Cyber Essentials and data protection for small charities

Why charities are a target

The government's Cyber Security Breaches Survey 2025/26 found that 28% of charities had a cyber breach or attack in the past year. Most attacks on small charities aren't sophisticated. They're stolen passwords, fake emails asking for payments, and shared accounts nobody controls.

The four things that matter most

• One login per person. Volunteers and trustees should each have their own account, with two-step verification. Shared logins make it impossible to remove someone's access when they leave.
• Remove leavers straight away. Volunteers come and go. Closing accounts on their last day is one of the simplest protections there is.
• Keep donor records in one secure system. Donor details and Gift Aid declarations scattered across spreadsheets and personal inboxes are hard to protect and hard to delete on time.
• Check payment requests by phone. Fake emails pretending to be a trustee or supplier are a common way charities lose money.

Reporting serious incidents

The Charity Commission expects trustees to report serious incidents promptly. Its examples include financial crimes such as fraud and cyber crime, and significant data breaches or losses. Trustees decide whether an incident is serious enough to report, and should record their reasons either way. In Scotland, charities report to OSCR, and in Northern Ireland to the Charity Commission for Northern Ireland.

A personal data breach may also need reporting to the ICO within 72 hours. Our free "Think you've been hacked?" tool helps you decide.

Data protection basics

Most charities that process personal data need to pay the ICO data protection fee, and charities pay the lowest tier. You also need a privacy notice for donors and beneficiaries, consent before sending fundraising emails, and a plan for deleting records you no longer need.

Common questions

Do charities need Cyber Essentials?
It isn't a legal requirement, but funders, councils and public bodies increasingly ask for it, especially when a charity handles personal data on their behalf.

Should a charity report a cyber attack to the Charity Commission?
If it's serious, yes. The Charity Commission lists cyber crime and significant data breaches among the incidents trustees should consider reporting promptly.

Can volunteers use their own phones?
Yes, but the devices are then in scope for Cyber Essentials. They need a screen lock, up-to-date software, and two-step verification on charity accounts.