Data privacy basics for small charities

This guide is for anyone at a small charity who handles names, addresses, phone numbers, donation records or notes about the people you serve. That is almost everyone. You don't need to be a lawyer or an IT expert to protect people's information well. After reading, you will know the few habits that prevent most privacy problems, how to treat donor and client data, and when to get legal advice.

Why privacy matters for charities

People trust you with information they might not share anywhere else: their health, their housing situation, their immigration status, their giving. If that information leaks or is misused, it can cause real harm. It can also end the trust that your whole charity runs on.

Personal information (also called personal data) means any information that can identify a person, alone or combined with other details. Names, emails, phone numbers, addresses, birth dates, photos and case notes all count.

The FTC's five key ideas

The Federal Trade Commission (FTC) publishes a free guide called Protecting Personal Information: A Guide for Business. Its five principles work just as well for charities:

1. Take stock. Know what personal information you have, and where it is: paper files, spreadsheets, email, phones, apps.
2. Scale down. Keep only what you need.
3. Lock it. Protect what you keep.
4. Pitch it. Properly dispose of what you no longer need.
5. Plan ahead. Have a plan for responding to security incidents.

Collect less

The safest data is data you never collected. For every form, ask: "What will we actually do with this answer?" If there is no clear use, remove the question.

• A newsletter sign-up usually needs an email address and maybe a first name.
• An event RSVP rarely needs a home address or birth date.
• A food program may need household size, but does it need full names of every child?

Ask for consent, and mean it

Consent means a person understands what you will do with their information and agrees to it freely.

• Tell people, in plain words, what you collect and why, at the moment you collect it.
• Ask separately for different uses. Agreeing to receive services is not agreeing to be in a newsletter story.
• Make "no" easy and safe. Nobody should feel they must share data to get help they need, unless it is truly required.
• Let people change their mind, and act on it.
• Write a short privacy notice for your website and forms that matches what you actually do.

Donor data

Donor records usually include names, contact details, giving history, and sometimes notes about interests or family. Treat them with care:

• Never sell, rent or swap your donor list. Say so in your privacy notice, and keep the promise even if someone offers money.
• Keep notes factual and respectful. Write as if the donor could read them one day.
• Respect requests to be anonymous. Some donors don't want their name in your annual report or on a wall.
• Limit who can see full donor records. A volunteer making thank-you calls may only need a name and phone number.
• Use a trusted payment provider. Don't store full card numbers yourself, ever.

Sensitive data about the people you serve

Some information is especially sensitive: health and mental health, disability, immigration status, criminal history, sexual orientation or gender identity, religious beliefs, abuse history, and anything about children.

Practical safeguards:

• Need to know. Only the people who must use the information can see it.
• Separate storage. Keep case notes apart from your general shared files.
• Locked and encrypted. Paper in a locked cabinet. Digital files in accounts with strong passwords and two-step login. Phones and laptops with a screen lock.
• No personal accounts. Volunteers shouldn't keep client data in their personal email or phone notes.
• Safe disposal. Shred paper. Delete digital files properly, and wipe old devices before you give them away.

If you provide health care, legal services or work funded by government contracts, other privacy rules may apply to you. Your funder or a lawyer can tell you which.

State privacy laws vary

There is no single national privacy law that covers every charity in the United States. Instead, states have their own laws, and they differ.

• Breach notification: the FTC says all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information. Details and deadlines vary.
• Consumer privacy laws: a growing number of states have broader privacy laws that give people rights over their data. Many cover only businesses, but some also cover nonprofits. For example, the Oregon Department of Justice says Oregon's consumer privacy law applies to for-profit and nonprofit organizations that meet its thresholds.

The rules depend on where the people in your records live, not only where your charity is based. If you hold data on many people, or on people in several states, check with your state attorney general's office or a lawyer.

If something goes wrong

A data breach is when personal information is lost, stolen or seen by someone who shouldn't see it. A laptop left on a bus counts. So does an email sent to the wrong list.

• Act quickly to stop further exposure.
• Write down what happened and when.
• Tell your board chair, your insurer and a lawyer.
• Follow the FTC's data breach guide and your state's notification law.
• Tell affected people honestly what happened and what they can do.

See our crisis communications guide for how to talk about it.

Your privacy checklist

• List what personal information you hold and where it is stored
• Remove form questions you don't truly need
• Write a plain-language privacy notice that matches what you do
• Promise never to sell or share your donor list, and keep the promise
• Limit access to sensitive records to people who need them
• Turn on two-step login and screen locks everywhere
• Set a schedule to shred or delete old records
• Write down who to call if data is lost or stolen

Good privacy is mostly good habits. Collect less, lock it up, share only with care, and treat every record as if it were your own family's.

If you want someone to review your forms or privacy notice, ask a member charity for help through the Exchange.

General information, not legal, tax or financial advice. Rules change and every situation is different, so check the official sources and talk to a qualified professional before you act.