A nonprofit donor database may contain contact information, giving history, payment details, employer information, family relationships, event attendance, communication preferences and notes from conversations.
Some organizations also record personal interests, estimated giving capacity or sensitive details shared during donor meetings. Over time, information may be copied into spreadsheets, exported for campaigns and stored in individual email accounts.
The nonprofit may know how to solicit donors without knowing where all their information has gone.
Decide What Information the Organization Actually Needs
Collecting more information does not automatically produce better fundraising.
For each donor-data field, the nonprofit should be able to explain:
- Why the information is collected
- How it supports a legitimate activity
- Which system should contain it
- Who may view or edit it
- How long it should be retained
- Whether the donor was told how it would be used
- When it should be corrected, archived or deleted
- Whether it may be shared with another organization
The Federal Trade Commission’s guide to protecting personal information recommends keeping only the sensitive information an organization has a legitimate business need to retain. It also emphasizes controlling access and disposing of information securely when it is no longer required. (Federal Trade Commission)
This principle applies to nonprofits as well as businesses. The FTC specifically notes that charitable organizations collect private information about donors, members and the people they serve. Its cybersecurity resources for nonprofits address risks such as phishing, ransomware, vendor security and unauthorized access. (Federal Trade Commission)
Stop Uncontrolled Exports
Donor information often leaves the CRM through ordinary work.
An employee downloads a mailing list. A consultant receives an event spreadsheet. A volunteer gets a list of phone numbers. A board member asks for major-donor information by email. Months later, copies remain on personal devices and shared folders.
The nonprofit should document:
- Who may export donor information
- Which fields may be included
- Where exported files may be stored
- Whether vendors may receive them
- How files must be transferred
- When temporary copies must be deleted
- Who confirms that access has ended
- How suspected exposure is reported
The CRM should remain authoritative for donor records, gifts, communication preferences and relationship history. SharePoint may hold approved procedures, blank forms and data-handling instructions, but unrestricted donor exports should not become part of the general Knowledge Hub.
Distinguish Privacy From Required Disclosure
Nonprofits must also understand which information is private and which organizational documents may be publicly available.
The IRS explains that most tax-exempt organizations must make certain applications and annual returns available for public inspection. However, public charities generally do not have to disclose contributor names and addresses shown on their annual returns. The rules vary by filing and organization type, so the nonprofit should follow current IRS public-disclosure guidance. (IRS)
Legal counsel and tax professionals should review unusual disclosure requests. Employees should not release donor information merely because someone describes the nonprofit as a public organization.
Make Approved Data Rules Searchable
SharePoint should serve as the organized knowledge source for donor-data policies, access rules, retention schedules, export procedures, vendor requirements and incident-reporting instructions.
Copilot Studio provides the conversational layer. Through Maisy, authorized employees could ask:
- May I send this donor list to a vendor?
- Which system contains the official giving history?
- How long may an event spreadsheet be retained?
- Who approves access for a consultant?
- What should I do after sending information to the wrong person?
- Which donor details may be shared with the board?
Maisy can help the nonprofit retain institutional knowledge about approved procedures. It should not expose donor profiles, payment details or confidential development notes to employees who lack permission.
How Maisy Helps
Pixeldust begins by identifying repeated donor-data questions, uncontrolled exports, authoritative systems, duplicate records, content owners and permission requirements.
Pixeldust then organizes approved guidance in SharePoint, maps access and configures Maisy through Copilot Studio. Testing uses realistic fundraising, vendor, board and incident-response questions.
This helps the nonprofit retain institutional knowledge about donor information while keeping donor records, disclosure decisions, security investigations and legal interpretation under qualified human control.
