Cyber Security Duties of Charity Trustees

Charity trustees in England and Wales are responsible for protecting their charity from cyber crime, even when an IT team or provider does the work. The Charity Commission says so in its guidance, and it expects trustees to report serious incidents, including significant data breaches.

This guide sets out what the Commission expects and when an incident has to be reported. It's a summary of published guidance, not legal advice.

What the Charity Commission says

The Commission's guidance, Protect your charity from cyber crime, was published on 27 November 2024 and applies to England and Wales. It says managing your charity's resources responsibly includes taking reasonable steps against cyber crime and responding properly when an attack happens.

You can delegate cyber security to someone else, such as an IT team. The guidance adds that "all the trustees remain responsible for making sure your charity is protected".

It asks trustees to decide what they expect on preventing cyber crime and to check those expectations are met. Its examples are the steps people take when a phishing email arrives and the cyber security training everyone at the charity completes.

The guidance also recommends a written plan for responding to a cyber attack. The plan should say who reports the attack and who needs to be told, such as the chair.

It tells you to act quickly and keep a record of what happened and when. If an attack harms the charity, the Commission expects you to check how it happened so you can stop it happening again.

How CC3 applies to cyber security

CC3, The Essential Trustee, sets out six main duties for trustees. Two of them apply directly to IT: manage your charity's resources responsibly, and act with reasonable care and skill.

Under the first, CC3 says you have "a duty to avoid exposing your charity to undue risk". It also names data protection among the laws that apply to every charity.

Under the second, you must take advice when necessary. CC3 lets trustees delegate, but says they "cannot delegate their overall responsibility".

CC3 uses "must" for a legal or regulatory requirement and "should" for good practice the Commission expects trustees to follow.

Reporting a cyber attack to the Charity Commission

A serious incident is an adverse event, actual or alleged, that results in or risks significant harm to people, loss of money or assets, damage to property, or harm to the charity's work or reputation. The Commission's guidance lists significant data breaches or losses among the incidents to report.

Responsibility for reporting "rests with the charity's trustees", even if someone else fills in the form. The Commission's examples table lists these as serious incidents to report:

Charity data accessed and deleted by an unknown person, including the charity's email account and donor names and addresses.
A stolen charity laptop holding personal details of beneficiaries or staff, with no encryption or other protection.
A data protection breach that has been reported to the ICO.
Charity funds lost to an online or telephone phishing scam.

The table also lists incidents you don't need to report. Attempted cyber crimes blocked by your security systems are excluded unless they're unusual, as is a missing laptop or phone with no confidential data that's been reported to the police.

Report promptly, using the Commission's online form, even if you've already told the police or another regulator. If trustees don't report a serious incident and it later comes to light, the Commission may treat that as mismanagement.

If your charity's income is over £25,000, the annual return asks you to declare there were no serious incidents in the previous financial year that should have been reported. You can't make that declaration until every serious incident has been reported.

Reporting to Report Fraud and the ICO

The Commission says to report every cyber attack to Report Fraud (opens in a new tab), even if it did no harm. If you're under a live cyber attack, the Report Fraud helpline is open 24/7 on 0300 123 2040.

If personal data is involved, UK GDPR may also require a report to the ICO. The ICO says you must report a notifiable breach "without undue delay, but not later than 72 hours after becoming aware of it".

You don't need to report if you can show the breach is unlikely to result in a risk to people's rights and freedoms. If the risk to people is high, you must also tell them directly and without undue delay.

A breach doesn't have to mean data was stolen. The ICO's definition covers data that's lost or altered, and data made unavailable where that has a significant negative effect on people.

The ICO says you should record every breach, whether or not you report it. If your IT provider processes personal data for you and suffers a breach, it must tell you without undue delay.

NCSC resources for trustees

For medium and large charities, the Commission points to the NCSC's Cyber Security Toolkit for Boards (opens in a new tab). It helps trustees discuss cyber risk and plan how the charity responds to an attack.

The toolkit is organised around the government's Cyber Governance Code of Practice and its five principles, from risk management to assurance and oversight. It includes a download of questions for the board to ask about cyber security, with possible answers.

For small charities, the Commission points to the NCSC's free Cyber Action Toolkit (opens in a new tab) and its free online training for beginners. The Commission says the training takes less than 30 minutes.

The NCSC's older Cyber Security: Small Charity Guide is no longer on its website. Its current advice for small organisations is the Small organisations guide to cyber security (opens in a new tab), published in April 2026.

That guide covers securing email and online accounts, protecting devices, backing up data and spotting cyber attacks. Its tips are written for people who aren't technical experts.

The Commission also suggests medium and large charities certify through Cyber Essentials. As an IASME Cyber Essentials and Cyber Essentials Plus Certification Body, we certify charities directly.

What to ask your IT provider

Put these questions to your IT provider or in-house IT lead, and ask for written answers. They follow the Commission's and the ICO's expectations above.

If we were attacked tonight, who do you contact first, and who at the charity do you tell?
Is our data backed up somewhere an attacker on our network can't reach, and when did you last test a restore?
Which accounts have multi-factor authentication, and which don't?
Are the laptops and phones that hold personal data encrypted?
If you have a breach involving our data, how quickly will you tell us?
Who keeps our breach and near-miss record, and can the board see it?
Do we meet the Cyber Essentials controls today, and what does it take to certify?

Vague answers are a risk in their own right. Record them on the risk register with an owner and a review date.

We're a Norwich-based managed IT provider, supporting charities remotely across the UK and on site in Norfolk, Suffolk and Cambridgeshire. Our professional services team writes costed IT roadmaps and trustee reports, and our IT support for charities covers the day-to-day.

A checklist for your next trustee meeting

Name the trustee who leads on cyber security, and the person who reports to them.
Check the charity has a written cyber attack response plan that says who reports to Report Fraud and who tells the chair.
Agree who decides whether an incident goes to the Charity Commission, and who reports personal data breaches to the ICO within 72 hours.
Ask to see the breach record, including incidents that weren't reported.
Set the cyber security training everyone at the charity completes, starting with the NCSC's free course.
Put the IT provider questions above on the agenda and minute the answers.
Add cyber risk to the risk register and review it at least once a year.
Check the serious incident declaration in your last annual return was accurate.

Scotland and Northern Ireland

This guide covers charities regulated by the Charity Commission for England and Wales. In Scotland, OSCR stopped its notifiable events process on 1 April 2024 and now asks trustees to raise a concern only about serious issues they can't resolve themselves.

In Northern Ireland, the Charity Commission for Northern Ireland says trustees must report serious incidents to it. It has urged charities affected by a supplier's cyber security incident to consider making a serious incident report.

Sources

Common questions

Are charity trustees responsible for cyber security?

Yes. The Charity Commission says trustees can delegate cyber security to staff or an IT team, but all the trustees remain responsible for making sure the charity is protected.

Do I have to report a cyber attack to the Charity Commission?

Yes, if it's a serious incident, such as a significant data breach or money lost to a phishing scam. Attempted attacks blocked by your security systems don't need reporting unless they're unusual.

How long does a charity have to report a data breach to the ICO?

No more than 72 hours after becoming aware of a notifiable breach, and without undue delay. You don't need to report a breach that's unlikely to put people's rights and freedoms at risk.

Where should a charity report a cyber attack?

To Report Fraud, which the Charity Commission says to do for every attack, even one that did no harm. You may also need to report it to the Charity Commission and the ICO.

What is the NCSC Board Toolkit?

It's the NCSC's free Cyber Security Toolkit for Boards, built around the Cyber Governance Code of Practice. The Charity Commission points trustees of medium and large charities to it.

IT support for charities

Charity trustees and cyber security: what you're responsible for