UK charities reported a data breach or cyberattack in 28% of cases over the past 12 months, an estimated 57,000 organizations, according to the UK government's Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology. That exposure sits next to a donor base that is watching closely: 79.8% of donors told Give.org's 2025 Donor Trust Report they would stop or reduce giving after a charity data breach.
Below is what the breach numbers look like, how donors say they will react, how the sector's largest websites scored on an independent compliance audit, and what happened after the Blackbaud breach touched more than 13,000 nonprofits at once.
How many charities have been breached?
28% of UK charities, an estimated 57,000 organizations, reported a cyber security breach or attack in the past 12 months. That figure comes from DSIT's Cyber Security Breaches Survey 2025/2026, based on interviews with 1,085 UK registered charities conducted between August and December 2025. It sits well below the breach rate reported by narrower samples: a CyberPeace Institute study of Geneva-area NGOs found 68% had experienced a data breach in the past three years, and Nonprofit Tech for Good's 2023 global report put worldwide nonprofit cyberattack victimization at 27%. The gap between these figures is mostly about scope, not disagreement: the UK government survey covers the entire registered charity sector including thousands of small, single-cause organizations, while the CyberPeace sample skews toward internationally active NGOs handling more sensitive caseloads.
Figure 1: Reported breach or cyberattack rate across three separate surveys of the nonprofit sector. Source: DSIT, CyberPeace Institute, Nonprofit Tech for Good.
The same DSIT survey found charities are less likely than businesses overall to have a formally documented incident response plan, which matters because 56% of nonprofits in the CyberPeace sample reported having no dedicated IT or cybersecurity budget at all, and 33% had no IT support or technical expertise on staff. A charity that wants to reduce its exposure, and be able to show a regulator or a major donor that it takes data protection seriously, can generate a privacy policy that documents how donor and beneficiary data is collected, stored, and shared.
Do donors care about charity data privacy?
79.8% of donors said they would stop or reduce their giving to a charity after a data breach, according to Give.org's 2025 Donor Trust Report, based on a survey of more than 2,200 US adults and 1,100 Canadian adults conducted in December 2024. The same report found 68.8% of donors are already concerned their information could be hacked when they give to a new charity, and 62.0% worry the charity will share their data with third parties without asking first.
Figure 2: Share of donors reporting each privacy concern. Source: Give.org, Donor Trust Report 2025.
Trust still tilts in the nonprofit sector's favor for now: 48.1% of donors said they trust charities more than businesses to protect their privacy, against 23.0% who trust businesses more. That gap is an asset a charity can lose quickly. 44.3% of donors in the same survey said they would be less likely to donate if they learned a charity used AI tools to identify them as a prospective donor, a sign that donor-data practices considered routine inside a development office can read as invasive from the outside.
How well do charity websites actually comply with GDPR?
The most detailed independent audit of UK charity websites, conducted by ProPrivacy in 2020, analyzed 82,804 charity domains and manually reviewed the sector's 100 highest-income organizations. It found 92 of the top 100 UK charities failed to meet at least one element of GDPR or ePrivacy compliance, and 84% loaded marketing or tracking cookies before the visitor had given consent. This audit is now several years old and has not been repeated at the same scale, so treat it as the most recent full picture available rather than a current snapshot, but no fresher sector-wide study has replaced it.
Figure 3: Cookie and tracking practices among the UK's 100 highest-income charities. Source: ProPrivacy, "Exposing the Hidden Data Ecosystem Behind UK Charities" (2020).
Only 8 of the top 100 charities fully suspended third-party cookies while waiting for consent, and just 32% offered visitors a granular choice over which categories of cookies to accept. Across the full 64,581-domain sample, 42% of charity websites carried some form of ad-tracking technology, and 21% of the top 100 shared donor or visitor data directly with data brokers, compared with 0.3% sector-wide. A charity handling donor payment details, gift-aid declarations, or beneficiary case records needs a policy that names every category of data collected and every third party it reaches, not a template copied from another organization's site.
What happened in the Blackbaud breach?
A ransomware attack on Blackbaud, the nonprofit sector's largest fundraising-software vendor, exposed data belonging to more than 13,000 nonprofit, education, and healthcare customer organizations in 2020, roughly a quarter of the company's customer base at the time. The Identity Theft Resource Center separately tracked the fallout across 536 organizations and an estimated 13 million affected individuals as notifications continued to surface over the following years.
Figure 4: Timeline of major charity-sector data privacy events. Source: ICO, Blackbaud, New York Attorney General, DSIT.
Blackbaud paid $49.5 million in October 2023 to settle a multistate investigation led by New York's attorney general, who alleged the company understated the scope of the breach to affected customers; New York's share of the settlement alone was $2.9 million. Because Blackbaud sits underneath so many charities' donor databases, a single vendor incident became a data privacy event for organizations that had no direct role in the underlying security failure, the same third-party exposure risk that shows up across other small-organization sectors covered in PrivacyTerms.io's small business privacy data.
Has the UK fined charities over data privacy?
Yes. The ICO opened its most concentrated charity-sector enforcement action in December 2016, fining the RSPCA 25,000 pounds and the British Heart Foundation 18,000 pounds for secretly profiling donors through "wealth screening" and trading their details with other organizations without proper disclosure. Four months later, in April 2017, the ICO fined 11 more major UK charities a combined 138,000 pounds for similar practices, including Oxfam, Cancer Research UK, Macmillan Cancer Support, the NSPCC, WWF-UK, Battersea Dogs and Cats Home, Guide Dogs, the Royal British Legion, Great Ormond Street Hospital Charity, the International Fund for Animal Welfare, and Cancer Support UK.
Figure 5: The compliance path that separated the fined charities from a lawful donor-data program. Source: ICO enforcement notices, 2016 to 2017.
Every one of those 13 organizations was a well-established, professionally run charity, which is the detail that makes the enforcement sweep worth remembering: donor data practices that feel like standard fundraising operations, such as buying additional contact details to enrich a donor's profile, can cross into unlawful processing the moment the donor was not told about it in advance.
The Bottom Line
The charity sector's exposure runs in two directions at once. A meaningful share of organizations, 28% by the UK government's own count, are being breached or attacked every year, often with limited IT budget or staff to respond. At the same time, the sector's largest websites have historically scored poorly on independent compliance audits, and donors say they are paying attention: nearly 8 in 10 would pull back their giving after a breach. A charity does not need a large compliance team to close the gap between those two numbers. Publishing a clear, accurate privacy policy that names every category of donor and beneficiary data collected, every third party it reaches, and the donor's rights over it addresses the exact failure that triggered the ICO's fines and the low marks in the 2020 compliance audit alike.
Frequently Asked Questions
How many charities have been breached or attacked? 28% of UK charities, an estimated 57,000 organizations, reported a cyber security breach or attack in the past 12 months, according to the UK government's Cyber Security Breaches Survey 2025/2026.
Do donors care if a charity has a data breach? Yes. 79.8% of donors surveyed said they would stop or reduce their giving to a charity after a data breach, and 62.0% already worry a charity will share their data with third parties, per Give.org's 2025 Donor Trust Report.
What happened in the Blackbaud data breach? A 2020 ransomware attack on nonprofit software vendor Blackbaud affected more than 13,000 nonprofit, education, and healthcare organizations. Blackbaud paid $49.5 million in October 2023 to settle a 50-state attorney general investigation into the incident.
Has a charity ever been fined for a data privacy violation? Yes. The UK's Information Commissioner's Office fined 13 major charities, including the RSPCA and British Heart Foundation, a combined total of more than 180,000 pounds in 2016 and 2017 for undisclosed donor wealth-screening and data-trading practices.
This post is one entry in a broader look at how smaller and mission-driven organizations handle privacy compliance; see Small Business Privacy Statistics 2026 for how charities' compliance gaps compare to other small organizations. Companion posts on open banking data sharing and blogger legal pages are planned for this cluster but not yet published on this site.
Where the Numbers Come From
- UK Department for Science, Innovation and Technology. (2026). "Cyber Security Breaches Survey 2025/2026." Charity sample of 1,085 organizations, fieldwork August to December 2025.
- Give.org (BBB Wise Giving Alliance). (2025). "Donor Trust Report 2025: Special Report on Privacy and Security." Survey of 2,200-plus US and 1,100-plus Canadian adults, fielded December 2024.
- ProPrivacy. (2020). "Exposing the Hidden Data Ecosystem Behind UK Charities." Analysis of 82,804 UK charity domains, manual review of the top 100 by income.
- New York Attorney General. (2023). "Attorney General James and Multistate Coalition Secure $49.5 Million from Cloud Company Blackbaud."
- Identity Theft Resource Center. "Blackbaud Data Breach Leaves Lasting Impact on U.S. and International Nonprofits." 536 organizations and an estimated 13 million individuals tracked.
- Third Sector. (2017). "ICO issues fines totalling 138,000 pounds to charities for data breaches." Covers the 11-charity April 2017 enforcement sweep.
- HuffPost UK. (2016). "RSPCA and British Heart Foundation Fined for Secret Wealth Screening of Donors." Covers the ICO's December 2016 enforcement action.
- CyberPeace Institute. "Cyber Poor, Target Rich: The Crucial Role of Cybersecurity in Nonprofit Organizations." Survey of Geneva-area NGOs.
Note: All figures verified as of September 2026. The 2020 ProPrivacy audit of UK charity websites has not been repeated at the same scale since publication; treat those cookie-compliance figures as the most recent full picture available rather than a current one. This post's figures are refreshed at least twice a year to track new breach-survey and enforcement data.
