Walk through any museum or gallery and your attention goes straight to what is on display. That is exactly how it should be. But behind the ticket desk and the donation kiosks, most cultural institutions are quietly running a data operation that carries real legal weight. Visitor booking records, membership databases, donor correspondence, Gift Aid declarations linked to individual tax details - this is personal data in scope of UK GDPR, and the ICO holds museums and galleries to the same standard as any other organisation that processes it.
A data breach that exposes a membership list or a Gift Aid database does not get treated more leniently because it happened at a charity or a public institution. The obligation is straightforward: put appropriate technical and organisational measures in place to protect the data you hold. What that looks like in practice is where many smaller museums and galleries are still finding their feet.
What Personal Data Does a Typical Museum Actually Hold?
It is worth mapping this out, because the volume is easy to underestimate when it is spread across several systems that were never designed to talk to each other:
- Online ticketing platforms holding names, email addresses and sometimes payment card data
- CRM and membership systems storing names, postal addresses, giving histories and communication preferences
- Gift Aid records that link individual donors to their tax declarations - data with direct financial implications for the people involved
- Collection management software that may sit on the same network as visitor-facing systems
- Staff email accounts and shared drives containing donor correspondence, contractor details and internal financial records
Each of those is a potential entry point for an attacker, and a potential source of real harm to the individuals whose details sit inside it.
A Practical Cyber Security Checklist
The following covers the technical and organisational controls the ICO would reasonably expect to see in place. It is a working starting point, not an exhaustive legal guide - but it gives a clear picture of where the gaps are most likely to be.
1. Map What You Hold and Where It Lives
You cannot protect data you have not documented. Start by listing which systems hold personal data, who administers them, and how long records are kept. Ticketing platforms and CRM tools have a habit of accumulating entries long after the individual relationship has ended. A clear retention policy - and the habit of actually acting on it - reduces your exposure without any technical investment at all.
2. Keep Everything Patched and Up to Date
Unpatched software is one of the most consistently exploited attack paths in small and medium-sized organisations. This applies to your ticketing platform, membership database, staff laptops and the networking equipment on site. Critical patches should be applied within 14 days - which is also one of the five technical controls required for Cyber Essentials certification and a reasonable benchmark to work to regardless of whether you are pursuing the certification itself.
3. Control Who Can Access What
Not everyone on your team needs access to donor giving histories or Gift Aid records. Apply least-privilege access across your systems - staff get the data their role requires, and nothing more. Review access when people change roles or leave, and make multi-factor authentication mandatory on any account that can reach personal data, especially cloud-based platforms accessed remotely.
4. Back Up Your Data and Actually Test the Restore
Ransomware attacks against cultural and charitable organisations do happen, and the consequences of losing donor records or membership data mid-campaign can be severe. Regular, tested backups stored separately from your primary systems - somewhere an attacker who has compromised your network cannot also reach and encrypt - are a basic expectation under the integrity and confidentiality requirements of UK GDPR. The critical word is tested: a backup you have never restored from is an assumption, not a safety net.
5. Train Your Staff on the Basics
The most carefully configured technical controls can be bypassed by a single convincing phishing email. Security awareness training does not need to be long or technically demanding - short, regular sessions on recognising phishing, using strong passwords and knowing how to report something suspicious make a measurable difference. The ICO will ask about training as an organisational measure following any incident, so it is worth having something in place and being able to evidence it.
6. Have a Plan for When Something Goes Wrong
Under UK GDPR, a personal data breach that is likely to result in risk to individuals must be reported to the ICO within 72 hours of becoming aware of it. That is a tight window if there is no plan in place. A basic incident response document covering who decides whether something is reportable, who contacts the ICO, and how affected individuals are notified does not need to be lengthy - it just needs to exist and be known to the people who will have to act on it at short notice.
Cyber Essentials as a Practical Baseline
The ICO does not mandate a specific framework, but it consistently refers to recognised standards when assessing whether appropriate measures were in place. Cyber Essentials certification covers five control areas - boundary firewalls, secure configuration, access control, malware protection and patch management - that address the technical vulnerabilities most likely to result in a breach. For a museum or gallery, working through those five controls does two things at once: it closes the most common attack paths, and it produces documented evidence of due diligence that carries real weight if the ICO ever investigates an incident.
If you want to understand how these controls map to the specific systems and risks that cultural institutions face, the CyberStark Museums and Galleries page sets out the practical picture in more detail.
A Practical Takeaway
Start with one honest question: if an attacker accessed your ticketing platform or CRM today, what data could they reach, and how quickly would anyone know? If the answer is uncertain, that uncertainty is the gap worth addressing first. A structured security review does not require a large budget or a specialist in-house team - and the effort involved is considerably lower than managing an ICO investigation or explaining a breach to several thousand donors.