FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Charity insurance
Charity cyber insurance is cover for the costs, lost income and liability that follow a cyber attack or data breach affecting donor, supporter or beneficiary data. It matters because larger charities hold sensitive records and face several reporting duties at once.
Part of: Charity insurance
In short
Charities holding donor and beneficiary data should expect a breach to trigger notification to the Information Commission (formerly the ICO) within 72 hours where feasible, a possible serious incident report to the Charity Commission, and a report to Report Fraud for cyber attacks. Cyber insurance usually funds incident response, restoration, interruption and liability claims, subject to the policy terms. Processors such as fundraising platforms need Article 28 contracts, and payment diversion losses may fall under crime cover rather than cyber.
A charity holding donor, supporter and beneficiary records faces two problems when something goes wrong: the cost of responding and the duty to report. Cyber insurance is designed mainly for the first. It usually pays for forensic investigation, legal advice on notification, data restoration, loss of income while systems are down and liability claims from people whose data was exposed, subject to the policy terms. It does not remove the reporting duties, and it does not replace good controls.
For larger charities the data is often sensitive. Beneficiary case notes, health information, safeguarding records and Gift Aid declarations attract more scrutiny than a mailing list. Trustees remain responsible: the Charity Commission's guidance Protect your charity from cyber crime says all the trustees remain responsible for making sure the charity is protected, and suggests medium and large charities use the Cyber Governance Code of Practice and consider Cyber Essentials certification. See also Cyber Essentials and cyber insurance.
Larger charities in England and Wales may have several reporting routes after a single incident.
| Who | When | Source |
|---|---|---|
| Information Commission (formerly the ICO) | Without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals | UK GDPR Article 33(1) |
| The charity, by its processor | Without undue delay after the processor becomes aware of a breach | UK GDPR Article 33(2) |
| Charity Commission | As soon as reasonably possible, for a significant data breach or loss (significant in the context of your charity) | Serious incident reporting guidance |
| Report Fraud | For cyber attacks, even where no harm resulted; a 24/7 helpline is available for live attacks | Charity Commission cyber guidance |
From 30 September 2026 the regulator is the Information Commission (formerly the ICO), and the current text of Article 33 refers to the Commission. Most cyber policies require the insured to notify the insurer promptly too, often through a breach response helpline; telling the insurer late can prejudice cover. The serious incident statistics page shows how often charities report incidents.
The table shows where cyber cover usually sits in a charity programme, subject to the policy terms.
| Exposure | Cover that usually responds | What to check |
|---|---|---|
| Ransomware encrypts the supporter database and case management system | Cyber: incident response, data restoration and business interruption | Waiting period, extra expense, whether fundraising income counts |
| Donor or beneficiary data exposed | Cyber: notification, legal advice, credit monitoring, liability claims | Whether the policy covers claims by data subjects and regulators |
| Regulatory investigation after a breach | Cyber regulatory defence; fines only where insurable by law | Wording on fines and penalties |
| Breach at a fundraising platform or other processor | Cyber for the charity's own response costs, subject to wording | Outsourced service provider cover; contract terms |
| Fraudster changes supplier bank details by email | Crime with social engineering cover, or a cyber extension | Sub-limits and verification conditions |
| Trustees criticised over cyber governance | Trustee indemnity or charity D&O | Cyber exclusions in the D&O wording |
| Fire or flood destroys servers | Property and computer equipment cover | Whether data reconstitution is included |
Whether regulatory fines can be insured is a separate question, discussed in GDPR fines versus civil claims.
Most larger charities rely on processors: online giving platforms, payment providers, CRM hosts, mailing houses, telephone fundraising agencies and payroll bureaux. Under UK GDPR Article 28 the charity, as controller, may use only processors that provide sufficient guarantees of appropriate technical and organisational measures, and processing must be governed by a contract. That contract must require the processor to act on documented instructions, keep data confidential, take the security measures required by Article 32, control sub-processors, help the controller meet its security and related obligations, delete or return data at the end of the contract, and allow audits.
From an insurance point of view, two questions matter. First, does the charity's cyber policy cover its own costs when the breach happens at the supplier, not on its own systems? Many wordings do, but some limit cover for outsourced providers. Second, does the contract leave the charity carrying losses the supplier caused? Liability caps in supplier terms can be low. See Article 82 compensation and processors and supply chain cyber across several policies.
Payment diversion and invoice fraud are the most common point of confusion. A fraudster who compromises an email account and changes a supplier's bank details has used a cyber method, but the loss is of the charity's money. Cyber policies vary: some include a limited funds transfer fraud or social engineering extension, others leave it to a crime policy. Crime policies commonly cover social engineering only as an extension with a sub-limit and verification conditions. Map both wordings side by side so a loss does not fall between them.
See crime versus cyber for payment fraud, invoice redirection fraud and crime and fraud insurance for charities. Ransomware can also touch property and interruption policies, discussed in ransomware across cyber, property and BI.
A national charity's supporter database is encrypted days before a winter appeal. The cyber policy's incident response team helps restore from backups and advises on whether personal data was taken. Business interruption cover responds to lost donation income after the waiting period, subject to proof of loss.
A mailing house used for a direct mail campaign is breached and supporter addresses are exposed. The supplier tells the charity, which must decide whether to notify the Information Commission and make a serious incident report. The charity's cyber policy covers legal advice and notification costs, subject to the policy terms, because it includes outsourced provider incidents.
Review cyber cover at each renewal and when the charity moves systems to a new provider, launches a new digital fundraising channel, takes on new categories of sensitive data, merges with another charity, or after any incident or near miss. Trustees should also check that charity D&O and trustee indemnity insurance do not exclude claims arising from a data breach without the cyber policy picking them up.
The charity insurance broker guide and cyber insurance broker guide give the wider context. For a second opinion, see the charity insurance programme review or the insurance programme review. Apex arranges cyber cover for charities holding donor and beneficiary data; a broker reads every enquiry.
Leave a name and number and a broker who works with charities will call you back, usually the same working day. Or ask for a free second opinion on your charity’s insurance.
Or email your schedules and renewal date to info@apexinsurancebrokers.co.uk, or call 0117 325 0027.
Under UK GDPR Article 33, a controller must notify a personal data breach to the Information Commission (formerly the ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Keep a record of breaches even where you decide not to notify.
The Charity Commission lists a significant data breach or loss as a serious incident that trustees should report, with significance judged in the context of the charity. This is separate from notifying the Information Commission. Cyber attacks should also be reported to Report Fraud.
Policy positions vary, and some wordings exclude or restrict ransom payments. Payments are also subject to legal limits such as sanctions. Most of the value of a cyber policy for a charity lies in incident response, restoration, business interruption and liability cover rather than any ransom element.
Often, but not always. Many cyber policies cover the charity's response costs when a processor is breached, while some limit or exclude outsourced providers. Check the wording and your Article 28 processor contracts, including liability caps.
They can. Payment diversion and invoice fraud may fall under a crime policy social engineering extension, a cyber policy funds transfer extension, or neither. Compare both wordings and their sub-limits so a loss does not fall between them.
Send us your current schedules, policy wordings and renewal date. We will review the whole programme and give you a one-page summary for your board: what to keep, what is missing and what to change. No fee and no obligation. Or call 0117 325 0027.
Get a second opinion Get a quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
