How should charities manage volunteers' personal phones and laptops?

Why are volunteers' devices a different problem?

Staff get charity laptops. Volunteers usually don't. They answer the helpline rota from their own phone, update records from a family laptop and check the shared calendar on a tablet their grandchildren also use. You can't insist on managing those devices: most volunteers would, reasonably, refuse to let a charity wipe their phone.

But the data is still yours. Under UK GDPR, the charity remains responsible for the personal information it holds about service users, donors and staff, wherever it is opened, and the ICO expects organisations to think through the security of personal devices used for work (ICO). And 28% of UK charities reported a cyber breach or attack in the last 12 months (DSIT, 2026).

There's a Cyber Essentials twist that many charities miss. In the current requirements, devices owned by volunteers and trustees are out of scope for the assessment, while staff-owned devices that access charity data are in scope. The scheme is equally clear that for devices out of scope, "your organisation is still responsible for confirming that the devices interacting with organisational services and data are configured correctly" (NCSC, April 2026). Out of scope for the certificate doesn't mean out of mind.

What can you control without managing the device?

Quite a lot, if you use Microsoft 365 Business Premium or have Intune and Microsoft Entra ID P1 separately.

App protection works on devices that aren't enrolled in device management. Microsoft designed it so that policies apply only in a work context, leaving personal apps and data alone (Microsoft Learn). On Windows, Intune app protection in Microsoft Edge lets you secure charity data on a personal PC that isn't enrolled in device management (Microsoft Learn).

Browser-only access is the simplest control for laptops. When you limit access from unmanaged devices, users get browser access with no ability to download, print or sync files (Microsoft Learn). A volunteer can still work on a spreadsheet of service users. They just can't end up with a copy of it in their Downloads folder.

What should a volunteer device agreement say?

Keep it to one page, in plain English, and ask volunteers to sign it when they're set up. The NCSC's guidance on bring your own device warns that if the rules are too heavy, people work round them with unsanctioned apps (NCSC). Short and reasonable works better.

Volunteer device checklist

• The device has a screen lock (PIN, fingerprint or face) and it's switched on.
• The operating system and apps are kept up to date, and the device still gets security updates.
• Charity information is only opened in the approved apps (Outlook, Teams, OneDrive) or in the browser.
• Charity data is never saved to personal cloud storage, email or messaging apps.
• Screenshots of service user information aren't taken or shared.
• Nobody else uses your charity account, including family members on a shared device.
• A lost or stolen device is reported to the charity the same day.
• When you stop volunteering, the charity will remove your access and charity data from your apps. Your personal data isn't affected.

The last line matters. Volunteers are far happier to agree when they understand exactly what the charity can and can't see or delete.

What about accounts, WhatsApp groups and leavers?

One person, one account. Shared logins, such as a single volunteers@ mailbox, make it impossible to tell who did what, use multi-factor authentication (MFA) properly or remove one person. Give each volunteer their own account, with MFA, even if they only work a few hours a month.

Move service user conversations out of WhatsApp. Many volunteer teams coordinate on WhatsApp groups on personal phones. That's fine for rota swaps. It isn't a place for names, addresses or case notes, because the charity can't remove that data when someone leaves. Use a Teams chat or channel, which sits under app protection.

Leavers. Volunteers often drift away rather than resign. Ask coordinators to confirm their active list every quarter, and treat anyone who hasn't worked a shift in three months as a leaver: block the account, remove the licence and wipe charity data from their apps. Our article on what should happen to a leaver's email, files and phone number covers the detail.

Worked example: a befriending charity with 60 volunteers

Example (an illustration, not a real client): a Glasgow befriending charity has 8 staff and 60 volunteers who phone older people each week. Volunteers keep call notes in a shared spreadsheet and chat in a WhatsApp group.

The charity gives each volunteer their own account with MFA. Volunteers' phones use Outlook, Teams and OneDrive under app protection, so notes can't be copied into personal apps. The call notes spreadsheet moves to a SharePoint site set to browser-only for unmanaged devices, so volunteers on home laptops can update it but not download it. The WhatsApp group stays for rota changes only, and anything about a person they support goes in a Teams channel. Every volunteer signs the one-page device agreement at induction.

When a volunteer moves away, the coordinator logs it, and the account is blocked and charity data wiped from her phone's apps that afternoon. Her photos and messages are untouched. The trustees get a one-line report each quarter: active volunteers, accounts removed, and any lost devices.

How Indigo does this. Indigo Unified Communications supports 30+ charities and third sector organisations from our Glasgow office. Our Charity package includes Microsoft 365 Business Premium licences, which include Intune and conditional access, and a 24/7 security operations centre (RocketCyber), a dedicated security team watching your systems. We set up volunteer accounts, app protection and browser-only access, and we support any organisation that wants Cyber Essentials. Whether volunteers need Business Premium licences is decided charity by charity, and we'll advise on the right licence for each role. IT support for charities →

What to do next

1. List the devices volunteers use for charity work: phones, personal laptops, shared computers.
2. Give every volunteer their own account with MFA, and close any shared logins.
3. Turn on app protection for phones and browser-only access for unmanaged laptops.
4. Write and circulate a one-page device agreement, using the checklist above.
5. Read our charity guide chapter on remote and volunteer working, or book an assessment and we'll review your set-up.