Do charities have to have a complaints procedure?

England and Wales: This page sets out the position in full. Scotland: the same Code and the same trigger, but the final stage of a fundraising complaint goes to the Scottish Fundraising Adjudication Panel rather than the Fundraising Regulator — see below. Northern Ireland: the same position as England and Wales — the Fundraising Regulator covers Northern Ireland too, so the same Code and the same trigger apply.

Which complaints duties apply to a charity?

You face two separate questions. The first is whether you need a general charity complaints procedure. The second is whether you have a route for data protection complaints.

This page is for trustees in England, Wales and Northern Ireland, where the Fundraising Regulator applies its Code. It is also for trustees in Scotland, which has its own adjudicator. The Charity Commission asks about complaints on the annual return. But it does not require a procedure.

Like the other policy pages in this hub, it assumes you have already mapped your governing document.

“Do we need a complaints procedure” sounds like one question. It is two. They have different answers. A charity that answers the wrong one thinks it is covered when it is not.

The first is about complaints in general. Someone may be unhappy with a service, a decision, a member of staff or a fundraising approach. No general legal duty says you must have a written policy for that.

The second is narrower and newer. Since 19 June 2026 a charity that holds personal data has to offer an accessible route for data protection complaints. Someone can now complain to the charity itself, not only to the regulator.

The charity has to acknowledge that complaint and respond without undue delay. The duty has no conditions. It does not depend on fundraising or on size. Nor does it depend on what the trustees decide about a general policy.

The two are separate. A charity can meet one and not the other. Take a charity with a service-complaints policy but no data protection route. It has not met the second duty, however good the first document is.

Is a general complaints procedure required?

No. The law sets no general duty. And the Commission does not list complaints among the policies it expects.

A complaints procedure is the charity’s written process for receiving, answering and escalating complaints. The Charity Commission’s annual return asks whether each of 13 named policies and procedures was in place at the end of the period. Complaints is one of the questions. That is where the “it must be required, they ask about it” idea comes from.

It does not follow. The Commission’s guidance names 6 policies it says it expects most charities to have.

Complaints is not among them. Being asked a question on a form does not mean you have to answer yes. This guide’s policy table rates a general complaints policy as required-for-fundraising-only. It is not law. Nor is it something the Commission says it expects.

One narrower point, named here because it is real but was not checked.

For charities whose accounts must be audited, the Charities (Protection and Social Investment) Act 2016 adds annual report disclosure about fundraising complaints. That provision was found in the research but not read directly. So this page does not say what it requires. If you are an audited charity that fundraises, treat it as something to check, not something settled here.

Fundraising charities and the Code of Fundraising Practice

If you fundraise, the Code of Fundraising Practice expects a complaints procedure, whether or not you register with the Fundraising Regulator. This is where a real expectation appears. It does not come from a regulator of charities.

Registering with the Regulator is voluntary. No statute compels it, at any size. The decision itself is on register with the Fundraising Regulator and adopt the Code.

The Regulator’s own materials call the scheme voluntary throughout. Charities above its levy threshold are invited to pay, not obliged to. The Commission’s own fundraising guidance for trustees treats registration as a should. It sets this beside six duties it does state as musts. Even there the framing is good practice, not law.

But the Code does not wait for registration. The Regulator applies the Code of Fundraising Practice to fundraising by organisations that have not registered. It will also consider complaints about them. Registering also binds you, by contract, to the same standard.

The Code expects a complaints procedure that is publicised and accessible. That expectation is self-regulatory, not statutory. Once you have signed up, it is contractual as well. It is not law. It is what the Regulator will hold you to.

Two caveats apply to the clause. This guide records the requirement at the clause number used in the previous edition. The Code moved to a new principles-based edition on 1 November 2025. That number has not been re-checked against the new text.

The rule itself is not in doubt. The clause number is. And the Fundraising Regulator cannot fine anyone. Its sanctions are of a different kind.

It can publish findings and name the charity. It can remove the Fundraising Badge and the directory listing. And it can refer the charity to a statutory regulator: the Charity Commission or the Information Commissioner’s Office. Those regulators do have powers. Anything telling you the Regulator levies penalties is wrong.

The data protection complaints route

The data protection complaints route is a separate duty. The annual return never prompts you to check it.

This page exists to close this gap. The gap is structural, not anyone’s mistake.

The annual return asks one general complaints question. It does not ask separately about a data protection complaints route. So a charity ticks yes because it has a service-complaints policy.

Nothing on the form then prompts it to check the narrower duty. And the narrower duty is the one with a statute behind it.

The detail is in Running the organisation — Write your data protection policy. That page covers what the duty requires and how to build the route. This page only tells you that the two questions are different. Answering one does not answer the other.

If you are writing a complaints policy this week, write the data protection route into it. Or write a second short document covering it. Either way, say in the minute which you did.

Scotland: the same Code, a different final adjudicator

A Scottish charity is not working to a separate Scottish standard. There is no Scottish Code of Fundraising Practice. The Code was transferred to the Fundraising Regulator in 2016. The Scottish Fundraising Adjudication Panel judges complaints against that same UK-wide document, not a version of it.

What differs is where a complaint ends up. The Scottish route is three-stage — (1) complain to the charity, (2) complain to the charity's trustees if unsatisfied, (3) escalate to SFAP if still unsatisfied. In England, Wales and Northern Ireland the Fundraising Regulator itself plays the role SFAP plays in Scotland. So the requirement to have the procedure is the same. The address for the last stage is not. A Scottish charity’s published complaints route should name the right one.

Common mistake: reading the annual return tick-box as an expectation that everyone has one

Complaints is one of the annual return’s named policy questions. So it looks like something the Commission expects. It is not one of the policies the Commission’s guidance says it expects most charities to have. Where a binding rule exists, it comes from the fundraising side. It does not come from the charity regulator.

Worked example

Saltmarsh Trust fundraises publicly and is registered with the Fundraising Regulator. Its way of handling complaints is that people email the chair. The trustees say this works well because nobody has ever complained.

Two problems. The Code expects a procedure that is publicised and accessible.

An unwritten practice known to the board is neither. A complainant has nothing to find and nothing to follow. And it covers service and fundraising complaints only. It says nothing about a person who complains about how Saltmarsh handles their personal data. That is the one duty here with a statute behind it.

The fix is one short document. Who receives a complaint. Where it is published.

What happens next, and how long each stage takes. And a named route for data protection complaints in particular. Adopted at a board meeting, minuted, and put on the website.

With complaints covered, the next policy in the sequence is the whistleblowing policy.