Insurance guide
Charity insurance cover for trustees, volunteers, events, and cyber risk
Charity insurance should start with the charity's risk register, activities, people, assets, premises, contracts, events, vehicles, fundraising routes, data, and trustee duties. This guide helps trustees prepare the evidence to discuss with a broker, insurer, adviser, or board, without treating insurance as a replacement for risk management.
Map the charity's actual exposure first
- List premises, owned buildings, leased spaces, contents, equipment, vehicles, events, fundraising activities, professional services, overseas travel, online systems, payment routes, and data processing before asking for a quote
- Use the risk register to separate risks that need insurance from risks that need controls, training, supervision, reserves, supplier review, cyber remediation, safeguarding action, or contract changes
- Record who is covered: employees, volunteers, trustees, contractors, visitors, beneficiaries, event participants, drivers, professional advisers, and partner organisations can sit under different definitions
- Check whether governing documents, leases, grant agreements, venues, funders, local authorities, commissioners, platforms, or lenders require particular cover or evidence
Understand compulsory and common cover routes
- Charities that employ staff normally need employers' liability insurance, with at least the required cover, bought from an authorised insurer, and with the certificate displayed where employees can access it
- Motor insurance is compulsory where the charity owns or operates motor vehicles; if staff, trustees, or volunteers use their own cars on charity business, their own insurance position needs to be checked
- Buildings, contents, event, public liability, professional indemnity, travel, staff sickness, and cyber insurance are not all compulsory in the same way, but they may be appropriate after risk assessment
- Trustee indemnity insurance directly protects trustees and is treated differently from insurance that mainly protects the charity, so trustees should check the legal power, exclusions, cost, and best-interest reasoning
Prepare evidence before renewal or quotes
- Keep current activity descriptions, income, employee and volunteer numbers, event plans, asset registers, premises details, prior claims, incident logs, risk register extracts, safeguarding controls, cyber controls, and financial control records in one renewal pack
- For volunteer-heavy work, check how the policy defines volunteer, whether age limits apply, whether activities are covered, and whether training, supervision, or record conditions must be met
- For events and public fundraising, match the cover to location, crowd size, volunteers, third-party suppliers, cash handling, food, transport, equipment, weather, safeguarding, cancellation, and venue requirements
- For cyber and data risks, prepare evidence around MFA, backups, access ownership, incident response, supplier controls, logs, sensitive-data rules, payment systems, and trustee reporting before relying on a cyber policy
Review the decision like trustees, not buyers
- Record why each cover is needed, what risk it addresses, what exclusions or excesses matter, what controls remain outside the policy, and who owns renewal checks
- Do not compare premiums alone; compare limits, exclusions, definitions, claims conditions, retroactive dates, professional advice periods, trustee indemnity restrictions, cyber evidence requirements, and broker or adviser notes
- Escalate when the charity has buildings, vehicles, regulated services, overseas work, professional advice, large events, high-risk fundraising, safeguarding exposure, sensitive data, or material contractual insurance requirements
- After buying or renewing, update the risk register, trustee papers, asset records, event templates, volunteer records, cyber remediation list, serious incident routes, and financial controls so the insurance evidence stays current
Official sources
Official source
Charities and insurance (CC49)
Charity Commission overview explaining how trustees can protect charity assets and resources by choosing appropriate insurance.
Official source
Charities and insurance detailed guidance
Detailed CC49 guidance covering compulsory insurance, volunteers, property, liability, events, professional indemnity, travel, and trustee indemnity insurance.
Official source
Employers' liability insurance
GOV.UK guidance on when employers' liability insurance is required, minimum cover, authorised insurers, fines, and displaying the certificate.
Official source
Employers' Liability (Compulsory Insurance) Act 1969: HSE40
Health and Safety Executive guide for employers explaining compulsory employers' liability insurance and exemptions.
Official source
Charities and risk management (CC26)
Charity Commission guidance on identifying, assessing, and managing charity risks before deciding whether insurance is an appropriate control.
Official source
Charity fundraising: a guide to trustee duties (CC20)
Charity Commission guidance on trustee duties when charities raise funds from the public, useful for events, public collections, commercial participators, and campaign risk records.
Official source
Internal financial controls for charities (CC8)
Charity Commission guidance on protecting charity funds and assets from fraud, loss, weak records, and control gaps.
Related tools
Interactive tool
Charity cyber insurance readiness checker
Check whether a charity has the operational evidence often requested before cyber insurance quotes, renewals, trustee review, or supplier due diligence. The checker scores controls, highlights urgent warning signs, and links to source-checked security benefits without giving insurance advice or quoting premiums.
Interactive tool
Charity risk register checker
Check whether a charity risk register has the evidence trustees need before annual reporting, insurance renewal, cyber review, service planning, reserves review, funding decisions, or major supplier changes. The checker follows Charity Commission CC26 themes without giving legal, insurance, audit, safeguarding, investment, or governance advice.
Interactive tool
Charity cybersecurity budget calculator
Estimate a practical annual cybersecurity budget before buying tools or applying for nonprofit security benefits. The calculator separates software or service spend from internal staff time, incident readiness, backups, DNS and website protection, identity controls, logging, training, and supplier access review.
Interactive tool
Charity password and access security checker
Check whether a charity has the core access controls needed before expanding software accounts. The checker gives a risk band, an action list, and source-checked benefits to review; it does not replace professional security advice, legal advice, or provider eligibility checks.
Interactive tool
Charity safeguarding policy checker
Check whether a charity's safeguarding and protecting-people arrangements have the evidence trustees need before annual review, service changes, online delivery, volunteer recruitment, overseas work, or incident follow-up. The checker follows Charity Commission safeguarding guidance without giving legal, safeguarding, employment, data-protection, insurance, criminal, or governance advice.
Interactive tool
Charity internal financial controls checker
Check whether a charity's internal financial controls have the evidence trustees need before year-end accounts, fraud review, bank mandate changes, online banking setup, fundraising events, grant payments, supplier payments, or serious incident follow-up. The checker follows Charity Commission CC8 themes without giving accounting, audit, tax, legal, investment, fraud investigation, or governance advice.
Interactive tool
Charity serious incident reporting checker
Check whether an actual or alleged incident has strong Charity Commission serious-incident reporting signals and whether the trustee body has the evidence needed before using the official report form. The checker follows GOV.UK serious incident guidance without giving legal, safeguarding, criminal, insurance, audit, data-protection, or governance advice.
Interactive tool
Charity data protection readiness checker
Check whether a charity has practical evidence ready before launching forms, fundraising campaigns, CRM migrations, AI tools, beneficiary systems, staff data workflows, or supplier questionnaires. The checker scores operational readiness and links to official ICO guidance without giving legal advice.
Common questions
FAQ
What insurance does a charity need?
There is no single list for every charity. Start with the charity's activities, employees, volunteers, premises, assets, events, vehicles, contracts, fundraising routes, cyber exposure, and risk register. Some cover may be required by law or contract; other cover depends on the trustee risk assessment.
FAQ
Do charities need employers' liability insurance?
Usually yes if the charity employs staff. GOV.UK says employers' liability insurance is required as soon as an organisation becomes an employer, must cover at least the required amount, and must come from an authorised insurer. Charities should also check HSE guidance and any exemptions before relying on a decision.
FAQ
Are charity volunteers covered by insurance?
Do not assume they are covered. CC49 says charities should treat volunteers in a similar way to employees for insurance purposes and check whether the policy includes volunteers, how volunteer is defined, whether age limits apply, and whether the activities volunteers carry out are covered.
FAQ
Does a charity need public liability insurance for events?
Public liability insurance may be relevant for events because events involve visitors, volunteers, venues, suppliers, equipment, and third-party injury or property risks. Trustees should match the cover to the event risk assessment, venue terms, fundraising controls, safeguarding controls, and supplier contracts.
FAQ
What is trustee indemnity insurance?
trustee indemnity insurance can protect trustees personally against certain legal claims made against them in their trustee capacity. CC49 explains that it directly protects individual trustees, has exclusions, and should be bought only where there is proper legal power, reasonable cost, and a best-interest decision.
FAQ
Is cyber insurance enough for a charity's data risk?
No. Cyber insurance is not a cyber security plan. Charities still need MFA, backups, access ownership, incident response, supplier controls, sensitive-data rules, logs, trustee evidence, and remediation work. Use the cyber insurance readiness checker only as preparation for broker, insurer, adviser, or trustee review.
Decision notes
- This guide is not insurance advice, legal advice, broker selection, risk management advice, safeguarding advice, employment advice, tax advice, audit advice, or a premium quote.
- Insurance does not replace trustee risk management, safeguarding controls, internal financial controls, cyber controls, contractual review, staff training, or professional advice.
- Use official guidance, the charity's governing document, policy wording, broker or insurer evidence requirements, and professional advice before buying, renewing, cancelling, or relying on insurance cover.
- Do not enter claims history, personal data, incident details, beneficiary information, policy numbers, or sensitive cyber evidence into this site.