The Trustee's Guide to Digital Governance

Digital governance is not a technology topic. It is a leadership topic. And in 2026, it has moved from something boards can reasonably deprioritise to something they cannot afford to ignore. The Charity Governance Code - refreshed in November 2025 in its most significant update in eight years - now explicitly requires boards to consider technology and AI risk as part of their governance responsibilities. The Charity Commission has stated clearly that trustees who fail to ensure adequate oversight of digital and data practices may not be meeting their legal duties.

The ICO is enforcing against charities where governance has been delegated rather than owned.

This guide is a practical introduction to what digital governance means at board level, and what a trustee needs to understand in order to discharge their responsibilities confidently.

What Digital Governance Actually Means

Digital governance is the set of decisions, structures, and accountabilities that determine how your organisation uses technology and how it manages the risks that come with it.

It covers three overlapping areas:

• Data governance - what personal data you hold, why you hold it, how it is protected, and how long you keep it. This is the territory of UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

• Technology governance - how decisions about digital tools and systems are made, who has authority to approve them, and how risks associated with them are identified and managed.

• AI governance - how AI tools are used across the organisation, what safeguards are in place, and how the board maintains meaningful oversight of their use and impact.

None of these areas requires a trustee to have technical expertise. What they require is the same thing all good governance requires: clear accountability, documented decisions, and a willingness to ask the right questions.

Three Questions Every Board Should Be Asking

What personal data does our organisation hold, and what are we doing with it?

This is the foundation of data protection compliance. Your charity should have a Record of Processing Activities - a document that maps what data you hold, why you hold it, what legal basis you rely on, and how long you keep it. If your board has never seen this document, or does not know whether it exists, that is the first thing to address.

Who in our organisation is using AI tools, and how?

According to the 2025 Charity Digital Skills Report, 76% of UK charities are now using AI tools. In most organisations, that adoption has happened faster than the governance around it. Staff are using AI assistants, transcription tools, and writing aids often without formal policy, without board knowledge, and sometimes without awareness of the data protection implications. The board's job is not to prohibit this use but to ensure it is governed.

If something went wrong tomorrow, could we demonstrate that we took reasonable steps?

This is the accountability principle of UK GDPR in plain English. The ICO does not expect perfection it expects evidence that an organisation understood its obligations and took proportionate steps to meet them. That evidence is documentation: policies, training records, risk assessments, board minutes that show the right conversations were had. If your board could not produce that evidence today, that is the gap to close.

What Good Digital Governance Looks Like in Practice

Good digital governance does not require a dedicated board committee or a trustee with a technology background though both can help. At its most basic, it looks like this:

• Data protection appears on the organisational risk register, is reviewed at least annually, and is reported to the board.

• The organisation has a named person responsible for data protection, and the board knows who that is.

• There is a policy covering AI use that staff are aware of, and the board has approved it.

• When new technology is introduced such as a new CRM, a new case management system, a new AI tool the data protection implications are assessed before deployment, not after.

• The board's minutes demonstrate that these questions have been asked and answered, not just assumed.

None of this is technically complex; all of it is genuinely protective for your beneficiaries, for your staff, for your funders, and for the trustees themselves.

Where to Start

If your board has not had a substantive conversation about digital governance in the past 12 months, the place to start is a structured self-assessment. The ICO provides free tools for small charities at ico.org.uk. The Charity Governance Code's self-assessment framework is another useful starting point.

The most common finding from that kind of review is not that the organisation is doing everything wrong it is that the governance is informal and undocumented. The work required is usually less about changing practice and more about making existing good practice visible, recorded, and owned.

If your board is not sure where to start, a 30-minute conversation is often enough to identify the two or three things that would make the most material difference. That conversation costs nothing, the absence of it can cost considerably more.