--- title: 'Cyber Security for Charities | Managed Protection' url: 'https://triplepoint.org.uk/industries/charities' markdown: 'https://triplepoint.org.uk/industries/charities.md' date: '2026-10-29' description: 'Cyber security for UK charities: protect donor and beneficiary data, stop phishing and payment fraud, and meet trustee and Charity Commission expectations.' --- # Cyber Security for Charities | Managed Protection ## Why charities are targeted Charities hold information people trust them with: donor details, gift aid records and, often most sensitive of all, information about the people they help. Many also handle money from grants and donations, with small teams, volunteers and shared accounts. Criminals know that. In the government's [Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), 28% of charities reported a cyber breach or attack in the past year, most often phishing. ## What we see ### Phishing and fake requests Emails pretending to be from a trustee, a funder or a supplier, asking for a payment, a gift card or a password. Small teams and volunteers are easy to rush. ### Donation and grant fraud An attacker in a mailbox changes the bank details on an invoice or a grant payment, and the money is gone before anyone notices. ### Sensitive beneficiary data Records about vulnerable people, safeguarding notes and health details. A breach harms the people you exist to help, and may need reporting to the ICO and the Charity Commission. ### Shared accounts and personal devices Volunteers and staff using their own phones and laptops, and logins shared between several people, make it hard to know who has access to what. ## What clients, insurers and regulators expect - **Trustees and the Charity Commission.** Trustees are responsible for protecting the charity's assets and data. In England and Wales they must [report serious incidents](https://www.gov.uk/guidance/how-to-report-a-serious-incident-in-your-charity) to the Charity Commission promptly, and that includes a significant data breach or loss, and fraud or cyber-crime. - **UK GDPR.** Your charity is responsible for the personal data it holds about donors, volunteers and beneficiaries. A breach that puts people at risk must be reported to the ICO within 72 hours of you becoming aware of it. - **Funders and partners.** Grant makers and the organisations you work with increasingly ask how you protect data before they fund or share information with you. - **Insurers.** Charity and cyber insurers ask about multi-factor authentication, email security and device protection. What we recommend ## Protection for charities From£4 ### Email security Filters phishing, impersonation and fake payment requests out of your mailboxes before staff and volunteers see them. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/people-and-email/email-security) From£8 ### Identity threat detection (ITDR) Spots stolen passwords and suspicious Microsoft 365 sign-ins, so a hijacked account is caught early. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/detect-and-respond/identity-protection) From£6 ### Anti-malware & ransomware protection Antivirus and anti-ransomware on every laptop and desktop, a sensible starting point on a tight budget. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/devices/malware-protection) From£4 ### Phishing simulation & training Practice phishing emails and short training, for staff and volunteers alike. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/people-and-email/phishing-simulation) From£3 ### Mobile device management Keeps charity data on personal phones under control, and removes it when a volunteer moves on. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/devices/mobile-devices) ### Business email compromise If a mailbox is compromised, we lock the attacker out, find out what they saw and help you contact the right people quickly. [More details](https://triplepoint.org.uk/security/incident-response/business-email-compromise) ## How we work with charities Many charities have a small team, a mix of staff and volunteers, and nobody whose job is security. Budgets are tight, so we start with the protection that stops most attacks and build from there. We start with a conversation about how your charity works: where donor and beneficiary data lives, who uses which devices, and what your funders and insurers ask for. Then we recommend the protection that fits, with prices up front. Everything runs from one platform with one monthly invoice, and you can add to it as you grow. Questions We have a very small budget. Where should we start?+Start with the basics that stop most attacks: multi-factor authentication on every account, email security and antivirus on every device. Our device protection starts at £6 per user per month, excluding VAT. Our guide, [How to spot a phishing email](https://triplepoint.org.uk/guides/how-to-spot-a-phishing-email), is free to share with your volunteers. Do we have to tell the Charity Commission about a cyber attack?+In England and Wales, trustees must report a serious incident promptly, and that includes a significant data breach or cyber-crime. A personal data breach may also need reporting to the ICO within 72 hours. Our guide, [Do we need to report a cyber attack?](https://triplepoint.org.uk/guides/report-a-cyber-attack-uk), explains the ICO side. Our volunteers use their own phones. Is that a problem?+It can be, but it is manageable. A work profile keeps charity email and files separate from their personal apps and can be removed when they leave. Our guide to [staff phones and BYOD](https://triplepoint.org.uk/guides/secure-staff-mobile-phones-byod) explains the options. Where to go next- [How to spot a phishing email: a guide to share with your staff](https://triplepoint.org.uk/guides/how-to-spot-a-phishing-email) - [Invoice fraud: how business email compromise works and how to stop it](https://triplepoint.org.uk/guides/invoice-fraud-business-email-compromise) - [Do we need to report a cyber attack? UK rules for small businesses](https://triplepoint.org.uk/guides/report-a-cyber-attack-uk) - [Compare our five protection tiers and prices](https://triplepoint.org.uk/security#protection-tiers) [< Back to Industries](https://triplepoint.org.uk/industries) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact?about=Charities) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security for Professional Firms & Charities](https://triplepoint.org.uk/industries.md) - Previous: [Cyber Security for Accountants | UK Practices](https://triplepoint.org.uk/industries/accountants.md) - Next: [Cyber Security for Financial Advisers | IFAs](https://triplepoint.org.uk/industries/financial-advisers.md)