What This Guide Covers

This guide provides a complete roadmap for securing your non-profit’s most valuable asset: your donors’ trust. You will learn how to identify the specific donor information you collect and understand why it makes you a target for opportunistic attacks. We will walk through choosing secure online donation tools that handle the heavy lifting of payment security for you. This guide also provides a low-cost IT security checklist covering passwords, software updates, and data access controls for your entire team. You will understand the critical role of training your staff and volunteers to recognize common threats like fraudulent emails. Finally, we will outline a simple, actionable plan for what to do immediately if you suspect a data breach has occurred.

Why Small Non-Profits Must Protect Donor Data? (It’s Not Just for the Big Guys)

When you think of data breaches, you probably picture massive corporations or hospitals. The reality is that small organizations, especially non-profits, are attractive targets. The issue isn’t that you’re facing off against sophisticated international hacking syndicates; it’s that you’re vulnerable to common, automated attacks that prey on organizations with limited IT resources.

The core issue here is trust. Your relationship with your donors is built on the belief that you are responsible stewards of their contributions and their personal information. A data breach, even a small one, can shatter that trust in an instant. The damage isn’t just a technical problem; it can be an existential threat to your fundraising and your mission.

Beyond trust, there are practical and legal responsibilities. Various laws and regulations govern how organizations must handle personal information. While you may not be subject to massive international rules like the General Data Protection Regulation (GDPR) unless you have donors in Europe, the underlying principle is universal: if you collect data, you have a duty to protect it. The U.S. Federal Trade Commission (FTC) has broad authority to act against organizations that fail to implement reasonable data security, as outlined in their data security guidance for businesses.

The financial impact of a breach can be devastating for a small non-profit. The cost isn’t just about potential fines. It’s about the expense of investigating the incident, notifying donors, offering credit monitoring, and, most significantly, the long-term loss of future donations from supporters who no longer trust you. Protecting donor data isn’t an IT expense; it’s a fundamental part of mission sustainability.

What Donor Data Do You Actually Have? (Know Your Treasure)

You can’t protect what you don’t know you have. The first step is to get a clear picture of the donor information your organization collects and stores. This doesn’t require a complex, formal audit. It starts with a simple inventory.

First, understand the types of data. The most common category is Personally Identifiable Information (PII), which is any data that can be used to identify a specific person. This includes the obvious things:

• Full Name
• Home Address
• Email Address
• Phone Number

You likely also hold more sensitive information related to their support of your cause. This can include donation amounts and dates, event attendance, volunteer history, and personal notes from conversations. This combination of personal and financial data is highly valuable and what you must focus on protecting.

The guiding principle here should be data minimization. Only collect and keep the information you absolutely need to operate. Do you need to ask for a donor’s birthday on your donation form? If not, remove the field. The less data you hold, the less risk you have.

Your next step is to map out where this data lives. Grab a notebook or open a spreadsheet and list every place you store donor information. Be thorough. Common locations include:

• Donor Management Software: A cloud-based system like Little Green Light, DonorPerfect, or Bloomerang.
• Spreadsheets: Excel or Google Sheets files saved on local computers or shared drives. This is a very common and high-risk storage method.
• Email Marketing Services: Systems like Mailchimp or Constant Contact that hold lists of names and email addresses.
• Accounting Software: QuickBooks or other systems that track donations and donor names.
• Physical Files: Paper donation forms, event sign-in sheets, or printed reports stored in filing cabinets or on desks.
• Personal Devices: Staff or board members who have downloaded donor lists to their personal laptops or phones.

Once you have this map, you have a clear scope of what needs to be secured. You can see which systems are critical and which informal storage methods (like spreadsheets on a desktop) need to be eliminated.

Before You Start

• Make a list of every staff member, board member, and volunteer who currently has access to your master donor list.
• Go to your online donation page and verify that your payment processor (e.g., Stripe, PayPal, Classy) is named and that they state they are PCI DSS compliant.
• List all the software programs or cloud services where donor names and contact information are stored (e.g., QuickBooks, Mailchimp, Google Drive, OneDrive, DonorPerfect).
• Check your website’s address bar. Confirm that it starts with “https://” and shows a lock icon, indicating you have a valid SSL certificate.
• Ask your team how they create and store passwords. Find out if anyone is using a password manager or if passwords are on sticky notes or in a shared document.
• Walk through your office and locate any physical papers, forms, or printouts that contain donor names, addresses, or donation amounts.
• Ask your most active volunteer if they have ever received any guidance or training from you on data privacy or spotting scam emails.

How Can We Secure Online Donations and Records? (Outsource the Hard Part)

The single most important rule for a small non-profit is this: never, ever store raw credit card numbers on your own systems. The security requirements for handling this data are incredibly complex and expensive to meet. The good news is that you don’t have to.

Your strategy is to outsource this risk to a company built to handle it. Use a reputable, third-party payment processor for all online donations. This includes well-known names like Stripe, PayPal, and Square, as well as donation platforms like Classy, Givebutter, or Network for Good that have these processors built in.

These services are compliant with the Payment Card Industry Data Security Standard (PCI DSS). In simple terms, PCI DSS is the rulebook for securely handling credit card information. By using a compliant processor, you shift the primary responsibility for securing the card data to them. When a donor types their credit card number into your donation form, that information goes directly to the processor’s secure servers, bypassing yours entirely.

Many processors use a technology called “tokenization.” They take the donor’s actual card number and replace it with a meaningless string of characters—a token. That token is what’s used to reference the transaction in your records. Even if your donor database were compromised, the attackers would only find useless tokens, not actual credit card numbers they could steal and use.

Your responsibility is to ensure the connection between the donor’s web browser and your website is secure. This is achieved with a Secure Sockets Layer (SSL) certificate, which enables HTTPS (the ‘s’ stands for secure). This encrypts the data in transit, so it can’t be intercepted. If your website address starts with https:// and has a lock icon in the browser, you have this covered. Modern web browsers will make it pretty obvious when a connection is not secure.

For your main donor records—your donor management system or Customer Relationship Management (CRM) software—the same principle applies. Use a reputable cloud-based provider. They are responsible for securing the physical servers, network, and underlying infrastructure. Your job is to secure the access to that system through strong user permissions and passwords.

Simple IT Security for Donor Data: What’s Essential? (Digital Housekeeping)

With payment processing outsourced, your focus shifts to protecting the PII in your other systems. Good security is about building layers of simple, consistent habits. Here are the non-negotiable essentials, all of which are low-cost or free.

1. Control Who Has Access

The most important security principle is the “principle of least privilege.” This means each person should only have access to the absolute minimum information required to do their job. Giving everyone on your team access to all donor data is like giving every employee a master key to the entire building. The volunteer at the event check-in desk only needs a list of names, not their full donation history.

Here’s what to do:

1. Review User Accounts: Go into your donor CRM, email marketing tool, and accounting software. Look at every single user login account. If a person is a former employee, board member, or volunteer that no longer works with your organization, disable their account immediately.
2. Create Roles: If your software allows, create different user roles. An “Administrator” can see and do everything. A “Viewer” might only be able to look up contact information but not export lists or see donation amounts. A “Data Entry” role might only be able to add new records. Assign people to the most restrictive role they can use and still function.
3. Limit List Exports: The ability to export your entire donor list to a spreadsheet is one of the most dangerous permissions. Limit this capability to one or two trusted individuals. A downloaded spreadsheet is a data breach waiting to happen—it can be easily emailed, lost, or saved to an insecure personal computer.

2. Use Strong Passwords and Multi-Factor Authentication (MFA)

Stolen passwords are the number one cause of data breaches. Weak, reused, or shared passwords are an open door for attackers. This is the single most critical technical control you can implement.

Here’s what to do:

1. Mandate a Password Manager: A password manager is an application that creates, stores, and fills in long, random, unique passwords for every website. Your team only has to remember one master password to unlock the manager. This eliminates the need to reuse passwords or write them down. Services like Bitwarden offer excellent free or very low-cost plans for teams. This is not optional; it is essential.
2. Enable Multi-Factor Authentication (MFA): MFA, sometimes called two-factor authentication (2FA), is the best defense against a stolen password. It requires a second piece of information—usually a temporary code from an app on your phone—in addition to your password. Even if an attacker steals a password, they can’t log in without physical access to the user’s phone. Enable MFA on every service that offers it, especially your email, donor CRM, and financial accounts. Apps like Google Authenticator or Authy are free.

3. Keep Your Software Updated

Software isn’t static. Developers are constantly finding and fixing security vulnerabilities. The updates they release, often called “patches,” are critical for closing those security holes before attackers can exploit them.

Here’s what to do:

1. Turn On Automatic Updates: For your operating systems (Windows and macOS) and your web browsers (Chrome, Firefox, Edge), go into the settings and enable automatic updates. This handles the most critical updates without you having to think about it.
2. Update Website Software: If your website runs on a platform like WordPress, you are responsible for keeping the core software, themes, and plugins updated. Outdated plugins are one of the most common ways websites are compromised. Set a reminder to log in and apply updates at least once a month.

4. Encrypt Your Data

Encryption is the process of scrambling data so that it can only be read by someone with the correct key. This is your last line of defense. If a device is lost or stolen, encryption makes the data on it useless to the thief.

Here’s what to do:

1. Encrypt Laptops: Every laptop that is ever used to access donor data must have its hard drive encrypted. This is a built-in feature of modern operating systems. On Windows, it’s called BitLocker (available in Pro editions). On macOS, it’s called FileVault. Turn it on. It takes a few minutes to set up and runs in the background.
2. Use HTTPS: As mentioned before, ensure your website and donation forms use HTTPS to encrypt data in transit.

Training Staff & Volunteers: A Must-Do for Data Safety? (The Human Firewall)

You can have the best technical defenses in the world, but they can all be bypassed if a staff member is tricked into giving away their password. Your people—staff, board members, and volunteers—are your first line of defense, but they can also be your biggest vulnerability. Ongoing training is not a “nice to have”; it’s a core part of your security program.

The primary threat you need to train against is phishing. Phishing attacks are fraudulent emails, text messages, or social media messages designed to trick the recipient into revealing sensitive information (like a password) or deploying malicious software (like ransomware).

Train everyone to spot the common signs of a phishing attempt:

• A Sense of Urgency: Messages that demand immediate action, like “URGENT: Account Suspension Notice” or “Invoice Overdue – Pay Now.”
• Suspicious Sender: The “From” address looks slightly wrong (e.g., `[email protected]` instead of `[email protected]`) or is a generic address for a specific request.
• Generic Greetings: Vague greetings like “Dear Valued Donor” instead of your name.
• Unexpected Attachments or Links: Requests to open a surprise invoice or click a link to track a package you didn’t order.

The most important rule you can teach is: When in doubt, check it out—a different way. If you get an urgent email from your executive director asking you to buy gift cards, don’t reply to the email. Call or text them to verify the request. If you get an email from a bank, don’t click the link. Open a new browser window and type the bank’s website address in manually to log in.

Beyond phishing, establish a simple, one-page data handling policy. It should include clear rules:

• Never email unencrypted spreadsheets containing donor lists.
• Do not save donor files to personal computers or personal cloud storage accounts (like a personal Dropbox or Google Drive).
• Always lock your computer screen when you step away from your desk.
• Shred physical documents with donor information; do not just throw them in the trash.

Training doesn’t have to be a long, boring seminar. A 15-minute discussion at a team meeting every few months, with recent examples of phishing emails, is far more effective.

What If a Data Breach Happens? (Don’t Panic, Have a Plan)

Even with the best preparation, incidents can happen. The goal is to respond quickly and calmly to minimize the damage. Having a simple plan in place before you need it makes all the difference.

Your incident response plan can fit on an index card. It has four steps.

1. Contain the Incident: Your first job is to stop the breach from getting worse. This means taking immediate action. If you suspect a computer is infected with malware, disconnect it from the network. If an email account has been compromised, change the password immediately. If a laptop is lost, use remote wipe capabilities if you have them.
2. Assess the Scope: Once contained, you need to figure out what happened. What systems were accessed? What specific data was viewed or stolen? How many donors are affected? Your data inventory from the beginning will be invaluable here.
3. Notify the Right People: This is the most difficult step. Depending on where you operate and the data involved, you may have legal obligations to notify affected individuals and government regulators. This is the one time you absolutely must seek professional help. Consult with a lawyer who specializes in data privacy to understand your specific obligations. You will also need a communication plan for being transparent with your donors and board.
4. Learn and Improve: After the crisis is over, conduct a post-mortem. How did the breach happen? What breakdown in your process or technology allowed it? Use the painful lesson to strengthen your defenses. Maybe you need to reinforce your phishing training or accelerate your rollout of MFA.

The Bottom Line

For the most common small non-profit scenario—using cloud-based services for email, accounting, and donor management—the right starting point is a focused, three-part strategy. These actions address the vast majority of real-world risks for minimal cost and effort.

First, use a major, PCI-compliant payment processor like Stripe or PayPal for all online donations. This ensures you never have to store or transmit raw credit card data, offloading the most significant technical and compliance burden.

Second, mandate the use of a password manager and enable Multi-Factor Authentication (MFA) on every critical service, including your email platform, donor CRM, and accounting software. This combination is your single most effective defense against account takeovers, which are the root cause of most breaches.

Third, conduct a 30-minute phishing awareness training session with all staff and key volunteers twice a year. The human element is your greatest vulnerability, and regular, simple training is the only way to fortify it.

Frequently Asked Questions

What are the biggest risks to donor data for a small non-profit?

The most significant risks are phishing attacks that trick staff into revealing passwords, lost or stolen unencrypted laptops, and using insecure or outdated website software for donation forms. In practice, the human element is the most common point of failure, not a sophisticated technical attack.

Do we need special software to protect donor information?

Not necessarily. Your focus should be on process and using the security features already built into your existing tools. Enabling multi-factor authentication, using built-in disk encryption, and investing in a low-cost password manager provide more protection than expensive, complex security software.

How often should we review our donor data security practices?

A full review of your policies and access controls once a year is a good baseline. More importantly, you should review a user’s access rights immediately when a staff member or key volunteer leaves the organization. Security is not a one-time project; it is a process of ongoing maintenance.

What’s the first step if we suspect a donor data breach?

Immediately change the passwords for the suspected compromised accounts or systems to prevent further unauthorized access. If you suspect malware, disconnect the affected computer from the network. Your first priority is always to contain the problem before you begin to assess the full scope of the damage.

Can volunteers access donor data safely?

Yes, but only if you strictly follow the principle of least privilege. Grant volunteers access only to the specific data they need for their task, for the shortest time necessary, and ensure their access is removed once their task is complete. They must also receive basic security awareness training and use strong passwords.

Protecting your donors’ data is a direct extension of your mission. It is how you maintain the trust that makes your work possible. It does not require a large budget or a dedicated IT department, but it does demand consistent attention to these fundamental security practices. Start with these steps today to build a durable and trustworthy foundation for your organization.