fragile. A grant management software platform builds them in: role-based access limits who can see applicant data, retention rules can be enforced automatically, and every action is recorded in the audit trail, so compliance is a property of the system rather than a matter of individual discipline.