What software should a small charity run on?

England and Wales: This page sets out the position in full. Scotland: the same — the programmes are UK-wide, and the data protection duty is reserved and applies identically. Northern Ireland: the same, for the same reasons.

No regulator prescribes a tool stack

No regulator, statute or official guidance tells a charity which email service, file store, finance package or database to use. That includes the Charity Commission and the ICO. Anything that claims to be “the approved charity stack” is someone’s recommendation.

So choosing charity software is practice, not law, in every UK nation. The choice falls to the manager and the treasurer. What follows is the order of decisions that avoids the common, costly mistakes. The next section covers the one piece of law in it.

You can take this step at any point. If the charity already has its tools, use it to review them. Check them against the security duty from the step to assess your cyber security baseline.

The duty follows your data

UK GDPR Article 32 says the charity must have security “appropriate to the risk” for the personal data it holds. That duty does not stay behind when the data moves into a cloud service. It follows the data into whatever tool you choose.

That changes the order of the decision. A tool whose terms or security cannot support appropriate measures is not made cheaper by a charity discount. The free tier is the visible saving, and it is tempting to start there. Start with the data terms instead:

1. What the tool will hold. Supporter records, beneficiary notes and payroll are personal data. Some of it may be special category. Your data map tells you which.
2. What the provider says it does with that data, and where it holds it. Read the data protection terms, not the feature list.
3. Whether you can secure it. Check that you can switch on multi-factor authentication and take a backup out. Those are the controls in the step to secure your accounts, devices and backups.
4. Only then, the price — and the charity programmes at step 14.

Keep the set of charity software small

Most small charities need four things: email, somewhere to keep files, a way to do the books, and a record of supporters. What the books themselves must record is covered where you open your books and choose your accounting basis. Each extra tool is another account to secure, another admin to track and another place personal data sits.

Prefer one tool doing two jobs well over two tools doing one each. When someone suggests a new tool, ask which existing one it replaces.

Write down who administers each tool

Admin access is the part small charities lose track of first. Accounts get set up by whoever was there at the time. Then that person leaves, and nobody can reset a password, add a user or get the data out.

Who holds admin access is an organisational measure under Article 32. The actions at step 11 also depend on knowing who holds admin access. You cannot switch on multi-factor authentication or test a restore on an account nobody can manage.

For each core tool, record:

• What it is for.
• The named administrator — a person, not “the office”. A second named person is sensible, so one departure does not lock the charity out.
• Where the data sits — which provider, and what the terms say about location.

Review the list whenever someone with admin access leaves, and at least when the trustees review their other policies.

Then claim the discounts

The programmes should come in only once the choice is made. Google, Microsoft and TechSoup UK all run charity programmes. Their terms differ, and the detail matters. For example, Microsoft limits its free licences to paid staff and unpaid executives such as trustees. It offers volunteers discounts instead.

That line changes the budget. The next step sets it out: What can we get free or cheap?

Common mistake: choosing tools on price or on the discount available, before reading the data protection terms

The free tier is the visible saving. But the Article 32 duty follows your data into whatever tool you choose. A tool whose terms or security cannot support “appropriate technical and organisational measures” is not made cheaper by a grant. Make the choice first and claim the discounts afterwards.

Common mistake: losing track of who administers each tool

Whoever was there at the time set up the accounts. Then people leave. The administrator list is the thing small charities lose track of first. Who holds admin access is an organisational measure under Article 32. Step 11’s security and backup actions depend on it.

Worked example

Tollgate Youth CIO is choosing its email, file storage, finance and supporter-records tools for the first time.

It starts from the four functions and looks for the smallest set that covers them. For each option it reads the data protection terms first. Its session records hold personal data about young people, and the security duty travels with them. It checks that each tool supports a second login step and a backup the charity can take out.

Only then does it look at price. The charity programmes at step 14 come last, and the trustees see that Microsoft’s free licences reach paid staff and trustees, not volunteers.

The outcome is a written list of core tools, the named administrator of each, and where the data lives. That list feeds steps 11 and 14.