Question 1

What cyber security standards does the Charity Commission expect?

Accepted Answer

The Charity Commission expects trustees to manage cyber risk as part of their broader duty to protect charity assets. Specific guidance recommends that charities implement the NCSC's Cyber Essentials controls as a baseline and document how they manage data security. The Commission can investigate charities where a cyber incident results in loss of charitable funds or a serious breach of donor trust.

Question 2

Does our charity need Cyber Essentials certification?

Accepted Answer

Cyber Essentials is not legally mandatory for most charities, but it is increasingly expected by grant funders, major donors and corporate partners as evidence of basic security hygiene. For charities handling sensitive beneficiary data or significant funds, it is the clearest way to demonstrate to the Charity Commission that adequate controls are in place.

Question 3

How do we protect donor data under UK GDPR as a charity?

Accepted Answer

Charities hold a lawful basis for processing donor data — typically legitimate interests or consent — but must still apply appropriate technical and organisational measures to protect it. This includes encrypted storage, access controls limiting who can see donor records, a documented retention policy, and a process for handling subject access requests and data breach notifications within 72 hours.

Question 4

What are trustee responsibilities for IT and cyber governance?

Accepted Answer

Trustees have a collective duty to protect charity assets, which includes digital assets and the data held on behalf of beneficiaries and donors. This means ensuring the charity has adequate cyber controls, that those controls are reviewed regularly, that staff are trained, and that there is a credible incident response plan. Trustees do not need to be technical experts, but they must ensure competent oversight is in place.

Question 5

Can a charity afford managed IT services?

Accepted Answer

Managed IT is typically more cost-effective for smaller charities than attempting to maintain an internal IT capability, particularly when the true cost of staff time spent on IT problems, the risk of an unmanaged incident, and the compliance overhead are factored in. BOOM works with charities to structure services around realistic budgets, and many clients find the switch is cost-neutral within the first year.

Question 6

What happens if a charity suffers a data breach?

Accepted Answer

Where personal data is involved and the breach poses a risk to individuals, the charity must notify the ICO within 72 hours and affected individuals where the risk is high. A serious breach should also be reported to the Charity Commission as a serious incident. Failure to report promptly is itself a regulatory issue, separate from the breach itself.

Question 7

How do we evidence adequate internal controls to the Charity Commission?

Accepted Answer

Documentation is key. The Commission expects charities to be able to show their risk register includes cyber and data risks, that those risks are reviewed by trustees, that controls are in place and monitored, and that staff receive appropriate training. In a serious incident investigation, charities that can produce this documentation are treated very differently from those that cannot.

Question 8

Do we need cyber insurance as a charity?

Accepted Answer

Cyber insurance is not mandatory for charities but is worth serious consideration, particularly for charities handling sensitive beneficiary data, significant donor funds, or running digital services. A policy should be assessed against your actual controls — insurers apply the same technical warranty principles to charities as to commercial organisations, and a claim will be scrutinised against the controls declared at inception.

Your cause deserves more
than good intentions.

Trustee Governance

Donor & Beneficiary Data

Funding & Insurance Continuity

Understand the Compliance Landscape

2025 UK Cyber Attack Review

Cyber Insurance Integrity Audit

Data Resilience & SaaS Liability

Can your trustees evidence
adequate internal controls?

Your cause deserves morethan good intentions.