Safeguarding and protecting people for charities and trustees

Manage the risks

Protecting people and safeguarding responsibilities should be a governance priority for all charities. It is a fundamental part of operating as a charity for the public benefit.

As part of fulfilling your trustee duties, whether working online or in person, you must take reasonable steps to protect from harm people who come into contact with your charity.

This includes:

• people who benefit from your charity’s work
• staff
• volunteers
• other people who come into contact with your charity through its work

Trustees are expected to report safeguarding matters to the relevant agencies (such as the police, social services or Ofsted) and for  putting matters  right if things go wrong.

The Charity Commission can hold trustees to account if things go wrong and can check that trustees followed this guidance and the law. We can look at how trustees have acted to protect beneficiaries, staff, volunteers and anyone else who comes into contact with their charity. Read about how the Charity Commission will assess any concerns that come to its attention and when it may become involved.

The Commission is not a safeguarding authority. We do not investigate individual allegations of abuse, decide whether any allegations are true or bring prosecutions. But we can refer concerns to relevant safeguarding agencies and other regulatory bodies to take further action.

Trustees should promote an open and positive culture and ensure all involved feel able to report concerns, confident that they will be heard and responded to.

We expect all trustees to make sure their charity:

• has appropriate policies and procedures in place, which are followed by all trustees, volunteers and beneficiaries
• checks that people are suitable to act in their roles
• knows how to spot and handle concerns in a full and open manner
• has a clear system of referring or reporting to relevant agencies   as soon as concerns are suspected or identified
• sets out identified risks and how they will be managed in a risk register which is regularly reviewed
• follows safeguarding statutory guidance, good practice guidance and legislation relevant to their charity: this guidance links to the main sources of information
• is quick to respond to concerns and carry out appropriate investigations
• does not ignore harm or downplays failures
• has a balanced trustee board and does not let one trustee dominate its work – trustees should work together
• makes sure protecting people from harm is central to its culture
• has enough resources, including trained staff/volunteers/trustees for safeguarding and protecting people
• conducts periodic reviews of safeguarding policies, procedures and practice

Read NCVO’s safeguarding resource Safeguarding for trustees for advice on how to get started with safeguarding.

Read the Charity Governance Code for best practice advice including on safeguarding.

Read Bond’s ‘Good governance for safeguarding’ for support on developing good practice on governance.

If you work with children or adults at risk there are more safeguarding legal requirements. You must check whether these requirements apply to your charity. If they do, you must work within them.

Types of risks and harm

Be aware of the wide range of risks and harms that exist, such as the following:

• sexual harassment, abuse and exploitation
• a charity’s culture, which may allow poor behaviour and poor accountability
• people abusing a position of trust they hold within a charity
• bullying or harassment
• health and safety
• discrimination on any of the grounds in the Equality Act 2010
• data breaches, including those under General Data Protection Regulations (GDPR)
• domestic abuse
• self-neglect
• physical or emotional abuse
• extremism and radicalisation
• forced marriage
• modern slavery and human trafficking
• female genital mutilation

Where concerns are brought to the Commission’s attention, we will make referrals to the relevant agencies.

Policies, procedures and practices you need to have

Your charity’s policies and procedures for protecting people and safeguarding should be:

• put into practice
• responsive to change
• reviewed as necessary, always following a serious incident and at least once a year
• available to the public
• compliant with all relevant legislation, noting this can vary depending on who you work with

Make all trustees, staff, volunteers, partners and beneficiaries aware of your policies. They all need to know how to apply them.

In your policies make clear how you will:

• protect people from undue  harm
• make sure people can raise safeguarding concerns
• handle allegations or incidents
• respond, including reporting to the relevant authorities

The amount of detail in your policies depends on what your charity does, where it works, whether it operates in person or online and the level of risk.

Use guidance to help with your policies and procedures, including the links to specific sources of support on this page. Take expert or professional advice if you need it.

Code of conduct

If you have staff or volunteers you should have a clear code of conduct which sets out:

• your charity’s culture and values
• how people in your charity should behave

Read the Charity Governance Code.

Read NCVO’s Charity Ethical Principles for help with policies on recognising and resolving ethical issues when considering your code of conduct.

Other policies you need to have

You also need to make sure your charity has:

• suitable health and safety arrangements in place
• first aid, fire safety and digital safety policies that everyone understands
• welfare, discipline and whistleblowing policies for staff if you have them
• a complaints process for users and others with concerns

Checking your charity’s policies, procedures and practice

Trustees must be assured that all policies, procedures and practice are checked and challenged to ensure they are fit for purpose.

You must make sure your charity:

• complies with relevant legislation and statutory guidance
• keeps accurate records
• complies with its own policies and procedures

You should also make sure that your charity:

• stays aware of current affairs, trends and themes and how these can influence your policies and practices
• updates policies and procedures to reflect changes to statutory requirements, good practice and current issues

Every trustee should have clear oversight of how safeguarding and protecting people from harm are managed within their charity. This means you need to monitor your performance, not just using statistics, but with supporting information, such as qualitative reports. This will help you to understand common themes, identify risks and gaps so you can ensure they are addressed.

If you change the way you work, such as working in a new area or in a different way, you should:

• review your current policies and make sure they are suitable
• consider whether any extra policies are needed to cover any new situations or risks
• record these discussions and decisions as part of your risk management procedures

Trustees can use a number of things to help with their checking and assurance, including:

• recording the risks faced by your charity and how these are managed
• speaking to people in your charity and beneficiaries to make sure they understand how to raise concerns and get feedback on past experiences
• carrying out checks on any sites your charity may work in and seeing any necessary paperwork
• working with statutory agencies and partners
• setting training plans for trustees, staff and volunteers on safeguarding and protecting people from harm
• recording any potential conflicts of interest at any level
• having a standing agenda item on safeguarding and protecting people from harm at meetings
• reviewing a sample of past concerns to identify any lessons to be learnt and make sure they were handled appropriately
• organising external reviews or inspections

Get checks on trustees, staff and volunteers

You must make sure that trustees, staff and volunteers are suitable and legally able to act in their positions. This includes people from or working overseas.

You may need to get:

• DBS checks
• references and checks on gaps in work history
• confirmation that staff can work in the UK
• health checks

Disclosure and Barring Service (DBS) – criminal records checks

You should consider whether to use DBS checks as part of your wide range of checks on trustees, staff and volunteers. They should be used alongside references and interviews to give you a broad and informed view to manage the risk of abuse or harm. You should review what checks are needed as your charity evolves or individual roles change.

Many posts are eligible for standard or enhanced level DBS checks, such as those working with children or adults at risk in certain circumstances, or with animals, although in limited circumstances.

Trustees should risk assess all roles taking into account the working environment to determine if they are eligible for a check and if so, at what level.

Always get a standard, enhanced or enhanced with barred list check from the DBS when a role is eligible for one.

Not all roles working with children or adults at risk are eligible for a standard or enhanced check. You should get a basic check if your risk assessment determines it’s appropriate.

Find out what checks are available from the Disclosure and Barring Service (DBS).

Use the DBS eligibility checker and guidance leaflets to decide what checks to make.

If you ask applicants about their criminal records you must have a policy in place that sets out a lawful basis and condition of processing this information, to comply with the General Data Protection Regulations (GDPR).

A charity that uses information from the DBS must also have a policy on the recruitment of ex-offenders, in order to comply with the DBS Code of Practice. The DBS has guidance on this.

Consider asking DBS applicants to register with the Update Service or consider carrying out further DBS checks on a regular basis.

NACRO has guidance on dealing with DBS checks and criminal record risk assessments.

DBS change that came into effect in 2026

From 21 January 2026, self-employed people, for example nannies, tutors and sports coaches, can now apply for an enhanced DBS check through a DBS Umbrella Body which they can then share with current or potential employers. Read DBS checks for self-employed people and personal employees for more details.

From 1 September 2026, the supervision exemption for regulated work with children no longer applies. This means some staff and volunteers who teach, train, instruct, care for or supervise children often or overnight will now be classed as carrying out regulated activity, even if they are supervised. Trustees should ensure their charity reviews affected roles and updates DBS checking arrangements where necessary. Read Change to the definition of regulated activity with children from 1 September 2026 for more details.

People from overseas

It’s a different process to get checks for trustees, staff or volunteers from overseas.

Read guidance on getting checks for people from overseas.

You can join the Misconduct Disclosure Scheme to get extra checks on international staff.

Sending workers overseas

Where you cannot get a DBS check for someone going to work overseas, they may be able to get an International Child Protection certificate.

Automatic disqualification

Some people are disqualified from being a trustee or holding a senior management function (chief executive or finance director level).

Guidance on disqualification and checks to make.

Protect volunteers and staff

If your charity has volunteers or staff, you need to protect them from undue harm.

Have clear policies and procedures on:

• bullying and harassment
• whistleblowing

Read ACEVO’s report on workplace bullying in charities. Section 7 of the report explores how a bullying culture can be created and gives six recommendations to create safer systems to combat this.

You need to have adequate insurance which covers the individuals and the activities involved.

Charities and insurance.

Safeguarding children or adults at risk

If your charity works with children or adults at risk, either online or in person, you should:

• establish appropriate safeguarding policies and procedures that all trustees, staff and volunteers follow, which fit with the policies and procedures of your local authority safeguarding partnership or safeguarding children or adults board
• make sure all staff and volunteers receive regular training on child protection or working with adults at risk
• appoint a safeguarding lead to work with your local authority safeguarding partnerships or boards and/or create a plan for responding to concerns overseas
• manage concerns, complaints, whistleblowing and allegations relating to child protection or adults at risk effectively
• have clear policies when DBS checks are required, how you assess the level of check needed and how you handle the information

You must follow relevant legislation and guidance.

Identify your local authority safeguarding children or adults partnership or board.

They:

• coordinate safeguarding and promote the welfare of children or adults at risk in the area
• publish policies and procedures for safeguarding which you must follow

You can find your local authority partnership or board online.

Safeguarding children

Safeguarding children duties apply to any charity working with, or coming into contact with, anyone under the age of 18.

Use resources and follow standards from the NSPCC for safeguarding children. Safeguarding children means to:

• protect children from abuse and maltreatment
• prevent harm to children’s health or development
• ensure children grow up with the provision of safe and effective care
• take action to enable all children and young people to have the best outcomes

In England follow Working Together to Safeguard Children 2023

In Wales follow Wales Safeguarding Procedures

Safeguarding adults at risk

Safeguarding adults at risk means protecting their right to live in safety and free from abuse and neglect. Your charity may have trustees, staff, volunteers, beneficiaries or other connections who are classed as adults at risk.

Safeguarding duties for adults at risk apply to any charity working with anyone aged 18 or over who:

• has needs for care and support (whether or not the local authority is meeting any of those needs) and
• is experiencing, or is at risk of, abuse or neglect and
• as a result of those care and support needs is unable to protect themselves from either the risk of, or the experience of, abuse or neglect

An adult at risk of abuse may:

• have an illness affecting their mental or physical health
• have a learning disability
• suffer from drug or alcohol problems
• be frail

In England follow guidance on the Care Act 2014

In Wales follow Wales Safeguarding Procedures

Operating online

Operating online carries specific safeguarding risks connected to protecting people from abuse and protecting sensitive information. You must make sure these are managed and reflected in your policies and practices.

• Content: does your charity have adequate control over its website and social media accounts? Who can post information and is all content suitable for your charity?
• Contact: how do people talk to each other when using your online services and how do you keep users safe? Do people need passwords to access services?
• Conduct: how do you monitor what people do, say and share when using your services?

You must be satisfied that your charity identifies and manages online risks:

• be confident volunteers, staff and trustees understand how to keep themselves safe online. You could use high privacy settings and password access to meetings to support this
• be sure the online services you provide are suitable for your users. For example, use age restrictions and offer password protection to help keep people safe
• know the services your charity uses and provides are safe and in line with your charity’s code of conduct
• protect people’s personal data and follow GDPR legislation
• make sure you have permission to display any images on your website or social media accounts. You may need individual or parental permission
• clearly explain how users can report online concerns

Your charity may also have to comply with the Online Safety Act 2023 if it uses social media or delivers online services in a particular way. For example, if your charity runs an instant messaging service or an online forum where your beneficiaries or other users can post content and communicate with each other.

If the Act applies to your charity, you must put in place measures that protect users, particularly children. For example, measures to stop them from accessing harmful content.

Your charity should have a social media policy. If your charity must comply with the Act, make sure your policy reflects this, including how your charity is compliant.

Read our guidance about social media and cyber crime.

Read Online Safety Act: explainer and check if your charity must comply with the Act by using this online tool.

There are further resources charities can use for support when working online, such as Internet Matters, Get Safe Online and NSPCC.

ReadIf theyou Commission’sare guidancenot onsure, charitiesget usingrelevant socialprofessional media. advice.

Working overseas

You must:

• be aware of different risks for staff, volunteers and beneficiaries who are overseas
• have suitable reporting and monitoring processes in place for any work overseas
• monitor where you work for any changes or new safety systems which are needed

Challenges of working overseas include:

• different cultures, practices or legal systems
• an unstable environment, like a conflict zone
• working with many partners

You should apply the same practices as in England and Wales and make sure you comply with any extra requirements of the other country.

Follow The Core Humanitarian Standard on Quality and Accountability for overseas humanitarian work and the Inter-Agency Standing Committee Minimum Operating Standards for Protection from Sexual Exploitation and Abuse if relevant.

You must know when to report:

• issues to law enforcement in the country you are working in
• to police in the UK

You can find resources online to help with working overseas. These include:

• Safeguarding against Sexual Exploitation and Abuse and Sexual Harassment (SEAH) in the aid sector
• BOND, the UK network for organisations working in international development
• Safeguarding Resource and Support Hub

Only use templates that are appropriate for your charity.

Handle and report incidents and concerns

If you have an incident or allegation of abuse you should:

• handle and record it in a secure and responsible way
• follow your protecting people and safeguarding policies and procedures
• act quickly, ensuring you stop or minimise any further harm or damage
• report it to all relevant agencies and regulators when required
• plan what to say to those involved with your charity and the media if appropriate
• be as open and transparent as possible, so that you build the charity’s reputation for acting with integrity while protecting confidentiality appropriately
• review what happened to understand how to stop it from happening again

You should consider whether the incident or concern involves criminal behaviour and whether you therefore need to report it to the police. Follow our guidance on reporting to the police (ODT, 33.7 KB) for further details.

There are other regulators that you may need to report or refer to, as well as Government departments where these are providing funding, depending on what your charity does.

In some cases, you should send a serious incident report to the Charity Commission.

If you work or volunteer for a charity you can also report it to us using our whistleblowing procedure.

If you work with children or adults at risk

Refer all safeguarding concerns with children or adults at risk to your local safeguarding children (LADO) or adult team at your local authority.

You can also refer concerns to the DBS and you must refer to DBS if you:

• provide a regulated activity, and
• stop someone working with children or adults at risk, and
• certain criteria are met

Working with or making grants to other organisations

Carry out proper due diligence when you work with, or make grants to, any other bodies, including:

• delivery partners
• trading subsidiaries of the charity, including charity shops
• organisations you fund
• connected charities

You must make sure that any grant recipient or partner body is suitable. They must have appropriate safeguarding procedures in place. Make sure there are clear lines of responsibility and reporting between all bodies involved.

How to carry out due diligence checks

Use the Department for International Development’s enhanced due diligence: safeguarding for external partners for more guidance on this.

Read our guidance on grant funding an organisation that isn’t a charity if you are considering making grants to other types of organisations.

You should have a written agreement or contract that sets out:

• your relationship
• the role of each organisation
• monitoring and reporting arrangements

Terrorism and the Prevent duty

All charities must prevent abuse for extremist purposes.

Some charities, like educational charities, are ‘specified authorities’. They must follow guidance on the Prevent duty.

Where appropriate you should also follow Advice for schools and childcare providers and use How higher education bodies’ compliance with the Prevent duty is monitored

This must be part of your charity’s risk assessments, policies and procedures.

Download infographic

This document is a one-page summary of safeguarding actions for trustees.

10 safeguarding actions for charity trustees (infographic) (PDF, 122 KB, 1 page)

Text version of infographic

10 actions trustee boards need to take to ensure good safeguarding governance

Safeguarding should be a key governance priority for all charities.

Ensure your charity has an adequate safeguarding policy, code of conduct and any other safeguarding procedures. Regularly review and update the policy and procedures to ensure they are fit for purpose.

Identify possible risks, including risks to your beneficiaries or to anyone else connected to your charity and any emerging risks on the horizon.

Consider how to improve the safeguarding culture within your charity.

Ensure that everyone involved with the charity knows how to recognise, respond to, report and record a safeguarding concern.

Ensure people know how to raise a safeguarding concern.

Regularly evaluate any safeguarding training provided, ensuring it is current and relevant.

Review which posts within the charity can and must have a DBS check from the Disclosure and Barring Service.

Have a risk assessment process in place for posts which do not qualify for a DBS check, but which still have contact with children or adults at risk.

Periodically review your safeguarding policy and procedures, learning from any serious incident or ‘near miss’.

If you work overseas, find out what different checks and due diligence you need to carry out in different geographical areas of operation.

In this guidance:

• ‘must’ means something is a legal or regulatory requirement or duty that trustees must comply with
• ‘should’ means something is good practice that the Commission expects trustees to follow and apply to their charity