I am having some difficulty in persuading a client that GDPR is designed to help, not hinder our activity. They say that the fundraising team cannot collect and collate information on potential donors without asking the prospect for their permission first. I pointed out that we would have no idea on the likely status of an individual if we failed to do the research. Once we have the information (all in the public domain), we could evaluate their potential.

Rather grumpily, they then said, fine, but we must contact all of the possible supporters within 30 days of starting the research.

Does anyone have a helpful narrative to break the log jam please?