Concept for - Beacon CRM Cyber Security Incident: Key Actions for Charity Trustees

The Charity Commission has issued guidance following the recent cyber security incident involving Beacon CRM, a platform used by many charities to manage supporter and stakeholder information. The Commission has confirmed that it is monitoring the situation and has already received a number of Serious Incident Reports from affected charities. Trustees are being encouraged to consider their reporting obligations and take appropriate action where necessary.

Beacon has indicated that an unauthorised third party accessed parts of its systems and may have obtained database backups. Charities using the platform should therefore assess whether personal data held on their behalf may have been affected.

What Should Trustees Be Doing Now?

From a Data Protection Perspective

Trustees should:

  • Assess what information may have been affected and who may be impacted.
  • Obtain updates and information from Beacon regarding the incident.
  • Consider whether the breach meets the threshold for notification to the ICO.
  • Consider whether affected individuals should be informed.
  • Keep a clear record of decisions and actions taken.

Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, notification to the ICO may be required within 72 hours of becoming aware of the breach.

From a Charity Governance Perspective

Trustees should also consider whether the incident is sufficiently serious to require reporting to the Charity Commission. The Commission expects charities to report incidents that result in, or risk, significant harm to beneficiaries, assets, services or the charity’s reputation.

The Commission has specifically reminded charities affected by the Beacon incident to consider their Serious Incident Reporting obligations and any reporting requirements to other regulators.

How Stephens Scown Can Help

Cyber incidents often require trustees to make important decisions quickly and before all the facts are known.

Our Charity and Data Protection teams can help by:

  • Assessing whether an ICO or data subject notification is legally required.
  • Advising on Serious Incident Reporting to the Charity Commission.
  • Preparing regulatory notifications and reports.
  • Supporting trustee decision-making and governance processes.
  • Advising on communications with supporters, beneficiaries and stakeholders.
  • Liaising with regulators, insurers and cyber security specialists.
  • Reviewing data protection, supplier and governance arrangements following the incident.

We regularly advise charities on governance, regulatory compliance, serious incident reporting and data protection issues and can provide practical support throughout the response process.

Need Advice?

If your charity uses Beacon CRM and is concerned about the impact of the incident, please get in touch with a member of our team by calling 0345 450 5558 or by emailing [email protected]

This article has been jointly written by Laurie Trounce, Partner and joint head of Corporate team, and Leanne Yendell, Solicitor, Intellectual Property, Data Protection and Technology team.