A charitable organisation wanting to self-report

Jump to section

Jump to heading

Raising concerns as a fundraiser, trustee or charity employee ​

Fundraisers and others working for a charity can: ​

  • Self-report if they are aware of a known or potential breach of the code and have the authority to report this on behalf of their organisation. Please use our self-reporting tool if this applies to you.​

  • Make a complaint as an individual if they feel they have been pressured to act in a way that is not in line with the code. Please read our section on whistleblowing as this may apply to you. If you no longer work for the charity, or are a volunteer, this isn’t likely to be applicable, but you can still complete our complaints form. ​

We cannot consider self-reports or complaints from whistleblowers about charities which are only registered in Scotland.

About self-reporting

About self-reporting

The person completing our self-reporting form must have the appropriate level of responsibility to make the report on behalf of the organisation. For example, you will be in a senior role or be instructed to report the incident by your senior management or trustees.​

  • If your organisation is a charity registered with the Charity Commission, we would expect you to inform your trustees about the incident before contacting the Fundraising Regulator.​

  • If your organisation is a third-party fundraiser that raises funds on behalf of a charity, we would expect you to discuss with your charity partners whether it is more appropriate for them to lead on self-reporting, or for your organisation to make a report, depending on the nature of the incident.​

  • In addition to those working for registered charities, if your organisation is a fundraising Community Interest Company (CIC) or a company working with registered charities, you may also wish to report potential issues, as these could fall within our scope. ​

We ask organisations to report incidents where they consider:​

  • the incident relates to charitable fundraising​

  • they have, or may have, breached the fundraising standards in the code; and ​

  • where these breaches have posed an actual or potential risk to the public, the charity sector, or public confidence in fundraising more generally.

Our self-reporting form will ask for:​

  • your contact details​

  • details about the organisation you are reporting on behalf of, including your registered charity, company or CIC number and office address(es)​

  • information about the incident, including when and where it took place​

  • information about any action taken in response, including reports to other regulatory or relevant bodies; and​

  • If you can also upload documents as supporting evidence and highlight any specific areas you would like help and support with. 

  • Our casework team will assess the information you provide, including information about any steps you have taken to resolve the incident and prevent future occurrences. If appropriate, we will provide or signpost you to further advice or guidance. ​

  • Our approach will be fair and proportionate in handling these cases, and in most circumstances formal regulatory action will not be necessary. In exceptional cases where we do need to take action, we will consider that a charity has demonstrated its openness and desire to put things right when deciding our next steps.​

  • Information received in self reports will be looked at as we would with any other complaints or intelligence and may result in a compliance case or investigation.​

We appreciate organisations may be obliged to report to a number of regulatory bodies, depending on the circumstances of an incident. For example:​

You may also want to report issues to other similar sector bodies. For example: Report Fraud, the national fraud and cybercrime reporting centre.​

If you need to report or have already reported the incident to another body, please let us know. We can speak with directly with the other organisation(s) if needed.​

Fundraising method/s: Addressed mail​

Code theme/s: Handling personal data​

What happened?​

The charity sent a mailing to supporters with a donation form which was pre-populated with donor contact details. The data included information about the amount of regular gift donated and the supporter’s name, address and email address, where known. The data on the form was printed incorrectly. This meant supporters received another person’s data.​

How did the organisation respond?​

The organisation reported the personal data breach to the Information Commissioner’s Office (ICO). They self-reported to the Fundraising Regulator to confirm they had responded to any complaints received from supporters, investigated the reasons why the breach happened and had amended their internal procedures to prevent this happening again in the future.​

Our response​

The organisation correctly recognised that they had breached the code in relation to handling personal data and reported to the appropriate regulators. The information provided reassurance that the incident was being dealt with appropriately and further investigation by the Fundraising Regulator would not be required.​

Jump to section