Blog
A nonprofit may first learn about a possible data breach when a software provider, payroll company, donation platform, or other vendor reports that its systems were compromised. In other cases, the problem may begin inside the organization after a phishing attack, compromised email account, lost device, or accidental disclosure of sensitive information.
Whatever the source, leadership should avoid treating the incident as only an IT problem. The organization may also need to consider legal obligations, insurance requirements, vendor responsibilities, and whether affected individuals need to be notified.
Secure the Immediate Problem
The first priority is preventing additional exposure.
Depending on what happened, that may mean disabling a compromised account, changing credentials, removing publicly accessible information, restricting access to affected systems, or bringing in an IT or cybersecurity professional to contain the issue.
Organizations should also be careful not to destroy system logs, affected devices, emails, access records, or other information connected to the incident. Those records may help forensic professionals determine when the breach occurred and what data was affected.
Find Out What Information May Have Been Affected
A stolen password does not necessarily mean sensitive records were accessed, and a vendor breach does not necessarily mean every customer’s data was compromised.
The nonprofit should begin identifying what systems or accounts were involved and what types of information may have been exposed. That could include donor records, employee information, beneficiary files, financial information, Social Security numbers, health-related information, or other sensitive data.
When the incident involves an outside vendor, much of that information may need to come from the vendor’s investigation rather than the nonprofit itself.
Contact the Appropriate Legal, Insurance, and Technical Professionals
A nonprofit attorney can help leadership determine which legal questions need to be addressed while IT or cybersecurity professionals investigate the technical side of the incident.
The organization may also need to notify its cyber insurer promptly. Insurance policies can contain reporting requirements that apply soon after an organization becomes aware of a possible incident.
Determine Whether Anyone Needs to Be Notified
Not every security incident triggers the same notification requirements.
Under Georgia law, organizations may be required to notify Georgia residents if certain unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person. The type of information involved, how it was exposed, and whether other state or federal laws apply can all affect the nonprofit’s obligations.
A nonprofit attorney can help determine whether affected individuals, regulators, insurers, or other parties need to be notified and what those notices should contain.
Review Vendor Responsibilities When a Third Party Is Involved
If the incident began with a donation processor, payroll provider, CRM, cloud platform, or another outside service provider, the nonprofit should review the underlying agreement.
Our nonprofit attorneys can help review vendor contracts to determine what information the vendor must provide, whether incident reporting deadlines apply, what cooperation is required, and how responsibility for notification or other response costs is allocated.
For future agreements, clearly defining those responsibilities in advance can reduce uncertainty when an incident occurs.
Document How the Nonprofit Responds
Leadership should maintain a record of when the problem was discovered, who was contacted, what information was received from vendors or investigators, and what steps the organization took in response.
Documentation can also help explain later why particular notification, remediation, or communication decisions were made.
Address the Weaknesses the Incident Revealed
Once the immediate issue is under control, the nonprofit should consider whether its policies, vendor agreements, access controls, or incident response procedures need to change.
A phishing incident may reveal a need for different internal access practices. A vendor breach may expose gaps in contract language. An accidental disclosure may show that too many people have access to information they do not need.
Using those lessons to improve existing procedures can reduce the risk of the same problem occurring again.
Get Legal Guidance After a Nonprofit Data Incident
The Law Office of Cameron Hawkins provides outside general counsel services to nonprofits throughout the Atlanta area. We can help nonprofit leaders evaluate legal obligations after a possible data breach, review vendor agreements and insurance requirements, determine whether notification may be required, and strengthen incident response policies for the future.
If your organization has learned that sensitive information may have been exposed, contact us at (678) 921-4225 to discuss the legal issues that may need to be addressed.
