How secure do we actually have to be?

England and Wales: This page sets out the position in full. Scotland: the same position — data protection is reserved, so UK GDPR and the ICO apply identically, and Cyber Essentials and the NCSC guidance are UK-wide; the point below about the annual return is about the Charity Commission’s return, and OSCR’s return is separate. Northern Ireland: the same position, reserved in the same way; CCNI’s annual monitoring return is separate from the Commission’s.

The duty sets an outcome, not a checklist

The law sets one duty for charity cyber security, and it is an outcome, not a checklist. The duty applies across the UK. In England and Wales, the Charity Commission makes it a matter for the trustees, not only the manager. Most of what charities are told about cyber security is something else.

This is the first of two security steps in this hub: assess here, then fix at the next. The risk you assess is set by what is on your data map.

The one legal duty is UK GDPR Article 32. It applies to any charity that holds personal data, which is nearly all of them. Its core sentence, verbatim:

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

So you must have security that fits your risk. That is the whole requirement. Article 32 does not mention Cyber Essentials, a password policy or any named control.

That matters in both directions. A small charity does not have to buy a certificate to comply. And a certificate on the wall does not prove you comply, if the risk you carry is larger than the certificate covers.

Cyber Essentials and the NCSC guide are evidence, not the rule

Three things are often described as “the requirement”. None of them is.

• Cyber Essentials is a government-backed certification scheme. It is optional for most charities, priced by headcount band. Its cost, the free insurance and the contracts that can make it compulsory are set out where you secure your accounts, devices and backups.
• The NCSC’s guidance is free advice from the UK’s cyber security agency.
• The Cyber Governance Code is a further published framework.

Each is evidence you could point to if asked how you met Article 32. A certificate is easier to point at than an outcome. That is why charities mistake one for the other. Keep the two apart: the duty is the outcome, and the rest is how you show it.

The Commission makes this a trustee matter

Cyber can look like an IT problem with nothing to do with trustee duties. The Charity Commission does not see it that way. Its guidance “Protect your charity from cyber crime”, published 27 November 2024, grounds cyber in the ordinary duty to look after the charity’s resources. The guidance says:

You and your fellow trustees must manage your charity’s resources responsibly by, for example: being aware of the risks to your charity from cyber crime; taking reasonable steps to protect your charity from cyber crime; responding to cyber attacks properly to reduce the harm to your charity.

That “must” is the Commission’s. It rests on an existing duty rather than a new cyber rule. The same guidance says a serious enough attack may need a serious incident report to the Commission.

The reporting section of this guide covers what counts as serious and how to report: recognise a serious incident, then make a serious incident report. Tool: Is this a serious incident? (planned).

The annual return does not ask about cyber security

You may have read that the annual return now asks whether your charity has a cyber security policy, or has had a cyber incident. It does not.

This guide read the Commission’s full question guide for the 2025 and 2026 returns, end to end. There is no cyber security question in it and no question about AI. The claim traces to an AI-generated summary of a site this guide does not use as a source. This is the third time the claim has been checked across this guide, by a different route each time, with the same result.

The return does ask something nearby. Its governance section asks which of a list of named policies the charity has. That list includes internal risk management and campaigns and political activity. It does not include cyber security or AI.

Its full list of questions is in what the annual return actually asks. The AI side is covered where you decide your position on AI use and record it.

This point is about the Charity Commission’s return for England and Wales. OSCR’s and CCNI’s returns are separate documents.

None of this is a reason to skip the assessment. The duty comes from Article 32 and the Commission’s guidance, not from a question on a form.

Assess against the NCSC’s five topics

Use the regulator’s own structure. The NCSC used to publish a “Small Charity Guide”. It no longer exists as a named document. The PDF returns an error and the old collection address redirects. The live version is the Small organisations guide to cyber security, reviewed in July 2026. It has five topics:

1. Secure your email.
2. Secure your important online accounts.
3. Protect your devices.
4. Back up your data.
5. Spot cyber attacks.

For each topic, write down three things: what you do now, what the gap is, and who will close it. That page is your cyber security baseline: a written record of where the charity stands on each topic, and who owns each gap. Keep it short. A single page is fine for a small charity.

Two habits make the assessment worth having. Name a person against every gap, not “the committee”. And put the page in front of the trustees, so the risk is theirs as well as the manager’s. If you keep a risk register, cyber belongs on it.

The actions that close the gaps are the next step: secure your accounts, devices and backups.

Common mistake: treating Cyber Essentials, or any named control, as the legal requirement

A certificate is easier to point at than an outcome. But UK GDPR Article 32 is outcome-based: “appropriate technical and organisational measures”. It names no control. Cyber Essentials, the NCSC guidance and the Cyber Governance Code are evidence you could point to, not the requirement itself.

Common mistake: believing the charity annual return asks about cyber security

An AI-generated summary said so. It traced back to a source this guide does not use. The full question guide has no cyber security question and no AI question. Do not let the claim back into your planning. This is about the Commission’s return for England and Wales. OSCR’s and CCNI’s returns are separate.

Common mistake: linking the NCSC “Small Charity Guide” by name

Sector content still cites it. It no longer exists as a named document. The PDF returns an error and the collection address redirects. The live equivalent is the “Small organisations guide to cyber security”, with five topics. Anything linking the old guide is citing a broken link.

Common mistake: treating cyber as an IT matter with nothing to do with trustee duties

The Commission is not thought of as a cyber regulator. But it has published cyber guidance. The guidance rests on the existing duty to manage resources responsibly. In the Commission’s words, trustees must be aware of the risks, take reasonable steps and respond properly to an attack. A serious enough attack may need a serious incident report.

Worked example

Wrenfield Village Hall runs its bookings from one laptop and a shared email account. Nobody has changed the password since it was set up.

The committee works through the five NCSC topics in one evening. It finds:

• email: one shared password and no second login step
• accounts: the booking system and the bank both allow a second step, and neither uses it
• devices: the laptop’s updates are switched off
• backups: the bookings live only on the laptop
• spotting attacks: nobody has been shown what a fake invoice email looks like

Each gap goes on one page with a name against it. The treasurer takes the bank. The bookings secretary takes the laptop and the backup. The chair takes the email.

Certification is optional for Wrenfield. The committee decides to come back to it at step 11. The annual return will not ask about any of this. That is not a reason to skip the assessment.

The outcome is a completed baseline assessment against the five topics. Each gap is written down and owned by a named committee member.