Who can see our accounts, and do we have to publish them ourselves?

England and Wales: This page sets out the position in full. Scotland: covered, and a genuinely different regime — since March 2026, whatever you submit is published in full, unredacted, with no income floor; see below. Northern Ireland: covered — accounts are published once filed, and what that means for personal data is set out below.

Three meanings of “publishing” charity accounts

“Filing” and “publishing” are not the same thing, though almost everyone uses the two words as if they were. Before the trustees draft anything, keep three ideas apart:

• what the regulator publishes automatically, once you have filed
• what the charity has to publish itself, separately from filing
• what is now unredacted: published exactly as you sent it, with nothing taken out by the regulator for you

The third is the one that has changed, and it has changed furthest in Scotland. This page assumes the accounts are already filed — see file your accounts — and deals with what happens to them next.

Scotland: since March 2026, whatever you submit is published in full

From 9 March 2026, OSCR stopped taking personal details out of Scottish charity accounts before it published them. In OSCR’s own words:

“OSCR will no longer redact any information from these documents. The new legislation requires OSCR to publish the information in an unredacted form.”

OSCR publishes in full every accounts document a Scottish charity submits with its online annual return. Nothing is redacted. There is no income threshold below which the rule stops applying. The change came into force in law on 5 March 2026. OSCR began publishing this way on the following Monday, 9 March 2026. Both dates are real, for different things.

Once published, it stays visible for at least 5 years.

In effect, OSCR no longer stands between what you write and what the public sees. Whatever goes into the document you submit is what appears. So the decision about what to include has to be made before you draft. Do not leave it until after, on the assumption that the regulator will quietly tidy it up.

OSCR’s out-of-date FAQ

OSCR’s own published FAQ still states an old, lower income threshold for this rule. That was the position before the March 2026 change. The rule now covers every charity, however big or small.

Do not cite the FAQ for that point. Cite the instrument, as this page does. If OSCR’s site still shows the old threshold when you check, it is the FAQ that is out of date, not this page.

How can a Scottish charity keep personal details out?

The law has two routes to keep personal details out of published accounts. They are not two separate applications. The law links a Scottish charity’s Register-entry exemption to its accounts protection. The link is in the Charities and Trustee Investment (Scotland) Act 2005, s.44(4A), in force from 5 March 2026. It reads:

“Regulations under subsection (4) must be framed so that a charity is not required to include any information in its statement of account that is excluded from its entry in the Register under section 3(4).”

Where a trustee already has a s.3(4) exclusion from the public Register, it carries over to the accounts by itself. The trustee does not apply a second time. The exclusion itself is covered where you record trustee details with OSCR.

The other route is a safety and security dispensation. It covers a named person’s or premises’ details. The dispensation adds to the Register exclusion. It does not replace it. The dispensation also covers premises addresses and the names of people who are not trustees. The Register exclusion covers neither.

The dispensation uses the same test in law. OSCR must grant it where satisfied that including the information would be likely to jeopardise the safety or security of a person or premises.

Either way, the timing matters more now than it used to. OSCR no longer redacts when it publishes. So protection has to be in place before you submit. Asking afterwards, once the document is already public, is too late.

Content the charity adds itself

Neither route covers content the charity chooses to add, such as a photo, a volunteer’s name or a beneficiary’s story. The Register exclusion and the safety dispensation come before anything the charity chooses to write.

Then there is anyone who is not a trustee. OSCR’s own advice is to decide before drafting whether it is right to name or picture them at all. Trustee names themselves are legally required content. Only the two exclusion routes in the previous section are available to withhold one.

The same drafting question comes up again when you prepare the notes to the accounts. For what those notes have to cover, see prepare the notes to the accounts.

Northern Ireland: published once filed

CCNI publishes a charity’s accounts once they are filed. Its own recent monitoring found that a few charities had documents taken off or replaced on the public register in the year covered. Most were for simple admin errors. A smaller number were for data protection reasons.

CCNI’s own advice is the same as OSCR’s. You need consent before publishing a volunteer’s name or photo in a report. Do not assume it. The charity’s own position on this belongs in its data protection policy.

This page ends the yearly cycle. The pages after it are for when something goes wrong. For harm or loss, see recognise a serious incident. For a wrong filing, see fix a late or incorrect filing.

Common mistake: assuming the regulator will strip personal data before publishing

OSCR used to do exactly that. It no longer does. In OSCR’s words: “OSCR will no longer redact any information from these documents.” Whatever is submitted appears. Protection has to be in place before you submit. Use the Register exclusion or the safety and security dispensation.

Common mistake: treating the Register exemption and the accounts as unconnected

They look like two separate protections, and are sometimes treated that way. That leads a charity to file a second application it does not need. Or it assumes a Register exclusion leaves a gap in the accounts. The statute connects them. A s.3(4) Register exclusion carries over to the accounts by itself, with no second application required.

Worked example

Tollgate Youth CIO is based in Scotland. Its annual report has a photo and the first names of several volunteers in the achievements section. Once the report is filed, all of it is published: the image, the names, everything as submitted. OSCR removes nothing.

The trustees take their advice from OSCR. First, decide before drafting whether it is right at all to name or picture volunteers and the young people the charity works with. Second, do not assume the regulator will make that call for the charity later.