Cyber security for charities

The rule: trustees' duties and UK GDPR, not a cyber statute

No cyber security statute applies to charities as such: in England and Wales the duty comes from the trustees' general duties, which the Charity Commission applies to cyber crime in its guidance, and from the security principle of the UK GDPR. The Commission's guidance Protect your charity from cyber crime says: “You and your fellow trustees must manage your charity's resources responsibly by, for example: being aware of the risks to your charity from cyber crime; taking reasonable steps to protect your charity from cyber crime; responding to cyber attacks properly to reduce the harm to your charity.”

Those examples rest on two duties in the Commission's The essential trustee (CC3). Under 2.4, the duty of prudence, trustees must “avoid exposing the charity's assets, beneficiaries or reputation to undue risk”, and should “put appropriate procedures and safeguards in place and take reasonable steps to ensure that these are followed”. Under 2.5 they “must use reasonable care and skill, making use of your skills and experience and taking appropriate advice when necessary”. CC3 does not mention cyber; the cyber crime guidance is where the Commission makes the link.

The duty cannot be delegated away. The cyber crime guidance says: “You may be able to delegate cyber security to someone else at your charity, such as an IT team. But all the trustees remain responsible for making sure your charity is protected.” It also says trustees “should decide what your expectations are on preventing cyber crime and make sure these are met”, and that those expectations “will depend on the size of your charity and the resources it has”.

The second source of the duty is data protection law. A charity holding personal data about donors, volunteers, staff or the people it supports, often including sensitive information about their health or circumstances, must process it, under UK GDPR Article 5(1)(f), “in a manner that ensures appropriate security of the personal data”. UK GDPR Article 32 turns that into “appropriate technical and organisational measures to ensure a level of security appropriate to the risk”, including, as appropriate:

• “the pseudonymisation and encryption of personal data”;
• “the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services”;
• “the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident”;
• “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures”.

The regulator for that side is now the Information Commission. The office of Information Commissioner was abolished on 30 September 2026 under section 118 of the Data (Use and Access) Act 2025, and section 119 passed its functions to the Information Commission, still known as the ICO. Where this guide says “the Commission” on its own, it means the Charity Commission.

What a cyber attack on a charity looks like

Around three in ten UK charities (28%) reported a cyber security breach or attack in the previous 12 months, about 57,000 charities, according to the government's Cyber Security Breaches Survey 2025/2026, which surveyed 1,085 registered charities between August and December 2025. The rate rises with income: 22% of charities with income under £100,000, 39% of medium-income charities and 57% of charities with income of £500,000 or more. The survey estimates that 14% of charities were victims of at least one cyber crime.

Phishing is the attack that matters most. The survey found phishing “remained the most prevalent type of breach or attack by far”, experienced by 25% of charities, and for 57% of the charities that had a breach or attack, phishing was the only kind they saw. The Charity Commission's guidance says the same in one line: “Phishing is the most common type of cyber attack.” In practice that is an email or text that looks as though it comes from the bank, a supplier, the chief executive or a sign-in page, asking someone to click, log in, open an attachment or change bank details, so that the attacker can gain access to an account or move money.

Attention to cyber threats is falling, and fastest among the smallest charities. Cyber security was a high priority for senior management in 60% of charities in 2025/2026, down from 68% the year before, and the fall was driven by charities with income under £100,000, where it dropped from 64% to 53%.

A charity can also be hit through a supplier. In August 2026 a cyber security incident at a CRM platform used by many charities led the Charity Commission to publish guidance for charities affected by the supplier's incident: “A number of affected charities have submitted serious incident reports to the Commission and we encourage trustees to continue to follow our guidance on serious incident reporting.” It added that trustees “should consider their reporting obligations to other regulators, notably the ICO, and to individuals whose data is stored on” the supplier's systems. The Charity Commission for Northern Ireland likewise advised affected charities there to consider their legal duties to report the incident to it and to the ICO.

The legal position in a supplier incident is set by UK GDPR Article 33. A supplier processing data for the charity “shall notify the controller without undue delay after becoming aware of a personal data breach” (Article 33(2)); the charity, as controller, still decides whether to notify the ICO and the people affected, and its 72 hours run from when it becomes aware.

The baseline that stops most attacks

The National Cyber Security Centre's cyber security advice for small to medium sized organisations, offered “to help UK businesses, charities, clubs and schools build their cyber resilience”, sets out three steps: start with the free Cyber Action Toolkit; use free NCSC tools and services such as Check your cyber security to find common weaknesses; then achieve Cyber Essentials. The address of the NCSC's old Small Charity Guide now leads to this page, and the Charity Commission points small charities to the same toolkit and to the NCSC's free online training for beginners, which “takes less than 30 minutes to complete”.

The technical baseline is the five controls of Cyber Essentials, set out in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). Even a charity that never certifies can use them as its checklist:

1. Firewalls, protecting every device that connects to the internet.
2. Secure configuration of the charity's computers, phones and cloud services.
3. Security update management: updates that fix vulnerabilities the vendor rates “critical” or “high risk”, or with a CVSS v3 score of 7 or above, or with no rating given, applied within 14 days of release. The NCSC “strongly recommend[s] (but it's not mandatory)” applying all updates within 14 days.
4. User access control: multi-factor authentication (MFA) where available – “authentication to cloud services must always use MFA” – and accounts removed or disabled “when they're no longer required (for example, when a user leaves the organisation …)”.
5. Malware protection on the devices in scope.

Two points in v3.3 matter for charities in particular. Cloud services such as email, file storage and the CRM cannot be left out of scope, and every sign-in to them needs MFA; the NCSC notes that “SMS is not the most secure type of MFA but still offers a huge advantage over not using any MFA at all.” And volunteers' and trustees' own phones and laptops are in scope if they access the charity's data or services; the only exception is a device used solely for its built-in calling and texting or for an MFA app. The bring your own device policy guide covers how to set that out.

Backups are not a Cyber Essentials requirement – v3.3 says “Backing up your data is not a technical requirement of Cyber Essentials” but highly recommends one – yet they are where Article 32's “ability to restore the availability and access to personal data” comes from. The Commission's Charities and risk management (CC26) lists “computer system failures or loss of data” among the risks to plan for, with the responses “agree IT recovery plan” and “implement data back up procedures and security measures”. Keep at least one backup that an attacker who gets into the main systems cannot reach, and test that it restores.

People are the last control. Only 17% of charities ran any staff training or awareness activity in 2025/2026, down from 21%, and 38% used two-factor authentication. A short session on spotting phishing, a unique password for every account, a rule that any change to bank details is confirmed by phone on a known number, and MFA switched on everywhere cost very little against the survey's most common attack.

Cyber Essentials for charities: cost, contracts and limits

Cyber Essentials is, in the words of the NCSC's Cyber Essentials overview, “the minimum standard of cyber security recommended by the Government for organisations of all sizes”. It is a certification scheme run for the NCSC by its delivery partner IASME, with two levels:

• Cyber Essentials: a verified self-assessment. The charity registers with IASME, pays and completes the questionnaire itself, or hires a certification body licensed by IASME to help; the answers are “signed-off by a board member or equivalent and then marked by an assessor”. The cost is “priced according to the size of your organisation, starting at £320 +VAT”.
• Cyber Essentials Plus: “The same protections, but with more rigorous, independent technical testing”, priced according to the size and complexity of the network.

Two practical points follow. The NCSC's overview says “Any UK organisation with a turnover under £20m, that achieves certification covering their whole organisation, is automatically entitled to Cyber Liability Insurance arranged by” IASME, so certifying only part of the charity loses that. And where a government contract requires certification, PPN 014 says it “must be renewed annually by the supplier for the duration of the contract”.

No law requires a charity to hold Cyber Essentials. The Charity Commission suggests it for medium and large charities, alongside the NCSC's 10 Steps and Cyber Security Toolkit for Boards. It becomes a requirement when a contract, a funder or an insurer makes it one. The Cabinet Office's PPN 014: Cyber essentials scheme applies to “all central government departments, their executive agencies and non-departmental public bodies, and NHS bodies”. They “must ensure that all suppliers demonstrate that they meet certain technical requirements” for contracts with certain characteristics, including “where personal information of citizens, such as home addresses, bank details, or payment information is handled by a supplier”. The PPN calls Cyber Essentials or Cyber Essentials Plus “the quickest and most effective means” of meeting those requirements, and a supplier without it “must be able to demonstrate equivalent controls are in place through other means”. Where certification is required, “it must be renewed annually by the supplier for the duration of the contract”.

The PPN also limits itself. “In-scope organisations must not take a blanket approach”, and it is “important not to over- burden suppliers or deter Small and Medium-Sized Enterprises (SMEs) and Voluntary, Community and Social Enterprises (VCSEs) from bidding for public contracts”. Councils are not bound by it: “Other public sector bodies may wish to apply the approach set out in this PPN.” A charity asked for Cyber Essentials by a council, a housing association or a funder can ask whether the work involves the kind of data that justifies it, and whether equivalent controls would be accepted.

What a certificate does not prove matters as much. PPN 014 says: “The Cyber Essentials Scheme does not negate risk and it is not designed to address more advanced, targeted attacks.” The ICO's A guide to data security calls Cyber Essentials “a good starting point” for the UK GDPR security duty, but “only intended to provide a ‘base’ set of controls”; that guide carries a notice that it is under review following the Data (Use and Access) Act. A basic certificate shows that the charity's signed-off answers met the five controls when it was assessed, and Plus adds testing that they work in practice; neither makes a charity compliant with the UK GDPR or immune to phishing.

Few charities have one. In the 2025/2026 survey, 3% of charities said they adhered to Cyber Essentials and 1% to Cyber Essentials Plus, 13% reported controls in all five areas, and 16% were aware of the scheme at all (40% of charities with income of £500,000 or more).

The trustees' part: risk, the response plan and reporting

The board's job is governance, not configuration. Board-level responsibility for cyber security sat with 30% of charities in the 2025/2026 survey; 27% had done a cyber risk assessment and 19% had a formal incident response plan. Those are the three gaps a board can close itself.

1. Decide expectations, roles and responsibilities. Record in the minutes what the charity expects – MFA on every account, leavers removed the day they leave, backups tested – and which trustee and which member of staff are responsible. The risk register guide covers how to add a cyber row with its likelihood, controls and owner.
2. Use the Cyber Governance Code in proportion. The government's Cyber Governance Code of Practice sets out board actions under five principles: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight. It “has been designed for medium and large organisations”, but small organisations “should seek to implement the Code's principles”. Its incident actions ask boards to “Gain assurance that the organisation has a plan to respond to and recover from a cyber incident” and that the plan is exercised at least annually.
3. Write the response plan before it is needed. The Commission says “You should plan how your charity will respond to a cyber attack”, in “a policy or cyber attack action plan”, and that “your policy should say who needs to be informed about the attack, such as the chair” and “Set out who has responsibility at your charity” for reporting it.

The plan needs four reporting routes, because they answer different questions:

• Report Fraud, for the crime. The Commission says “you should report all attacks to Report Fraud, even if they did not cause your charity any harm”, and to call the 24/7 helpline on 0300 123 2040 during a live attack. What is Report Fraud? says the service issues a police crime reference number but does not investigate cases itself. It replaced Action Fraud in December 2025.
• The Charity Commission, for a serious incident. Under How to report a serious incident in your charity, “financial crimes – fraud, theft, cyber-crime and money laundering” and “significant data breaches/losses” are reportable categories. “It is the responsibility of the charity trustees to decide whether an incident is significant”, but “An incident that involves actual or alleged criminal activity will usually be reportable”, and “if reporting to the police at Report Fraud … you should also make a serious incident report”. Report promptly. The guidance defines a serious incident as “an adverse event, whether actual or alleged, which results in or risks significant” harm to people, loss of the charity's money or assets, damage to its property, or harm to its work or reputation. A single phishing email that nobody acted on is unlikely to meet that test; an attack that caused or risked significant loss or harm will, and the Commission expects repeated low-value incidents of cyber-crime to be reported too. The serious incident reporting guide covers the categories, the decision and the record.
• The ICO, for a personal data breach. Under Article 33 the charity must notify the ICO “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach “is unlikely to result in a risk to the rights and freedoms of natural persons”. Every breach must be documented, reported or not; the data breach log guide covers the record and the decision.
• The people affected. Under UK GDPR Article 34, where a breach “is likely to result in a high risk to the rights and freedoms of natural persons”, the charity must tell the donors, volunteers or beneficiaries concerned “without undue delay”, unless an exception in Article 34(3) applies – for example, the data was encrypted so that it is unintelligible to anyone not authorised to access it.

Keep a record throughout. The Commission says “you should also keep a record of what happened, and when”, and “If your charity is harmed by a cyber attack, check how it happened.” A charity with income over £25,000 must also sign a declaration in its annual return “confirming there were no serious incidents during the previous financial year that should have been reported to the Commission but were not”, so a decision not to report should be minuted with its reasons. Where an attack involves fraud, the charity fraud policy guide covers the response plan.

The attack that arrives as a message

The most common attack on a charity is a message, and many of a charity's day-to-day messages never touch its email system at all. The rota is in a group on volunteers' own phones. The treasurer is asked by text to approve a payment. A trustee forwards a screenshot of an odd email to the chair on a Sunday evening to ask if it is real. When a volunteer steps back, the charity has no account to switch off: they stay in every group, with every past message, unless someone remembers to remove them, and whoever was removed takes their copy with them.

Those conversations are also the record the reporting routes ask for. The Commission wants to know when the charity became aware of an attack and what it did; if personal data is affected, the ICO's 72 hours run from when it became aware of that breach. If the first warning was a message to the chair's personal phone, the charity may not be able to show when it arrived.

ComplyChat gives a charity's staff, volunteers and trustees channels the charity controls. Each person is identified by a UK mobile number verified with a one-time code sent by SMS, so a volunteer with no work email account can still be added and removed; everyone added is told the channel is on the record, and messages are recorded on the server as they are sent. On paid plans, removing someone from the organisation also signs them out and removes their passkeys. On a paid plan with the charity's Microsoft 365 connected, conversations are kept within its own subscription, under the retention schedules it already runs. It is not antivirus, a firewall, an email filter or a Cyber Essentials tool, and it does nothing for the charity's email, devices or backups. The question for the next trustees' meeting: when a volunteer leaves, which of the charity's conversations leave with them?

Questions people ask

Do charities need Cyber Essentials?

No law requires a charity to hold Cyber Essentials. The NCSC calls it “the minimum standard of cyber security recommended by the Government for organisations of all sizes”, and the Charity Commission suggests it for medium and large charities. It becomes a requirement when a contract, funder or insurer makes it one: under PPN 014, central government departments, their agencies and NHS bodies must make suppliers on higher-risk contracts, such as those handling citizens' home addresses or bank details, demonstrate set technical controls, for which Cyber Essentials is “the quickest and most effective means”, with equivalent controls accepted. Councils and other public bodies may choose to apply the same approach.

How much does Cyber Essentials cost for a charity?

Cyber Essentials is priced by the size of the organisation, starting at £320 + VAT; Cyber Essentials Plus, which adds independent technical testing, is priced by the size and complexity of the network. Where a government contract under PPN 014 requires certification, it must be renewed annually for the life of the contract. A UK organisation with turnover under £20m that certifies its whole organisation is automatically entitled to cyber liability insurance arranged by IASME.

Does a charity have to report a cyber attack?

In England and Wales the Charity Commission says to report all cyber attacks to Report Fraud, “even if they did not cause your charity any harm”, and to make a serious incident report to the Commission when the incident is serious. The trustees decide, but cyber crime and significant data breaches are listed categories, criminal incidents will usually be reportable, and the Commission says that if you report to Report Fraud you should also make a serious incident report. Separately, a personal data breach must be reported to the Information Commission (the ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people; if it is likely to result in a high risk, the people affected must be told too.

Who is responsible for cyber security in a charity?

The trustees are responsible for cyber security in a charity. The Charity Commission says trustees may be able to delegate cyber security to someone else such as an IT team, “But all the trustees remain responsible for making sure your charity is protected.” This sits within the duties in CC3 to manage the charity's resources responsibly and to act with reasonable care and skill.

How common are cyber attacks on charities?

Around three in ten UK charities (28%) reported a cyber security breach or attack in the 12 months before the Cyber Security Breaches Survey 2025/2026, rising to 57% of charities with income of £500,000 or more. Phishing was by far the most common type, experienced by 25% of charities.

Does the Cyber Governance Code of Practice apply to charities?

Not as a legal requirement. The Cyber Governance Code of Practice is non-statutory government guidance “tailor-made for boards and directors of both public-sector and private organisations” and “designed for medium and large organisations”; small organisations “should seek to implement the Code's principles” and use the NCSC's guidance designed for them. The Charity Commission points medium and large charities to it.

Official guidance and your next step

The primary sources are the Charity Commission's Protect your charity from cyber crime and How to report a serious incident in your charity, and the NCSC's advice for small to medium sized organisations and Cyber Essentials overview. Quotations are from those pages and the other sources listed below as published on 21 October 2026.

This guide covers charities in England and Wales and is not legal or technical advice. In Scotland, OSCR replaced its notifiable events process on 1 April 2024 (OSCR: the notifiable events process has been replaced) and now asks charities to use its raise a concern form only where a serious issue cannot be dealt with; cyber crime there is reported to Police Scotland on 101. Report Fraud covers England, Wales and Northern Ireland (Report Fraud service goes live), and charities in Northern Ireland report serious incidents to the Charity Commission for Northern Ireland under its serious incident reporting guidance. The UK GDPR and the NCSC's advice apply across the UK.

Then do one thing: before the next trustees' meeting, list every account the charity relies on – email, cloud storage, the bank, the CRM, the website and social media – with who can sign in to each and whether MFA is on. Any account a former volunteer can still reach, or that has no MFA, is the first item on the agenda.