How should charities protect themselves from cyber attacks and data breaches?

How big is the risk for charities?

The UK Government's Cyber Security Breaches Survey 2025/2026 (DSIT, April 2026) found:

• 28% of UK charities reported a breach or attack in the last 12 months, around 57,000 charities
• 14% were victims of cyber crime, and 95% of that crime involved phishing
• Only 38% use two-factor authentication
• Only 19% have a formal incident response plan
• Only 30% have a trustee with explicit responsibility for cyber security
• Only 17% ran any staff awareness activity in the year
• Only 16% are aware of Cyber Essentials

Charities also rely on third-party systems. In August 2026 SCVO published guidance for Scottish charities after a cyber incident at a CRM (supporter database) supplier used by many UK charities, where copies of customer database backups were accessed. Your suppliers' security is part of your risk.

What do trustees in Scotland need to know?

Trustees are responsible. OSCR has said it's the responsibility of every trustee in Scotland to act in their organisation's best interests, and that this must include cyber security (OSCR, November 2025). In practice that means:

• A named trustee or board lead for cyber and data protection
• Cyber risk on the risk register, reviewed at least yearly
• A short report to the board on incidents, training and progress
• A written incident response plan the board has seen

OSCR replaced its "notifiable events" process on 1 April 2024. Trustees are expected to deal with serious incidents themselves and use OSCR's "raise a concern" route where issues can't be resolved. Check OSCR's current guidance when an incident happens.

What does UK GDPR require?

If a personal data breach is likely to put people's rights and freedoms at risk, you must report it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it. The ICO has an online self-assessment tool to help you decide. Beneficiary health, support and safeguarding records are often special category data, so they need tighter access controls.

From 5 February 2026, under the Data (Use and Access) Act 2025, charities can use a "charitable purposes soft opt-in" to send marketing emails and texts to people who have supported or shown interest in their cause, if strict conditions are met (ICO, April 2026). Check the ICO guidance before relying on it.

Is Cyber Essentials worth it for a charity?

For most charities, yes. It covers five controls (firewalls, secure configuration, user access control, malware protection and software updates) that block the most common attacks. It's required for some central government contracts and increasingly asked for by councils and funders. The NCSC's free Cyber Action Toolkit and guidance for small organisations are a good place to start.

The layers every charity needs

• Identity: multi-factor authentication for every staff member, volunteer and trustee account
• Email: filtering against phishing, impersonation and fake invoices, and a rule that bank detail changes are confirmed by phone
• Devices: encrypted, updated and centrally managed, with remote wipe
• Data: permissions on sensitive folders and separate backups of Microsoft 365
• Monitoring: someone watching for unusual activity, ideally around the clock
• People: short, regular training for staff and volunteers

What to do if something goes wrong

Follow your incident plan. Contain the problem, tell your IT provider, inform trustees, assess whether to report to the ICO within 72 hours, and report crime to Police Scotland on 101. Scotland's Cyber Incident Response Helpline, run by the Cyber and Fraud Centre – Scotland, is 0800 1670 623 (weekdays, 9am to 5pm).

How Indigo does this. Indigo Unified Communications holds Cyber Essentials Plus and ISO 27001:2022 itself. Our Charity package includes Kaseya 365 endpoint protection, INKY email security, multi-factor authentication, Microsoft 365 backup with Datto SaaS Protection, security awareness training and a 24/7 security operations centre. We take charities through Cyber Essentials, usually starting with multi-factor authentication, device management and access reviews. Cyber security services →