ComplyChat guides · 78 guides
Guides for charities and community groups
Charity trustees answer to the Charity Commission, the Charities Act, their governing document and UK GDPR, and most of them do it as volunteers. These guides cover the duties trustees carry, the policies a charity needs, safeguarding and data protection, quote the Commission’s own guidance, and name the record that shows a duty was met. Youth clubs, sports clubs, churches and PTAs will find their guides here too.
Where to start
- Charity trustee responsibilities: the six main dutiesThe six main duties of a charity trustee from the Commission's CC3, who is eligible, the chair and treasurer roles, and when trustees can be personally liable.
- What policies does a charity need? The legal minimum and the restWhich charity policies are required by law, which the Charity Commission expects, which depend on staff, volunteers or fundraising, and how to keep them real.
- Charity Governance Code 2025: eight principles and what changedThe Charity Governance Code 2025 explained for trustees: the eight principles, apply or explain, what is new since 2017, the evidence it suggests, and how to use it.
- Safeguarding policy for a small charity: what it should coverWhat the Charity Commission expects of a small charity’s safeguarding policy, with reporting routes, trustee oversight and practical records.
- Trustees WhatsApp group: what it can and cannot be used forWhat a trustees or governors WhatsApp group can be used for, when a decision in it is valid, and what it means for conflicts, personal data, SARs and leavers.
- Volunteer WhatsApp groups: how to run one and when to move onHow a charity should run a volunteer WhatsApp group: consent, admins, group rules, young volunteers, what never goes in it, and the signs it has outgrown the job.
Governance and the board
- Guide · Charity governance
Charity trustee responsibilities: the six main duties
What the Charity Commission expects of a trustee, taken from CC3: the six duties, who is eligible, chair and treasurer roles, and when trustees can be personally liable.
- Guide · Governance
Conflict of interest policy: what it must include
The types of conflict a policy must cover, the seven questions it has to answer, how a conflict is managed in a meeting, and what happens when one is not disclosed.
- Guide · Governance
Social media policy for a charity: what it must cover
The Charity Commission's 2023 checklist turned into a working policy: who posts and approves, personal accounts, emotive issues, campaigning, harmful content, complaints, and the private groups most policies forget.
- Guide · Governance
Minute taking: what to record and what to leave out
What belongs in meeting minutes and what does not, who should take them, a reusable structure, and why the minute book no longer sees every decision.
- Guide · Governance
Board minutes retention: how long to keep minutes, who is entitled to see them, and what the record has to prove
Board minutes retention for charities, schools and care providers in England: the ten-year rule for companies under the Companies Act 2006, the six-year rule for CIOs, what a maintained school governing body and an academy trust must make available for inspection, what the minutes are evidence of, the form the record may take, and the decisions made between meetings that never reach it.
- Guide · Charity governance
Trustees' annual report: what it must contain, and the records you need before you write it
Who must prepare one, the simple report and the full SORP report line by line, the public benefit statement the law requires, the thresholds changing for year ends from 30 September 2026, and the accounting and governance records behind every sentence.
- Guide · Charity governance
Charity Governance Code 2025: eight principles and what changed
The Charity Governance Code 2025 explained for trustees: the eight principles, apply or explain, what is new since 2017, the evidence it suggests, and how to use it.
- Guide · Charity governance
Governance framework for a charity: documents and how they fit
A charity's governance framework in England and Wales: the law, the governing document and how to change it, delegation and terms of reference, policies, and review.
- Guide · Charity governance
What policies does a charity need? The legal minimum and the rest
Which charity policies are required by law, which the Charity Commission expects, which depend on staff, volunteers or fundraising, and how to keep them real.
- Guide · Charity governance
Code of conduct for trustees: contents, adoption and breaches
A trustee code of conduct for a charity or academy trust: whether it is required, what the 2025 Charity Governance Code expects, what to include, and breaches.
- Guide · Charity governance
Register of interests for a charity: entries, updates and minutes
How a charity keeps a register of trustees' interests: what to record, the declaration form, annual updates, declarations at meetings and the minute that proves it.
- Guide · Charity governance
Trustee email retention: what to keep, for how long, and leavers
Trustee email in charities, schools and academy trusts: whose record it is, why personal addresses fail, SARs and FOI, how long to keep what, and leavers.
- Guide · Charities
Charity communication policy: who speaks, sign-off and records
What a charity communication policy should cover: spokespeople, sign-off, campaigning under CC9, the charitable soft opt-in, internal channels and incidents.
- Guide · Governance
Grievance procedure: the Acas Code steps and what to record
A grievance procedure under the Acas Code: what a grievance is, the steps, the meeting, accompaniment, the outcome and appeal, what to record, and tribunal time limits.
- Guide · Charity governance
Trustee recruitment: finding, checking and appointing trustees
How to recruit charity trustees: skills audit, open recruitment, the role description, eligibility checks and declarations, DBS, appointment and induction.
- Guide · Charity governance
Trustee decisions between meetings
How trustees can decide between meetings: written resolutions, chair’s action, delegation, voting rules and the evidence to retain.
- Guide · Charity governance
Trustees WhatsApp group: what it can and cannot be used for
What a trustees or governors WhatsApp group can be used for, when a decision in it is valid, and what it means for conflicts, personal data, SARs and leavers.
- Guide · Governance
Risk register: what it records and what the regulators expect
What a risk register is, what it should include, how likelihood and impact scoring works, and what CC26, the Academy Trust Handbook and CQC expect of boards.
- Guide · Charity governance
Trustee induction checklist: what to give, explain and record
A trustee induction checklist built from Charity Commission guidance (CC30) and the Charity Governance Code, with trustee training and the records to keep.
- Guide · Charity governance
Trustee resignation and removal: steps, notices and records
How a charity trustee resigns or is removed in England and Wales: the governing document, the quorum, the minute, the register update and Companies House.
- Guide · Charity governance
Trustee skills audit: the matrix, the gaps and the action log
How to run a trustee skills audit from Charity Commission guidance and the Charity Governance Code: the skills matrix, scoring, gap analysis and actions.
- Guide · Charity governance
Charity board effectiveness review: how to run one and record it
How a charity board reviews its effectiveness under the Charity Governance Code: self-assessment, external review, chair and trustee reviews, and records.
- Guide · Charity governance
Charity trustee liability: when trustees pay, and what protects them
When charity trustees are personally liable – to the charity, to third parties and in criminal law – and the relief, indemnity and insurance that protect them.
- Guide · Charity governance
Charity fraud policy: what to include, report and record
What a charity anti-fraud policy should contain, when fraud is a serious incident for the Charity Commission, Report Fraud, and the fraud register.
- Guide · Charities
PTA constitution: clauses, officers and the records to keep
What a school PTA constitution must cover, the Charity Commission model documents, the £5,000 registration threshold, officers, AGMs and the records to keep.
- Guide · Charity governance
Charity reserves policy: a template and how CC19 sets the target
A charity reserves policy template built on the Charity Commission’s CC19: what counts as reserves, setting and justifying a target, monitoring and reporting.
- Guide · Charities
Volunteer code of conduct: what to include and how to record it
What a charity’s code of conduct for volunteers and staff should cover, how it differs for each, recording that people have read it, and handling a breach.
- Guide · Charities
Volunteer expenses policy: what to pay, mileage rates and records
What a charity can reimburse volunteers, the HMRC approved mileage rates for 2026–27, why flat-rate payments risk employment status, and the claims record.
Work conversations on personal phones
- Guide · Data protection
Is WhatsApp GDPR compliant for work?
The three different things called WhatsApp, the five duties that are hard to meet whichever you mean, whether an employer can require its use, and what metadata Meta receives.
- Guide · Data protection
Subject access requests and WhatsApp messages
What an employer must disclose, what may be withheld or redacted, how tribunals treat them, and what to do when the messages cannot be produced at all.
- Guide · Work messaging
Work messages on personal phones: what the organisation is responsible for, what it can and cannot see, and what the policy has to say
Work messages on staff’s own phones in a school, charity or care service: why the organisation is the controller of what its staff hold there, what the ICO says about personal devices and subject access requests, the limits on looking at a worker’s own phone, what the Cabinet Office’s rules for WhatsApp and private email say a workplace policy should copy, and the record that never reaches the organisation.
- Guide · Work messaging
WhatsApp messages as evidence: tribunals, inspections and regulators, and the organisation that cannot produce them
WhatsApp and text messages as evidence for an organisation in the UK: how a message becomes a document in an employment tribunal, an inspection or a regulator’s inquiry, what the Civil Evidence Act says about copies and business records, the duty to disclose messages that harm your case, screenshots against exports and what authenticity turns on, subject access requests, and the position of the organisation that cannot produce the messages at all.
- Guide · Work messaging
Personal mobile phone policy for staff: what it must cover in a school, a charity or a care service
A personal mobile phone policy for staff in a school, charity or care service: the rules that make one necessary (KCSIE’s staff behaviour policy, the ICO’s guidance on personal devices and on checking workers’ communications, CQC’s records duty), the difference between a pupils’ phone policy and a staff one, the eight things the policy has to cover, what it cannot lawfully do, and the record the policy has to create.
- Guide · Work messaging
Staff messaging policy: what it must say about channels, records, hours and personal phones
A staff messaging policy for a school, charity or care service: the channels that are permitted for which work and the ones that are not, the record every message about a person or a decision has to reach, the Cabinet Office’s rules for WhatsApp, private email and SMS as the published model, hours and expectations, what the organisation may and may not look at under the ICO’s guidance, and the paragraph most policies leave out.
- Guide · Data protection
WhatsApp retention policy: what you can keep and what to write
A retention policy for work messages on WhatsApp: what the app keeps, disappearing messages, backups, leavers' phones, holds, and the rows a UK retention schedule needs.
- Guide · Work messaging
WhatsApp messages in a disciplinary hearing: using them fairly
Using WhatsApp messages in an internal disciplinary under the Acas Code: how they reach the employer, Article 8 and privacy, authenticity, and the employee's own copies.
- Guide · Charities
Volunteer WhatsApp groups: how to run one and when to move on
How a charity should run a volunteer WhatsApp group: consent, admins, group rules, young volunteers, what never goes in it, and the signs it has outgrown the job.
- Guide · Work messaging
Teams chat retention policy: what Microsoft 365 keeps and deletes
How Microsoft Purview retention policies work for Teams chats and channel messages, what they include and exclude, how deletion really runs, and who is outside them.
- Guide · Governance
Acceptable use policy for staff: schools, charities and care
A staff acceptable use policy for IT, devices and messaging in schools, charities and care: what KCSIE 2026 requires, what to cover, personal devices, and enforcement.
- Guide · Work messaging
WhatsApp group admin responsibilities when the group is for work
What a WhatsApp group admin can and cannot do, and what the admin of a staff, volunteer or parent group answers for: data protection, safeguarding, records.
- Guide · Work messaging
Right to disconnect policy: the UK legal position and what to write
The UK has no statutory right to disconnect. What the law does require for messages after work hours, and how to write a voluntary out-of-hours policy.
- Guide · Data protection
WhatsApp Advanced Chat Privacy: what it blocks in a work group
What WhatsApp’s Advanced Chat Privacy and its replacement, Restricted chat, block and allow, and what that means for a work group’s requests and evidence.
- Guide · Data protection
Bring your own device policy: security and UK GDPR for work data
A BYOD policy for staff using their own phones, tablets and laptops for work data: the ICO’s view, NCSC controls, Cyber Essentials scope, privacy and leavers.
Safeguarding and raising concerns
- Guide · Safeguarding
Safeguarding training records: what schools, charities and care providers must keep, and what an inspector asks to see
Safeguarding training records for schools, charities and adult social care in England: who has to be trained and how often under KCSIE 2026, the Charity Commission’s guidance and CQC Regulation 18, what a training record has to show, what Ofsted and CQC actually ask for, how long to keep it, and the update that is delivered as a message and never reaches the file.
- Guide · Governance
Whistleblowing policy: what it must include
Which disclosures the Public Interest Disclosure Act protects, who is covered, what detriment means, and the confidentiality you cannot honestly promise.
- Guide · Charities
Complaints procedure for a charity: what it must contain, what to record, and when a complaint is a serious incident
A charity complaints procedure in England and Wales: which rules actually require one (the Code of Fundraising Practice, CQC Regulation 16 for a charity that provides care, the independent school standards for a charity that runs a school), what the procedure has to contain, the written record of every complaint and the action taken, the timescales and escalation routes to the Fundraising Regulator and the Charity Commission, when a complaint must be reported as a serious incident, and the complaint that arrives as a message.
- Guide · Safeguarding
Making a MASH referral: what to record before, during and after
A concern followed from the first note to the outcome: thresholds, consent and the new information sharing duty, the one-working-day and 45-day timescales, and the record at each stage.
- Guide · Safeguarding
Channel panel: what happens after a Prevent referral
Notice, Check, Share, the police gateway assessment, the monthly local authority panel, consent, closure and the six- and twelve-month reviews, and the record the referrer should hold at each stage.
- Guide · Safeguarding
Safeguarding concern form: what to record and where it goes next
What a safeguarding concern form should record for a child or an adult at risk, how to write it, what the council's adult form asks, and where it goes next.
- Guide · Safeguarding
Information sharing between agencies: the duty, tests and record
How safeguarding information is shared between agencies under the section 16LA duty from 30 September 2026 and Working Together 2026, and what to record.
- Guide · Safeguarding
Church safeguarding records: what to record, pass on and keep
What a church must record when a safeguarding concern arises, who it goes to in each denomination, where the file lives and how long it is kept.
- Guide · Safeguarding
Sports club safeguarding policy: what it must say, who signs it
What a sports club safeguarding policy must contain under the NSPCC Sport standards and Working Together 2026, the procedures behind it and the welfare officer's role.
- Guide · Charities
Lone working policy: what the law requires and what it should say
A lone working policy for charities and care services: the HSE duty, the risk assessment, restrictions, check-ins and escalation, and the record that shows they work.
- Guide · Charity governance
Safeguarding policy for a small charity
What the Charity Commission expects of a small charity’s safeguarding policy, with reporting routes, trustee oversight and practical records.
- Guide · Charities and community groups
Youth club safeguarding records
Safeguarding records for youth and sports clubs: concerns, referrals, recruitment, access and retention, with official and specialist guidance.
- Guide · Safeguarding records
Safeguarding chronology
What belongs in a safeguarding chronology, how to record significant events, who maintains it and how it supports assessment and file transfer.
- Guide · Safeguarding records
Contemporaneous notes: what they are and how to write one
What a contemporaneous note is, why courts, tribunals and regulators give it weight, and how to write one: date, time, exact words, facts, no later edits.
- Guide · Safeguarding
Types of abuse in safeguarding: the statutory definitions
The types of abuse as England's statutory guidance defines them for children and adults, the difference between signs and proof, what to record and who to tell.
- Guide · Charity governance
Safeguarding trustee: the lead trustee's role and the board's record
What a lead safeguarding trustee does, how the role differs from the safeguarding lead, what the Charity Commission expects of the board and what to minute.
Records and data protection
- Guide · Data protection
Data retention policy: UK requirements and how to write one
What UK GDPR storage limitation actually requires, how to build a retention schedule, where the seven-year rule really comes from, and how deletion is proved.
- Guide · Charities
Volunteer records: what a small charity needs to keep
A practical register checklist for recruitment, induction, training, restricted records and the steps to take when a volunteer leaves.
- Guide · Data protection
DBS record keeping: what to keep, for how long, and what never to copy
What the DBS code of practice lets you record, the single central record's checklist, the six-month rule for copies and the places a certificate must never appear.
- Guide · Charities
Charity record keeping: what the law requires
What the Charities Act asks of accounting records, the six year rule and its exceptions, what goes in the trustees' annual report, and when an audit is required.
- Guide · Data protection
Subject access request policy: how to respond, and the exemptions
What a subject access request policy should say, how to respond on time, the exemptions, and the 2025 Act changes to searches and the clock.
- Guide · Data protection
Right to erasure under UK GDPR: when it applies, how to respond
The right to erasure under UK GDPR Article 17: the grounds, the exceptions for legal obligations, safeguarding and care records, and the one-month clock.
- Guide · Data protection
How long to keep employee records in the UK: statutory periods
How long UK employers must keep employee records: PAYE, minimum wage, holiday, right to work, pensions and accidents, with safeguarding periods for schools and care.
- Guide · Data protection
GDPR policy for a small charity: what to include and the DPO test
What a small charity's GDPR policy must cover, the ICO fee, complaints and breaches, and when a charity has to appoint a data protection officer.
- Guide · Work messaging
Message archiving for compliance in schools, charities and care
Why organisations archive work messages – access requests, FOI, safeguarding, disputes – capture after the fact or at source, and Microsoft 365 retention.
- Guide · Data protection
Confidentiality policy: what to include and when to share
What a confidentiality policy must cover for a care provider or charity: the common law duty, UK GDPR, Caldicott, and when confidentiality can be broken.
- Guide · Data protection
Data breach log: what to record for every breach, reported or not
The breach log UK GDPR Article 33(5) requires for every personal data breach: the ICO’s template fields, near misses, charity and care reporting, and retention.
- Guide · Data protection
Charity privacy notice template: donors, volunteers, beneficiaries
What a charity privacy notice must say under UK GDPR Articles 13 and 14, with a template outline for donors, volunteers and the people the charity supports.
- Guide · Data protection
Record of processing activities: what Article 30 requires you to keep
What a record of processing activities must contain under Article 30 UK GDPR, who must keep one, the fewer-than-250-employees exception and how to build it.
- Guide · Data protection
Data protection training for staff: what to cover and what to record
Data protection training for staff in schools, charities and care: what UK GDPR and the ICO expect, who needs it, how often, and the training record to keep.
Choosing a tool
- Guide · Choosing
Messaging app with an audit trail: what to look for
What an audit trail means in messaging, why end-to-end encrypted consumer apps cannot provide one, the questions to ask a supplier, and where the record should live.
- Guide · Choosing
Choosing a work messaging app
What Slack, Teams and Google Chat actually differ on, what happens when the people you need have no work account, and what a free plan does to your message history.
- Guide · Choosing
An internal communication app for a small charity: what to decide before you choose one
Six questions to settle before comparing products, the options that fit volunteers on their own phones, personal-device security and what free plans keep.
- Guide · Choosing
A GDPR compliant messaging app: what "compliant" has to mean for a UK organisation
No app is compliant on its own: the Article 28 contract, encryption and what it does not do, restricted transfers, the Article 30 record, subject access, retention and the 72 hour breach clock, and the questions to put to any vendor.
- Guide · Work messaging
Encrypted messaging for business in the UK: what it leaves open
What end-to-end encryption protects, what it leaves open, what the NCSC asks of a work messaging app, and the trade-off with keeping and producing a record.
Guides for other organisations
Why we write these
We sell a channel your organisation owns, on the record from the first message, filing into your own Microsoft 365. That is a narrow product, and it only makes sense against a duty you already carry. So we write the duties up honestly, cite the regulator rather than ourselves, and say plainly where our product is not the answer.
Every guide is a summary and none of them is legal advice. Where a decision turns on the detail, take proper advice.
How it works · Why us · Pricing · FAQ · Open a channel yourself