Privacy & Security for Charities & Foundations

It depends on province, incorporation and activity. An Ontario charity that never trades lists may have no privacy statute over its donor data at all, with duties flowing from contracts, accreditation standards and litigation risk instead. BC PIPA covers all nonprofit activity, Alberta exempts locally incorporated societies outside commercial activity while fully covering federally incorporated charities, and Quebec's Law 25 catches most organizations through its enterprise test. Getting this map right is the first task of any engagement.

Start with an inventory of the systems that hold donor, volunteer and beneficiary data, then apply a recognized small-organization baseline such as the Cyber Centre's controls: MFA, backups, patching, an incident plan and training. Assign one accountable owner, usually the director of finance and operations, and let your MSP execute against a documented plan rather than its own defaults.

Yes. CRA requires a registered charity's books and records, including duplicates of official donation receipts, to be kept at its Canadian address, with receipt duplicates retained two years past year-end and most other records six years. That requirement should shape which CRM, receipting and cloud services you choose, and it is a concrete reason Canadian-hosted platforms appeal to many charities.

Not ignore, but the law is friendlier than most boards fear. Commercial electronic messages sent by or on behalf of a registered charity whose primary purpose is raising funds are exempt under the regulations. Messages outside that exemption need consent, and a donation or volunteer work within the previous two years provides implied consent. Sound list hygiene still matters because the exemption does not cover everything you send.

It proved that a vendor's breach becomes each charity's problem. Backups containing donor and wealth-screening data were stolen, at least 24 Canadian organizations were affected, and the duty to notify donors sat with each charity rather than with Blackbaud. It also ended in a US$49.5 million multistate settlement over the vendor's security and communications. The lesson: vet fundraising vendors before signing and plan for their failures in your incident response.

Different risk, not lower. A community or private foundation holds grantee applications and financials, donor-advised-fund advisor identities, and often deep prospect research on a small number of wealthy families. A leak of any of these does immediate relationship damage, and Law 25 or funder agreements can attach formal duties to them. The absence of beneficiary case files simplifies the map without shrinking it.