Blog

Nonprofit board members and leaders typically understand that they have an obligation to safeguard donor information, but the specifics of what those data security rules are, and how to adhere to them without incurring high costs, can be murkier.

Federal Framework

Unlike Europe, the United States does not have a single comprehensive privacy law. Instead, nonprofits face a patchwork of federal statutes that may apply depending on the type of information they collect.

• Federal Trade Commission Act (FTC Act) – Prohibits unfair or deceptive practices. If a nonprofit promises in its privacy policy not to share donor information but does so anyway, that can be treated as a violation.
  
  
• Children’s Online Privacy Protection Act (COPPA) – Applies if a nonprofit collects personal information from children under 13 through online platforms or events. Consent from a parent or guardian is required.
  
  
• Health Insurance Portability and Accountability Act (HIPAA) – Applies only if the nonprofit is considered a covered entity, such as a health-related organization handling protected health information.

Even if none of these statutes squarely apply, the IRS expects nonprofits to safeguard donor and member data as part of their fiduciary duties.

Georgia’s Data Breach Notification Law

For nonprofits based in Georgia, the most important state-specific requirement is the data breach notification law (O.C.G.A. § 10-1-912). If a breach occurs that exposes personal information, such as names combined with Social Security numbers, financial account numbers, or driver’s license numbers, the nonprofit must notify affected individuals.

The law applies to both electronic and paper records, and failure to notify can result in fines, penalties, and reputational damage that may be harder to repair than the legal fallout. For example, if a laptop containing donor banking details is stolen, the nonprofit has a duty to investigate and, if necessary, provide timely notice to all affected donors.

International Considerations

International fundraising and membership outreach introduces another layer of complexity. Some nonprofits prefer to avoid these added regulatory requirements by simply not accepting international donations or members, particularly from website visitors with Canadian or EU IP addresses.

General Data Protection Regulation (GDPR)

This European Union law applies if a U.S.-based nonprofit collects or processes the personal data of EU residents. Obligations include obtaining consent for data collection, limiting data to what is necessary, and honoring rights such as access, correction, and erasure. An Atlanta nonprofit accepting online donations from EU residents could fall under GDPR requirements.

Personal Information Protection and Electronic Documents Act (PIPEDA)

Canada’s national privacy law functions similarly, requiring transparency and consent when Canadian donors’ information is collected.

Even if your nonprofit does not actively solicit donations from Canadians, the accessibility of online campaigns makes it important to understand when international laws could be triggered.

Gray Areas That Trip Up Nonprofits

Some compliance risks come from everyday activities that nonprofits don’t immediately recognize as data-sensitive:

• Email marketing: The CAN-SPAM Act applies to nonprofits and requires every email to include a functional opt-out mechanism, accurate sender information, and a clear subject line.
  
  
• Fundraising partnerships: Sharing donor lists with corporate sponsors or partner organizations may raise privacy concerns and should only be done with explicit consent.
  
  
• Event registrations: Collecting health or dietary restrictions for participants can fall into the category of sensitive information and should be handled with care.
  
  
• Vendor relationships: CRMs, payment processors, and donor management platforms may be subject to stricter privacy laws in their home states. Nonprofits don’t take on those obligations directly, but they should ensure contracts reflect vendor compliance.

Building a Compliance Checklist

• Adopt a clear, written privacy policy explaining how donor and member data is collected, used, and stored.
• Limit the information you collect to what is necessary for your mission and minimize retention periods.
• Encrypt sensitive records, especially those involving payment information or government identifiers.
• Train staff and volunteers on privacy practices, including how to spot and report potential breaches.
• Establish a breach response plan so the organization can act quickly if personal information is compromised.
• Work with reputable vendors that already comply with relevant state privacy laws when those laws apply to them.
• Conduct regular audits of access permissions and storage systems to ensure protections remain up to date.

These measures not only reduce legal risk but also demonstrate to donors that their trust is well-placed.

An Atlanta Nonprofit Attorney Can Help You Safeguard Donor Data

Privacy compliance is not a one-time project. Laws evolve, new technologies introduce new risks, and international fundraising adds unexpected obligations. For nonprofits based in Atlanta, the cost of falling behind can include both legal penalties and the loss of donor confidence.

Nonprofit attorney Cameron Hawkins can review your policies, evaluate vendor contracts, and train your team on compliance obligations so that your organization stays both effective and protected. Call 678-921-4225 to request a consultation.