Nonprofits collect information through donation forms, program intake, volunteer applications, event registrations, surveys, newsletters, grant reporting and employee records. Over time, that information spreads across databases, spreadsheets, email accounts, SharePoint libraries and third-party platforms.
The organization may know how to collect data without knowing exactly what it holds, why it still keeps it or who is responsible for it.
That creates problems for privacy, security, reporting and future AI projects. A nonprofit cannot safely retain institutional knowledge or introduce an AI Knowledge Hub until it understands where its information lives and which systems are authoritative.
Start With a Data Inventory
A data inventory is a practical record of the information the nonprofit collects and manages. It should identify:
- What information is collected
- Why the organization needs it
- Where it is stored
- Which system owns the official record
- Who may access it
- Whether it is shared externally
- How long it should be retained
- Who is responsible for reviewing it
- Whether it contains personal or restricted information
The inventory should include both structured data in systems and unstructured information in documents, emails and spreadsheets. NIST notes that organizations need to understand structured and unstructured data across the places where it resides before they can properly classify and protect it. (NIST)
Stop Collecting Information “Just in Case”
Every additional piece of personal information creates another obligation to secure, maintain and eventually dispose of it.
The Federal Trade Commission recommends collecting sensitive information only when there is a legitimate operational need and keeping it only as long as necessary. Smaller, controlled data collections are generally easier to protect than information scattered across old folders and abandoned systems. (Federal Trade Commission)
A nonprofit should ask:
- Do we still need this information?
- Is it required by law, contract or funding agreement?
- Are we collecting more detail than the program needs?
- Are duplicate copies stored elsewhere?
- Is there a documented deletion or retention rule?
Human review may be required from legal counsel, accountants, funders or privacy professionals before records are deleted.
Separate Knowledge From Individual Records
SharePoint should contain approved policies, blank forms, data definitions, retention guidance and instructions explaining how employees use organizational systems.
Completed forms containing participant, medical, financial, donor or employee information should usually remain in the secured system designed to manage those records.
The donor CRM remains authoritative for donor records. The case-management system remains authoritative for participant information. HR, payroll, accounting and grant-management systems remain authoritative for their respective records.
Copilot Studio can provide the conversational layer through Maisy. Employees might ask:
- Where should this information be stored?
- Which system contains the official record?
- How long should this document be retained?
- Who may access this type of information?
- Is this blank form still current?
Maisy can explain approved procedures and direct employees to the correct system. It should not combine restricted records into an unrestricted repository.
How Maisy Helps
Pixeldust begins with discovery: identifying data sources, repeated questions, duplicate records, conflicting instructions, content owners and permission requirements.
Pixeldust then organizes approved guidance in SharePoint, configures Maisy through Copilot Studio and tests realistic employee questions. This creates a controlled foundation for AI while helping the nonprofit retain institutional knowledge about what it collects, where it belongs and who is responsible for it.
