Is a written safeguarding policy legally required for a charity?

England and Wales: This page sets out the position in full. Scotland: the same answer, reached the same way — OSCR grounds its expectation in the general trustee duties, and there is no safeguarding-specific statute behind it; the one hard legal requirement is PVG scheme membership for people in regulated roles. Northern Ireland: genuinely different — CCNI says you must put appropriate safeguarding arrangements in place, which is a real must, though it attaches to arrangements rather than to one named document.

What is a charity’s safeguarding duty?

Trustees are responsible for protecting the people their charity comes into contact with. That duty binds whether or not a safeguarding policy is legally required. This page covers England and Wales, Scotland and Northern Ireland.

It answers whether the policy is required; what the policy must contain is on write a safeguarding policy. Like the other policy pages in this hub, it assumes you have already mapped your governing document. The duty does not depend on what kind of charity it is. The Charity Commission’s own guidance is explicit. Read it first:

“…trustees must take reasonable steps to protect the people who come into contact with their charity through its work from harm.”

Must is the Commission’s own word, in its own guidance. It disposes of the most common excuse in the sector. The excuse is that safeguarding is somebody else’s issue because the charity does not work with children or vulnerable adults.

The duty reaches everyone who comes into contact with the charity through its work. That includes your own staff and volunteers, not only the people you exist to help.

Safeguarding is also the Commission’s highest-profile enforcement area. A charity that gets this wrong does not usually get a letter about a missing document. It gets an inquiry about what happened to a person.

The duty is not in doubt. Nothing that follows reduces it.

Is a written safeguarding policy required by law?

No: in England and Wales the law requires the safeguarding, not the document.

This is the clearest case of a distinction that runs through this whole part of the guide. Having to do a thing and having to hold a written policy about it are two different duties.

For safeguarding in England and Wales, no provision requires a written policy. Not the Charities Act, not the Commission’s own rules, not the child and adults-at-risk statutes. Those statutes impose real duties on charities working with those groups. They do not impose a duty to hold a named document.

The Commission’s position is that you should have one. That should is not a sentence in the guidance, so it helps to be precise about where it comes from.

The guidance is written as though the policies already exist. It tells you what your charity’s safeguarding policies and procedures should be:

• put into practice
• responsive to change
• reviewed at least once a year and always after a serious incident
• available to the public

The expectation is inferred from that framing. Nowhere does the Commission write “you should have a safeguarding policy”. This page will not put quotation marks round a sentence the guidance does not contain.

Under the Commission’s own must/should convention, an expectation like that is a should. It is good practice the regulator expects and will judge you against. It is not law. Pretending otherwise would make this guide the thing it exists to correct.

Who does require a safeguarding policy?

Four groups, in descending order of how hard the requirement bites.

• Northern Ireland’s regulator. CCNI is the exception across the three nations, as the Northern Ireland section explains. It is a real must.
• Funders. Routinely, and as a condition of the grant rather than as advice. The National Lottery Community Fund requires an appropriate written safeguarding policy where the project works with children or adults at risk. If you apply for funding and work with those groups, you will be asked for the document.
• The Charity Commission, as an expectation. A should, and one it will measure you against if something goes wrong.
• The annual return, as a question. One of its questions covers Which of 13 named policies and procedures were in place at period end, and safeguarding is among them. Answering “no” is not an offence. It is a visible answer on a public form.

One caution about the funder limb, because it is the one most often overstated. There is no single list of the policies funders require.

This project read one large funder’s published terms directly. Those terms are unusually prescriptive. Generalising from them to “funders require X” would overstate how prescriptive funders are as a class. Check the specific funder's own published grant terms and conditions directly — each funder's own site is Tier A for its own requirements. This hub's own policy-content facts (list.policy.legal-status and its Scotland/NI variants) describe what regulators and general good practice expect; funder-specific extras sit on top of that baseline and vary funder to funder.

The annual return’s policy questions

The annual return asks about more policies than the Commission expects most charities to have. This gap causes a lot of needless anxiety. The annual return asks whether each of 13 named policies and procedures was in place at the period end. The Commission separately says it expects most charities to have 6 of them.

Being asked about a policy on a form is not the same as being expected to have it. The full set of questions is on what the annual return asks. Neither is the same as being required by law to hold it. Those are three different things. Sector checklists routinely present all of them as one.

What should a safeguarding policy do?

A useful policy names a lead trustee, sets out what happens to a concern, covers checks and gets reviewed. Since the document is not compelled, the only reason to write one is that it works. The practice pages in the People hub cover each of these properly, starting with write a safeguarding policy. A policy that works does four things:

1. Names a lead trustee, so that responsibility sits with a person rather than with the board in general. Choosing that person is covered in appoint a safeguarding lead.
2. Says what happens when a concern is raised — who must be told, and which of those reports carry a legal deadline. (No source ranks the regulator against the police: the reports run in parallel, not in sequence. Which of them are legal duties is on make the reports.)
3. Sets out the checks for roles that need them, without reproducing the eligibility test. Whether a role is regulated activity is decided by the official eligibility tool, not by a policy document. Working out whether a role is in regulated activity explains how.
4. Gets reviewed — at least annually, and always after a serious incident. That much is the Commission’s own stated expectation, verbatim, about policies that exist.

Two things are better left out. First, in England and Wales, do not reproduce the DBS eligibility test. Send people to the official tool instead, because getting the test wrong is worse than not attempting it. Scotland and Northern Ireland have their own tests, covered in criminal record checks.

Second, do not promise a response time the charity cannot meet.

Scotland and Northern Ireland

Scotland follows England and Wales. Northern Ireland is the one nation where the answer changes.

Scotland. The pattern is the same as in England and Wales. The research establishes this directly, not by assumption. No safeguarding-specific statute requires a written policy. OSCR grounds its expectation in the general trustee duties under the 2005 Act.

OSCR is clear about the limit of its own role too. Its focus is on whether trustees dealt appropriately with a concern. It says in terms that it is not responsible for dealing with incidents of actual abuse. It also says it does not oversee safeguarding legislation.

What OSCR will say is what it expects of a policy that exists:

"OSCR can't advise charities on what specific information to include in a policy, but we would expect, as a minimum, policies are: agreed by the charity trustees; regularly updated; reflect statutory guidance and national and local practice; supported by an implementation plan."

The one hard legal requirement in Scotland is not the document at all. It is PVG scheme membership, covered in run the check in Scotland or Northern Ireland. Membership is a legal requirement for people carrying out a regulated role with children or protected adults. That includes trustees of a charity providing services to those groups.

One practical warning matters if you search for OSCR’s guidance yourself. This project’s research found that OSCR’s pre-2025 safeguarding pages still circulate in search results and caches. Those pages tell trustees to report under a notifiable-events regime that no longer exists. Use the current safeguarding guidance under OSCR’s “managing a charity” section, not whatever a search engine surfaces first.

Northern Ireland. This is the one place in the three nations where the answer to this page’s question changes. CCNI’s own words:

"If your charity works with children, young people or adults at risk of harm, you must put in place appropriate safeguarding arrangements. Safeguarding means protecting their health, wellbeing and human rights; enabling them to live free from harm, abuse and neglect. Safeguarding arrangements include: staff and volunteer checks; policies and procedures; training for all staff and volunteers on what to do if they have concerns about the safety or welfare of a child, young person or adult at risk of harm."

That is a must. CCNI’s own must/should key confirms it means a legal requirement rather than good practice. Read what it attaches to, though. The duty is to put appropriate safeguarding arrangements in place. CCNI lists what arrangements include:

• staff and volunteer checks
• policies and procedures
• training

The duty is not phrased as a duty to hold one document called a safeguarding policy. It is triggered by working with children, young people or adults at risk of harm.

On content, CCNI does not publish its own list. It cross-refers to Volunteer Now’s nine safeguarding standards and treats them as the sector’s authoritative source. CCNI keeps the regulatory and legal-duty layer for itself. The standards are published free.

One Northern Ireland point that is easy to miss, because it sits in a different process entirely. CCNI’s own template declaration for prospective trustees asks a separate question. It asks whether the person is barred from acting as a trustee under the Safeguarding Vulnerable Groups (Northern Ireland) Order 2007. So a charity following CCNI’s recommended process screens for safeguarding barring as part of trustee eligibility, not only as part of its safeguarding arrangements.

Common mistake: concluding that because no statute demands a policy, none is needed

It is the literal reading of the legal position, and that position is correctly stated. It is still the wrong conclusion. The legal answer and the practical answer diverge further here than anywhere else in the policy set.

Funders require the document. The Commission expects it. The underlying duty to protect people is unconditional and unaffected by any of that. The right response to “no provision requires this” is to write the policy for the reason it helps. The person who takes the call at 7pm should know what to do.

Worked example

Wrenfield Village Hall has no staff. It runs a weekly lunch club for older people. It has never had a safeguarding policy, on the basis that it is a hall rather than a care provider.

The strict legal position is that no provision compels the document. But the club works with adults at risk, so the Commission’s expectation applies in full. The hall’s own annual return will also ask whether the policy was in place. When the committee applies to a grant funder for a new kitchen, the application asks for the policy as a condition.

The committee asked: “do we have to?” The honest answer is no, and they should, and here is exactly who will ask. What persuaded them was none of that. It was working out who the volunteer on the door should ring, and discovering that nobody knew.

With safeguarding settled, the next policy in the sequence is the financial controls policy.