The eight technology challenges we see most in Scottish charities are: tight budgets, unused or outdated charity licensing, sensitive beneficiary and donor data, rising cyber attacks, high turnover of staff and volunteers, trustee and funder scrutiny, ageing phone lines before the 2027 switch-off, and uncertainty about AI. Most share one cause: technology added piece by piece as funding allowed, without a plan.
1. Tight budgets
Every pound spent on IT is a pound not spent on services. Squeezed finances are a sector-wide problem: 44% of Scottish charities spent more than their income in 2025 (SCVO, 2026). Core costs such as IT are also hard to fund through project grants.
Best practice: know exactly what you spend on technology and what each contract delivers, then cut waste before cutting protection. See Chapter 2.
2. Charity licensing that's out of date
Microsoft ended its free Business Premium grant for nonprofits on 1 July 2025. Charities that relied on it now pay a discounted price or have moved to the free Business Basic plan, sometimes without realising Business Basic has no desktop Office apps. Others never registered for nonprofit pricing at all.
Best practice: check eligibility, then match each person to the right licence.
3. Sensitive data
Charities hold safeguarding records, health and support notes, case files, donor details and bank information. Much of it is special category data under UK GDPR (the most sensitive kind, such as health information), and a breach can harm the people you exist to help.
Best practice: know where sensitive data lives, who can see it, and how it's backed up.
4. Cyber attacks
28% of UK charities reported a breach or attack in the last 12 months, and phishing was involved in almost all cyber crime against charities (DSIT, Cyber Security Breaches Survey 2025/2026). Only 38% use two-factor authentication.
Best practice: multi-factor authentication for everyone, email filtering and staff awareness training. See Chapter 3.
5. Staff and volunteers who come and go
Sessional staff, placements and volunteers join and leave often, work from home and in the community, and use their own phones. Accounts that are never switched off are one of the most common security gaps we find.
Best practice: a simple starters-and-leavers process, with access limited to what each role needs. See Chapter 6.
6. Trustee and funder scrutiny
Boards, funders and commissioners increasingly ask how data is protected. Yet only 30% of UK charities have a trustee with explicit responsibility for cyber security (DSIT, 2026).
Best practice: a named trustee lead and a short, regular IT and security report to the board.
7. Phone lines and helplines before the switch-off
Openreach closes the analogue phone network on 31 January 2027. Helplines, alarm and telecare lines, lift phones and door entry on old lines all need to move.
Best practice: audit every line now. See Chapter 5.
8. AI: opportunity or risk?
79% of charities now use AI, and 56% say a lack of skills is their biggest barrier (Charity Digital Skills Report 2026). The questions we hear most are whether Copilot is worth it and whether it's safe with beneficiary data.
Best practice: start with low-risk admin tasks and write a short AI use policy first. See Chapter 4.
What these challenges have in common
These challenges look different, but they usually share one cause: systems were bought one at a time, often tied to a specific grant, and nothing joins them up. The charities that cope best don't necessarily spend more. They know what they have, use the discounts they're entitled to and plan ahead.
How Indigo does this. At Erskine, Scotland's leading veterans care charity, the problem wasn't a lack of technology. It was too many contracts, with some suppliers raising prices by up to 1,200%, and no single view of the estate. Indigo Unified Communications reviewed everything, moved Erskine onto Microsoft charity pricing, removed unused mobiles and prepared lines for the PSTN switch-off. Read the Erskine case study →
Sources: DSIT, Cyber Security Breaches Survey 2025/2026, 30 April 2026 (https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) · Zoe Amar Digital and Think Social Tech, Charity Digital Skills Report 2026, July 2026 (https://charitydigitalskills.co.uk/) · SCVO, State of the Sector 2026: Scottish voluntary sector key trends, September 2026 (https://scvo.scot/research/reports/state-of-the-sector-2026-scottish-voluntary-sector-key-trends).
Chapter 1 of 8 · All chapters
Get a free technology assessment
One of our consultants will review your IT, security, connectivity and phones, then give you practical recommendations. No obligation.