What Should a Charity's Safeguarding Page Let People Do?
Key takeaways
- The Charity Commission says trustees must take reasonable steps to protect people who come into contact with their charity from harm, and that safeguarding policies and procedures should be available to the public.
- FCDO's SEAH guidance says the partners it funds should make beneficiaries and local stakeholders aware of their policies, including how and where to raise a concern, and should let people outside the organisation raise concerns confidentially.
- A safeguarding page should let a person find the policy, reach a named lead, report a concern, see the external routes and see what partners are held to.
- A safeguarding report can carry special category data and, according to the ICO, allegations of criminal activity count as criminal offence data even when unproven, so the form is among the most sensitive routes on the site.
- Decide where each report lands, who can read it and what happens out of hours before the form goes live: the notification email, the shared inbox and the form provider's database are all copies of the report.
- In the Charity Commission's 2026 research in England and Wales, 21% chose keeping staff, volunteers and service users safe from harm as a driver of their trust in a charity.
Summary
A safeguarding page should let a person do five things: find the policy, reach a named lead, report a concern safely, see the external routes and see what your partners are held to. The Charity Commission says safeguarding policies should be available to the public, and FCDO expects the partners it funds to make their policies known and to give people outside the organisation a confidential way to raise concerns. The hardest part is the report route, because a form that collects allegations of abuse holds some of the most sensitive data a charity will ever receive. This post covers the page and the route, not your safeguarding procedure.
The Short Answer
A safeguarding page should let a person do five things:
- Find your policy.
- Reach a named person responsible for it.
- Report a concern safely: anonymously where you can allow it, in their own language and from wherever your work happens.
- See who else they can go to.
- See what your partners are held to.
Most safeguarding pages are written to prove a policy exists. They are read by someone who needs to tell you something.
The section checklist carries this as two rows: the safeguarding page itself, and a partner page that sets the standard across the delivery chain. The page is short. The route behind it is where the work is.
Why the Page Is Expected
The Charity Commission's guidance on safeguarding and protecting people says trustees "must take reasonable steps to protect from harm people who come into contact with your charity". It says a charity's policies and procedures should be:
- "available to the public";
- reviewed "at least once a year" and after any serious incident.
Its section on operating online adds that a charity should "clearly explain how users can report online concerns".
None of this names a website, and "should" is a regulator's expectation rather than statute. But a policy the public can reach and a route they can use are hard to provide anywhere else.
For international work, FCDO's SEAH due-diligence guidance applies to organisations funded through an Accountable Grant or Memorandum of Understanding. It says they:
- "should make beneficiaries and other local stakeholders aware of their policies and procedures", including "how and where to raise a concern about SEAH and what to expect";
- should let people outside the organisation raise concerns through "a mechanism through which to input confidentially".
Again "should", and no web page is required, but it is what FCDO will ask you to show.
The public notices this less than the funder does. In the Charity Commission's Public trust in charities 2026 (England and Wales), 21% chose keeping staff, volunteers and service users safe from harm as a driver of their trust. Asked whether the charities they know actually do it, 15% said they did not know.
A page is how someone finds out.
Five Things the Page Must Let Someone Do
1. Find the policy
A short summary in HTML, the full policy linked beneath it and the date it was last reviewed.
The guidance expects a yearly review, so a policy dated three years ago tells a reader something whether or not it has changed.
2. Reach a named lead
The guidance tells charities working with children or adults at risk to "appoint a safeguarding lead". FCDO expects a designated safeguarding officer at board level, with a network of leads for larger organisations working in several places.
Give the role and a contact someone monitors. For an international organisation that may mean a contact per country or region, not one inbox in London.
3. Report a concern
Offer more than one way in, because FCDO asks for "multiple methods and channels" where possible:
- a form;
- an email address;
- a phone number;
- where your programmes run, a person.
Say whether a report can be anonymous, and say it truthfully. Complaints and speak-up routes sets the rules for stating anonymity across every route and covers the whistleblowing route for staff. Link to it; do not repeat it.
Language is part of the route too. A reporting page that exists only in English can shut out the people an international programme serves. A translated page that is a year behind the English one gives out old contacts. Multilingual website governance covers who keeps translations current.
Concern Worldwide's safeguarding page puts a "Report a safeguarding Concern" block beside its policies, stating that "all complaints are taken seriously, whether anonymous or not". I loaded it on 30 September 2026.
4. See the external routes
A person may not want to report to you at all. Say what to do if someone is in immediate danger, and name the bodies that take reports from outside:
- The Charity Commission. Its guidance says anyone who works or volunteers for a charity "can also report it to us using our whistleblowing procedure".
- FCDO, for FCDO-funded work. Its own Reporting Concerns route, where the guidance says "it is possible to report concerns anonymously".
- Local routes in programme countries, with an owner who checks they still work.
5. See what partners are held to
The Commission's guidance says a charity "must make sure that any grant recipient or partner body is suitable" and that partners "must have appropriate safeguarding procedures in place".
FCDO asks funded organisations whether they share their safeguarding policy with downstream partners. That is a question answered to the funder, not a duty to publish. The easiest way to show the answer is yes is a partner page with:
- your minimum standards;
- the training you offer;
- how to report a concern about you or about a partner.
The guidance makes safeguarding one of five pillars FCDO assesses partners against. What a website can answer for the other four is in what an NGO's website can answer before FCDO due diligence.
The Report Form Is a Data Problem
Everything above is content. The report route is infrastructure, and it fails quietly.
What the form receives
Few routes on a charity website carry anything as sensitive:
- A report can describe someone's health, sex life or sexual orientation, which are special category data under Article 9 of the UK GDPR.
- It usually describes an allegation against a named person. The ICO says criminal offence data under Article 10 covers "suspicion or allegations of criminal activity", including unproven ones.
Where a submission goes
Every step makes a copy of the report, readable by whoever can open it:
- It is stored by the form provider, usually a processor your charity needs a contract with under Article 28(3).
- It triggers a notification email.
- That email lands in an inbox, which may be shared, which syncs to phones.
I would make the notification say only that a report has arrived. Keep the report itself in one place, with access limited to the people named to handle it.
Who can read it
If every report reaches one person, a report about that person reaches them first. FCDO's guidance says there should be "a process to follow if the concern is being raised against an individual in the organisation who manages internal complaints or concerns". The website has to support that process.
Give the form a second recipient outside that line, or a route that bypasses the usual handler, and say on the page that it exists.
Anonymous has to mean anonymous
A form that says it does not need a name is collecting what the page promised it would not if it:
- requires an email address;
- logs the sender's IP address;
- fires an analytics tag on its confirmation page.
Check what the platform records, not only what the form asks.
Out of hours
Picture a report submitted late on a Friday from a programme country. If nobody reads the inbox until Monday, the page needs to say so, and say what to do if someone is at risk now.
The guidance tells charities to "act quickly" when an incident or allegation arises. A form cannot do that, but it can tell the person honestly when it will be read and where to go in the meantime.
Retention and form design
The privacy notice at the point of collection, the field design and keyboard access are covered in form design for nonprofit websites. How long reports are kept is a decision for your safeguarding lead and your data protection lead. The website's job is to enforce it.
Who Owns It
The safeguarding lead owns what the page says. Whoever runs the website owns whether the route works.
Both need a review date. Every change to the form, the platform, the inbox or the people who answer it needs a test submission, read by the person it is meant to reach. FCDO expects safeguarding to be reported to the board, so the route's last test date is worth a line in that report.
Translations need the same discipline. When a contact, a phone number or a local route changes, every language version changes the same day, or the page is wrong in the languages that matter most.
A policy PDF shows that you have a policy. A route that works on a Friday night, in the reporter's language, shows that you meant it.
Further Reading
- Section 82: Safeguarding
- Section 49: Safeguarding for partners
- Complaints and Speak-Up Routes: What a Charity Website Needs, and What Is Required
- Form Design for Nonprofit Websites
- Multilingual Website Governance for International NGOs
- What Can an NGO's Website Answer Before FCDO Due Diligence Starts?
- Safeguarding in Digital Communications
What This Post Does Not Cover
This is about the page and the route: what they let a person do, where reports land and who keeps them working.
It is not advice on your safeguarding procedure, including how to assess, investigate or refer a concern and when to report to the authorities. That belongs with your safeguarding lead and specialist advisers. It is not legal advice on data protection; your data protection lead decides the lawful basis and retention.
Consent for the stories and images of people you work with is a different safeguarding question, covered in safeguarding in digital communications.
Two clicks. Three things.
Send the address of your website. Within two working days you get a short email naming the three things a funder would hold against it, including what AI assistants like ChatGPT and Google’s AI Overviews currently say about you. No report, no call, no follow-up unless you ask.
Received. Your three things arrive within two working days.
That did not send. Email hello@socialectric.com with your website address and I will reply from there.
Frequently asked questions
- Do we have to publish our safeguarding policy on our website?
No statute requires it. The Charity Commission's safeguarding guidance says a charity's policies and procedures for protecting people should be "available to the public", a regulator's expectation rather than a legal duty, and the website is the simplest way to meet it. The section checklist tags the page Conditional for FCDO-funded partners and a firm regulator expectation for everyone else.
- Should our safeguarding report form accept anonymous reports?
That is a decision for your safeguarding lead, not your web team. FCDO accepts anonymous reports to its own Reporting Concerns route, so it can be done. Whatever you decide, the page must say it truthfully and the form must match. Complaints and speak-up routes covers how to state anonymity across all your routes.
- Should the page name our safeguarding lead?
It should give a role and a contact that a person actually monitors. Adding the person's own name is a judgement about their safety, particularly for staff in programme countries. FCDO's SEAH guidance says larger organisations working in several locations are likely to need a network of safeguarding leads, so an international page may need a lead per country or region.
- Can the report form simply email the safeguarding lead?
It can notify them, but keep the report itself in one restricted place. The ICO says criminal offence data includes suspicion or allegations of criminal activity, and every email copy is another place such a report can be read or forwarded. The form-level fixes are in form design for nonprofit websites.
- What should the page tell our partners?
Your minimum standards, how a partner's staff or a community member can report a concern about you or the partner, and the training you offer. The Charity Commission's guidance says grant recipients and partner bodies must have appropriate safeguarding procedures in place. The partner safeguarding row of the section checklist sets out the content.