Donor and Constituent Data Security: What a Growing Non-Profit Owes the People It Serves

A non-profit with 60 employees and a $10 million budget holds more sensitive data than most people expect. There are donor names, addresses, giving histories, and payment details. There are client files, case notes, and intake forms. There are volunteer records, employee records, and grant reports that name the individuals the organization serves.

Almost none of that data was collected with security in mind. It accumulated in a donor database, a shared drive, a case management tool, and a dozen spreadsheets, because the mission came first. That is a reasonable priority. It is also the reason the people who trusted the organization with their information are more exposed than the organization realizes.

Why Non-Profit Data Is a Target

Attackers do not need a non-profit to be wealthy. They need it to hold data that can be resold, used for fraud, or held for ransom, and to defend that data poorly.

Donor records are useful for impersonation. A criminal who knows who gave, how much, and when can send a convincing "your receipt" or "update your payment method" email. Client and constituent records are worse. Case notes, health details, immigration status, housing situation, and student information are the kind of data that causes lasting harm when exposed, and the people affected are often the least able to absorb that harm.

Then there is the staffing reality. A Washington State survey of 100 non-profits, reported by the state's technology agency WaTech, found that nearly four in five had experienced at least one cyberattack in the prior three years, and that 64% had no full-time IT or cybersecurity staff member. It is a small, regional sample, so treat the exact percentages as directional rather than national. The pattern is consistent with what we see: the organizations with the most sensitive data often have the thinnest technical oversight.

What the Blackbaud Case Taught Every Non-Profit

The clearest recent lesson came from a vendor, not a non-profit. In 2020, a ransomware attack on Blackbaud, a software provider used heavily by non-profits and schools, exposed data held on behalf of roughly 13,000 customers. In October 2023, a coalition of state attorneys general announced a $49.5 million settlement over the company's data security practices and its breach response. Blackbaud did not admit wrongdoing as part of that settlement.

In 2024, the Federal Trade Commission finalized its own order against the company. The FTC's complaint focused on a point that matters well beyond Blackbaud: the company kept data on former customers and prospects far longer than it needed, so the breach exposed far more than it should have. The final order requires Blackbaud to delete data it no longer needs and to maintain a data retention schedule. You can read the FTC's announcement of the final order and the Nevada Attorney General's summary of the multistate settlement.

Three takeaways apply to a growing non-profit:

• Your vendors' failures become your problem. The affected organizations did nothing wrong in the attack itself, yet they were the ones notifying their own donors and constituents.
• Regulators now treat holding data you do not need as a risk of its own. Retention is a security control, not an administrative afterthought.
• "Our vendor handles security" is not an answer to a donor, a funder, or an attorney general.

What You Owe the People Behind the Data

It helps to frame this as an obligation rather than an IT project. A donor who gives $50 and a client who shares a case history are both extending trust. Four commitments cover most of what that trust requires.

1. Know what you hold, and where

You cannot protect data you cannot locate. Most growing non-profits cannot say how many places donor payment details, client case notes, or volunteer background checks are stored. The first deliverable is a simple inventory: what categories of data you hold, which system holds each one, who can access it, and who the vendor is.

2. Collect and keep only what the mission needs

Every record you keep is a record that can leak. Set a retention rule for each data category: how long you keep it, why, and what triggers deletion. A donor who has not given in a decade, an applicant who was never served, and a volunteer who left years ago are all liabilities sitting in a database. Deleting them reduces your exposure and your notification burden if something goes wrong.

3. Control who can see it

Access should follow the role, not the person's seniority or tenure. A development associate needs donor contact records, not client case notes. A program manager needs client files, not payment data. Multi-factor authentication on every system that holds constituent data is the minimum, and an access review at least twice a year catches accounts that outlived the person who used them.

4. Be ready to tell people quickly

Breach notification laws vary by state, and many carry short deadlines. An organization that learns of an incident and then spends two weeks figuring out who holds the affected data has already lost most of its options. Decide in advance who makes the call, who contacts the vendor, who drafts the donor and constituent notice, and who talks to the board.

A 90-Day Framework for a Non-Profit Without an IT Department

This is the sequence we recommend for an organization with no dedicated technology leader. It assumes your managed service provider, if you have one, keeps handling day-to-day support while someone owns the strategy.

Days 1 to 30: Inventory and ownership

1. Name one executive who owns data protection. It does not have to be a technologist. It has to be someone with authority and a board reporting line.
2. List every system that holds donor, client, volunteer, or employee data, including the spreadsheets and shared folders.
3. For each system, record the vendor, the data categories, the number of users, and whether multi-factor authentication is on.

Days 31 to 60: Reduce and restrict

1. Turn on multi-factor authentication everywhere it is missing, starting with the donor database, email, and any case management tool.
2. Remove accounts for people who have left and accounts no one can account for.
3. Write a one-page retention schedule. Start with the data that carries the most harm if exposed.
4. Delete or archive the records that fall outside it.

Days 61 to 90: Vendors and response

1. Review the security terms in your contracts with your three largest data-holding vendors. Ask where data is stored, how quickly they notify you of an incident, and what happens to your data if the relationship ends.
2. Write a one-page incident response plan with names, phone numbers, and the first five decisions.
3. Run a 60-minute tabletop exercise with leadership. Walk through a scenario in which your donor database vendor reports a breach on a Friday afternoon.
4. Report the results to your board in plain language.

Where Funders and Boards Fit In

Grantmakers increasingly ask about data handling in due diligence and renewals, and some funding agreements carry explicit data protection requirements. A board that has never asked about data security will eventually be asked about it by someone else. The reporting that serves a funder well is the same reporting that serves a board: the inventory, the retention schedule, the access review dates, and the incident plan.

Nothing in this framework requires a large budget. It requires an owner, a calendar, and a decision to keep less. What it also requires is someone with the technical judgment to tell which vendors are a real risk and which controls are worth the staff time. That is the gap Elevaire's Fractional IT Leadership and Compliance & Security work is built to fill, alongside the provider that already keeps your systems running.

Frequently Asked Questions

How much does it cost to secure donor and constituent data?

Most of the first 90 days is staff time and configuration, not new spending. Multi-factor authentication is included in the licensing of most major email and donor platforms, and retention and access reviews cost hours rather than dollars. Costs rise when you need outside testing, a formal framework such as SOC 2, or a part-time technology leader to own the program.

Are non-profits subject to the same data breach laws as businesses?

In most states, yes. State breach notification laws generally apply based on whose personal information was exposed, not on the organization's tax status. Some states also exempt or treat certain kinds of organizations differently, so confirm the rules for each state where your donors and clients live with counsel.

How does this work alongside our existing managed service provider?

It is additive. Your provider keeps devices, networks, and support running. Data protection strategy covers a different set of questions: what you collect, how long you keep it, which vendors you trust, and how you respond when something goes wrong. A fractional technology leader sets that direction and works with your provider to carry it out.

What should we do if our donor database vendor reports a breach?

Confirm what data was exposed and when, preserve all vendor communications, and notify your legal counsel and insurer. Then follow your incident plan to decide who needs to be told and by when. The faster you can answer "which of our records were in that system," the better your options.

How long should a non-profit keep donor and client records?

It depends on the category. Financial and tax records often carry legal minimums, while case notes may be governed by program or funder rules. The principle is to keep each category only as long as a legal, funder, or mission need requires, and to write the rule down. Have counsel review the schedule before you delete anything covered by a legal hold or grant requirement.

How do we get started if we have no IT staff?

Start with the inventory and name an executive owner. Those two steps cost almost nothing and make every later decision easier. From there, the 90-day framework above gives you a sequence you can run with the staff you have, with outside help on the technical judgment calls.