donor data security

Donor Data Security for Nonprofits: 90 Days on a Tight Budget

Nonprofit coordinator setting up donor account security

Three actions cut most of the risk facing donor records today: enable phishing-resistant multi-factor authentication on every admin account, route payments through PCI-compliant channels instead of storing card numbers locally, and encrypt donor data both in transit and at rest with backups tested on a regular schedule. These align with CISA, PCI DSS, and NIST's small-business framework. We walk through exactly how to put each one in place below.

TL;DR:

Use FIDO2 security keys or platform authenticators instead of SMS, and disable fail open settings so outages cannot bypass administrator authentication.

Keep one backup offline or air gapped, encrypt backup files with separately stored keys, and test a full restore at least quarterly.

Hosted payment pages or tokenization keep card data off your servers, reducing PCI scope, but PCI DSS still applies to every organization accepting card donations.

Before signing, request a SOC 2 report or written security attestation, and confirm breach notice deadlines, data deletion terms, and subcontractor access.

Priority checklist for the next 30 to 90 days
How to implement essential technical controls correctly
How to evaluate and manage vendors that touch donor data
Policies and data governance: retention, privacy notices, and PCI scope
Incident response: an actionable playbook for nonprofits
Cost-conscious ways smaller nonprofits can implement these controls
Relevant regulations and obligations affecting donor data
Why partnering with a local managed IT provider can reduce risk
Quick CTA: start securing your donor data today
FAQ
Sources

Priority checklist for the next 30 to 90 days

Donor data security improves fastest when tasks have an owner and a deadline, not just a good intention. We recommend assigning this sequence to a single staff lead, even at small organizations where that person wears five other hats.

Day 1: Enable MFA on every admin account for your donor database, email, and financial systems.
Week 1: Confirm your payment processor handles card data directly and remove any local storage of card numbers from spreadsheets or forms.
Week 1-2: Inventory every place donor data lives, including your CRM, email platform, spreadsheets, and any staff laptops.
Month 1: Restrict access to donor records based on job function, not convenience.
Month 1-2: Set up automated backups for your donor database and run a test restore.
Month 2-3: Document the policies above so your board and funders can see what changed.

Pro Tip: Start MFA enforcement with the accounts that touch donor data directly, finance and development staff, then expand. Pair it with a password manager so staff stop reusing credentials across systems.

Small nonprofits often delay these steps because they feel like IT projects. In practice, most take an afternoon per item once ownership is clear.

How to implement essential technical controls correctly

Getting the configuration right matters as much as choosing the control. A few specifics make the difference between real protection and a false sense of security.

Multi-factor authentication: Favor phishing-resistant options like FIDO2 security keys or platform authenticators (Windows Hello, Touch ID) over SMS codes, which attackers can intercept through SIM swapping. Avoid "fail-open" configurations that let a login through when the MFA service is unreachable.
Encryption in transit: Require TLS on every donor-facing form, donation page, and internal portal. Browsers now flag non-HTTPS pages, which also erodes donor trust.
Encryption at rest: Donor databases and backup files need strong encryption, with keys stored separately from the data they protect. If a backup drive is stolen, the data stays unreadable without the key.
Backups: Keep at least one offline or air-gapped copy that ransomware cannot reach over the network. Test restores quarterly, not just backup completion.
Patching: Turn on automatic updates for operating systems and donor management software wherever possible. Unpatched software remains one of the most common entry points for attackers.
Logging: Collect login attempts, failed access tries, and file changes in your donor database, and keep those logs for at least 90 days so you can reconstruct events after an incident.

MFA blocks the vast majority of automated attacks. CISA cites Microsoft data showing that MFA blocks roughly 99.9% of automated account compromise attempts, which makes it one of the highest-return controls a small organization can deploy.

How to evaluate and manage vendors that touch donor data

Your donor database vendor, email platform, and payment processor all become part of your security posture the moment they hold donor information. Ask specific questions before signing anything.

Does the vendor encrypt donor data both in transit and at rest, and who holds the encryption keys?
Can the vendor provide a SOC 2 report, PCI Attestation of Compliance, or a written security attestation on request?
What is the vendor's documented breach notification timeline, and does it meet your state's requirements?
Does the contract specify data deletion terms when you end the relationship, and does it disclose any subprocessors who also touch your data?
Has the vendor had a prior breach, and what changed afterward?

If a vendor cannot produce evidence, in writing, treat that as a decision point, not a formality. The Blackbaud settlement is the clearest cautionary example in the nonprofit sector: the FTC found that inadequate encryption, retention, and monitoring practices at a major donor-database vendor contributed to a large-scale exposure of client data. Nonprofits using that platform were not shielded from fallout just because a vendor handled the technology; donor trust and reputational risk fell on the organizations themselves.

Policies and data governance: retention, privacy notices, and PCI scope

A written policy does more than satisfy auditors. It forces decisions about what data you actually need to keep.

Publish a plain-language privacy policy describing what donor data you collect and how you use it.
Set a retention schedule and delete records you no longer need; a ten-year-old donor's full giving history rarely needs to stay in an active database.
Avoid storing Social Security numbers or card numbers unless a specific program requires them.
Reduce PCI scope by using hosted payment pages or tokenization so card data never touches your own servers; this determines which Self-Assessment Questionnaire applies to your organization.
Assign a staff member to review these policies annually and keep a record of changes for board and funder review.

PCI DSS applies to any organization that stores, processes, or transmits cardholder data, so the scope-reduction choices you make upfront shape how much compliance work follows.

Incident response: an actionable playbook for nonprofits

A breach response moves faster when the steps are already written down and nobody has to improvise under pressure.

Contain: Isolate affected systems from the network immediately and preserve logs before they rotate out.
Notify internally: Alert your designated incident lead and any vendor partners whose systems may be involved.
Bring in outside help: Contact legal counsel and your cyber insurance provider early; involve a forensic responder if the scope is unclear.
Notify donors: Follow your contractual and regulatory notification obligations, which vary by state and by the type of data exposed.
Recover: Restore from tested backups and verify data integrity before bringing systems back online.
Review: Run a post-incident debrief and document what changed, then update your response plan.

Keep a one-page contact list and notification template ready in advance. During an actual incident, that document saves hours.

Cost-conscious ways smaller nonprofits can implement these controls

Budget constraints do not have to mean weak security. Several of the most effective controls cost nothing beyond staff time.

Use the MFA built into your existing identity provider (Google Workspace, Microsoft 365) before buying a separate tool.
Start with a free tier of a password manager for staff logins.
Choose a cloud backup service with automatic scheduling rather than relying on manual copies.
Turn on automatic patching wherever your software allows it.
Run short monthly phishing-awareness reminders instead of one annual training session nobody remembers.

Pro Tip: If your organization has no dedicated IT staff, outsourcing monitoring and backups to a managed provider often costs less than the staff hours needed to do it reliably in-house.

Prioritize MFA and backups first. Low-cost cybersecurity guidance built for nonprofits consistently points to basic hygiene, patching, and staff training as the steps that reduce risk the most relative to their cost. Our low-cost cybersecurity setup guide covers specific tools at each budget tier.

Relevant regulations and obligations affecting donor data

Donor data sits at the intersection of several regulatory frameworks, and which ones apply depends on what you collect and how you communicate with supporters. There is no single federal donor-privacy law in the United States, but a patchwork of rules still governs most nonprofit fundraising activity.

If you accept credit or debit card donations, PCI DSS applies regardless of your size or nonprofit status; it governs how cardholder data is stored, processed, and transmitted. If you email donors, CAN-SPAM sets requirements around opt-outs and accurate sender information, while the TCPA governs text and phone outreach, including consent requirements for automated messages. Organizations running health-related programs, such as clinics or health-focused service providers, may also fall under HIPAA if they handle protected health information as part of their mission work.

State-level data breach notification laws add another layer, and requirements differ by state in terms of timelines and what counts as a reportable incident. The NIST Cybersecurity Framework 2.0 does not carry the force of law but gives small organizations a practical structure for organizing compliance efforts across these overlapping requirements, built around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.

Why partnering with a local managed IT provider can reduce risk

Many of the controls above take real time to configure and monitor correctly, which is where proactive managed support changes the equation. We provide 24/7 monitoring that catches suspicious activity before it becomes a breach, alongside cybersecurity protection, tested backup and recovery, and Microsoft 365 management built for organizations without a dedicated IT department. Many nonprofits rely on this kind of hands-on support to keep donor systems patched, backed up, and monitored without hiring full-time IT staff.

Quick CTA: start securing your donor data today

Small organizations can put these controls in place without the jargon or the long-term contract. Managed IT support, dedicated cybersecurity protection, or a tested backup and recovery plan can be built around your donor systems and your budget.

What you get	Starting point
Free initial evaluation	Free Network Assessment
Quick security snapshot	10-minute readiness audit
Ongoing protection	Managed IT Support

Request our 10-minute readiness audit to see exactly where your donor data stands today, and get a plain-language plan for closing the gaps.

FAQ

What is the single most important step to secure donor data?

Enabling multi-factor authentication on admin accounts is the highest-impact single step, since CISA cites data showing MFA blocks roughly 99.9% of automated account compromise attempts. Pair it with removing local card data storage and encrypting your donor database for a strong baseline.

Does PCI DSS apply to small nonprofits that accept donations?

Yes, PCI DSS applies to any organization that stores, processes, or transmits cardholder data, regardless of nonprofit status or size. Using a hosted payment page or tokenization reduces your compliance scope, though you still need to verify your processor's own compliance.

How often should we test our donor data backups?

Test restores quarterly at minimum, since a backup that has never been restored is unverified, not functional. Keep at least one offline or air-gapped copy that ransomware cannot reach through your network.

What should we check before trusting a donor database vendor?

Ask for a SOC 2 report, PCI Attestation of Compliance, or written security attestation, and confirm how the vendor handles encryption and breach notification. The FTC's settlement with Blackbaud shows that inadequate vendor safeguards can expose donor data even when the nonprofit itself did nothing wrong.

Is encrypting donor data at rest necessary if we already use HTTPS?

Yes, encryption in transit (HTTPS or TLS) protects data moving between systems, but it does nothing to protect a stolen laptop, drive, or backup file. Donor databases and backups need separate at-rest encryption with keys managed apart from the data itself.

— Nicholas

Sources

Want help putting this into practice?

We'll audit your security, speed, and hardware in under an hour — no commitment, no sales pitch. Just a clear roadmap of what to fix and why.

Schedule Your Free Assessment

Donor Data Security for Nonprofits: 90 Days on a Tight Budget