What IT policies should a charity have in place?

Charities do not need a large library of complex policies. What matters is having clear, practical policies that explain how technology is used, who is responsible, and how risks are managed.

For most charities, the following policies form a sensible baseline.

---

Core IT policies most charities should have

• Acceptable Use Policy
  Explains how staff and volunteers should use IT systems, email, and the internet.
• Data Protection Policy
  Sets out how personal data is handled, stored, and protected.
• Access Control Policy
  Covers user accounts, passwords, and who can access systems and data.
• Incident Reporting Policy
  Explains what to do if something goes wrong, such as a suspected data breach or cyber incident.
• Remote and Mobile Working Policy
  Particularly important where staff or volunteers work from home or use personal devices.

---

Why IT policies matter for trustees

IT policies help trustees demonstrate that:

• Risks have been considered
• Expectations are clear
• Responsibilities are defined
• Reasonable steps are in place

Policies do not need to be long or technical. They should be understood, followed, and reviewed periodically.

---

A proportionate approach

For smaller charities, policies can be short and straightforward. Larger charities or those handling sensitive data may need more detail.

The key is that policies reflect how the charity actually operates, not generic templates that sit unread.