Donor and supporter data protection audit

Why run this

What this checklist is for

Supporter data carries the same obligations as commercial customer data and is usually protected with a fraction of the resource. Regulators do not adjust for organization size.

The good news is that a substantial part of what is needed is already inside nonprofit-priced Microsoft 365 licensing and simply has not been deployed.

Run it with

Executive director or head of fundraising

And with

Whoever handles IT

And with

Data protection lead, if you have one

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

Knowing what you hold

The prerequisite for everything else.

Locations holding supporter data are documentedIncluding spreadsheets on personal drives, which is where most of it actually is.
Special category data is identified where you hold itHealth, beliefs and similar categories carry heightened obligations and are common in beneficiary records.
Payment and financial data locations are knownEven where you use a third-party processor, exports and reports often land somewhere unmanaged.
Data held on behalf of partners or chapters is identifiedFederated organizations frequently hold data whose controller relationship is undocumented.
A record of processing activities exists and is currentA regulatory expectation in most jurisdictions and a useful map regardless.

Section 2

Protecting it

Proportionate controls a small team can maintain.

Sensitivity labels applied to supporter and beneficiary recordsStart with two or three labels. A complex scheme will not be maintained.
Access is role-based rather than everybody having everythingIn a small organization this feels unnecessary until somebody leaves under difficult circumstances.
Multi-factor authentication is enforced on every accountThe single highest-value control available, included in your licensing, and frequently not enabled.
Sharing of supporter data outside the organization is controlledAnonymous links and unrestricted external sharing are the most common exposure.
Data loss prevention covers your most sensitive data typesTwo or three types that genuinely matter beats attempted comprehensive coverage.

Section 3

Consent and rights

Obligations that arrive as requests.

Consent is recorded per channel and per purpose, and is currentA blanket consent from 2018 does not cover a new channel.
Preference changes propagate to every system that sends communicationsThe commonest complaint is contact after opting out, and it is usually a synchronisation failure.
A subject access request can be fulfilled within the statutory windowTime a synthetic one. The finding is usually about locating data rather than producing it.
Erasure requests can be honoured without breaking financial recordsFinancial retention obligations and erasure rights interact. Know how before a request arrives.
Somebody is named as accountable for data protectionEven part-time. Regulators ask who is responsible and 'everybody' is not an answer.

Section 4

Practical resilience

What happens on a bad day.

Retention is applied so data is not held indefinitelyIndefinite retention increases both risk and the scope of any breach.
Backups exist and a restore has been testedSmall organizations are disproportionately affected by data loss because there is no second copy anywhere.
A breach response plan exists and names who is contactedIncluding the regulator notification window, which is short.
Staff have had basic data protection training in the last yearMost incidents in small organizations are process errors rather than attacks.
Nonprofit licensing has been checked so controls are not unaffordableMuch of the above is included at nonprofit pricing and organizations routinely under-claim.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

MFA not enforced

Enable it this month. It is included in your licensing, it is the highest-value control available, and it is the one regulators ask about.

Supporter data in personal spreadsheets

Consolidate into managed locations. Data nobody has mapped cannot be protected, deleted or produced on request.

Subject access never tested

Run a synthetic request and time it. The statutory window is shorter than most small teams expect.

Licensing not checked

Do it this month. Nonprofit entitlements are substantial and the check takes a morning.

Want a second opinion on your score?

We will review your licence position alongside your data protection obligations and tell you what is already covered by entitlements you hold — usually more than expected.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

power-bi

nonprofits-associationsReadiness

Reporting capability readiness checklist

Whether a one-analyst organization can build and sustain its own reporting, assessed across twenty checks.

May 30, 2026 · 20 checksOpen

business-central

nonprofits-associationsReadiness

Year-end close readiness checklist

Twenty checks before a nonprofit year end, covering fund accounting, grant reconciliation and audit evidence.

February 28, 2026 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

Knowing what you hold

Protecting it

Consent and rights

Practical resilience

Read this against the number above

If you could not tick these, start here

MFA not enforced

Supporter data in personal spreadsheets

Subject access never tested

Licensing not checked

Want a second opinion on your score?

Related checklists

Reporting capability readiness checklist

Year-end close readiness checklist

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email