Data is one of the most powerful tools your nonprofit can use to reach its supporters. With the deprecation of third-party cookies, it’s more important now than ever to make sure your nonprofit safely manages its first-party data.
However, it’s critical that your nonprofit complies with all relevant data regulations intended to protect individuals’ personal information—especially when using constituent information for marketing and fundraising purposes.
In this guide, we’ll cover tips for protecting donors’ sensitive information and staying on top of the latest regulations in the US.
1. Familiarize yourself with all relevant data regulations.
The first step in following US data privacy laws is making your team aware of them in the first place. These regulations are constantly changing, and since regulations differ between states, even if you comply with one state’s laws, you may still violate others’.
Put a team member in charge of regularly checking the status of relevant data laws and reporting on them to the rest of your staff. Use resources such as the International Association of Privacy Professionals (IAPP) US State Privacy Legislation Tracker to stay on top of current and proposed legislation that will impact how your nonprofit uses donors’ personal information.
To help you get started, here is a quick overview of two US data privacy laws that are currently in effect:
- The California Consumer Privacy Act (CCPA) grants California residents rights over their personal information, including the right to know how their information is used, the right to opt out of the sale of their personal data, the right to request access to the information organizations collect about them, and the right to request the deletion of their personal information from collecting organizations.
- The Colorado Privacy Act (CPA) grants Colorado residents rights over their personal data, mandates transparency about the data organizations collect, requires organizations to obtain opt-in consent, and demands that organizations conduct data protection assessments, among other regulations.
When you’re familiar with the many different privacy laws that apply to your organization, you can mitigate risks and keep sensitive donor data secure.
2. Store data in a secure database.
Storing supporter data in spreadsheets—or worse, on physical forms—should be a thing of the past. It’s widely considered best practice to store donor information in a comprehensive database or constituent relationship management system (CRM) that features robust security measures.
To keep sensitive donor information secure, look for a system that offers:
- Data encryption
- Multi-factor authentication
- SOC 2 Type II compliance
Additionally, implement access controls to limit database access to only team members who need it and regularly update your software so you maintain the latest security patches.
3. Be transparent about data collection.
Your nonprofit likely collects and stores data through its marketing and fundraising efforts. These data points may include:
- Demographics
- Contact information
- Communication preferences
- Website activity
- Donation history
- Other preferences and behaviors
All of this information is considered first-party data—information your organization collects from direct interactions with your constituents. When gathering this information from your supporters, you must obtain consent, be transparent about the fact that you’re collecting their data, and explain what you’re using it for.
For example, if you ask supporters to submit their phone numbers when registering for your upcoming fundraising event, include a box for donors to check to signify their consent to having this information collected. Additionally, specify whether you’ll use this information for text marketing purposes, event updates, phone calls, donation solicitations, or something else entirely.
4. Maintain proper data hygiene.
Supporters’ preferences about the use of their personal information may change frequently. After all, 80% of adults worldwide say they’re concerned about their data privacy, and 69% say they’re more concerned about their data privacy than ever before.
That’s why it’s important to keep your database clean and up to date. Just as you audit your financial records, audit your database to ensure you’re properly storing information on your constituents’ data preferences.
Then, apply data hygiene services to keep your database up to date and remove contacts who don’t want to receive your communications. For instance, Deep Sync’s data hygiene guide explains that services like Do Not Mail suppression allow you to identify supporters who have registered with the ANA’s DMAChoice™ Program, note their preferences in your CRM, and prevent your team from contacting them via direct mail.
5. Work with a data provider that prioritizes data privacy.
Whether you’re cleaning up your first-party data, appending third-party data, or building a custom marketing audience, ensure you’re working with a data provider that prioritizes data privacy.
Partner with data experts who:
- Publicly list their security measures, such as CCPA and SOC 2 Type II compliance
- Are transparent about where they source their data from
- Allow easy access to their privacy policy
- Work with your organization to respect supporter preferences
- Are open to discussing their data privacy and security practices and answering your questions
To ensure compliance with data privacy laws and build donor trust, make comprehensive privacy and security measures a must-have in your search for data services. If you’re unsure what steps your current provider is taking, ask them how they protect sensitive data and refer to their privacy policy.
Wrapping Up
When it comes to nonprofit data privacy, put yourself in your donors’ shoes. They’re offering their unwavering support and generosity to your cause; the least you can do in return is ensure their personal information is kept safe and secure. Remembering that your donors are more than just database entries—and are instead individuals instrumental in fulfilling your mission—will help ground your organization in the importance of staying vigilant and maintaining data privacy.
About the Author
As Senior Product Marketing Manager, Jeanette C. Rumsey leads the marketing, product promotion, and sales enablement strategies for Deep Sync’s multi-brand Foundational business unit. She brings more than 20 years of direct marketing expertise to her role, including a deep understanding of data compilation methodologies, data-related services, and cross-channel application. Jeanette is passionate about helping businesses grow through the successful application of direct mail marketing.
