VPO · Nonprofit
Virtual Privacy Officer for Charities & Foundations
A Virtual Privacy Officer gives your charity a designated privacy lead who actually knows which statute, contract or standard governs each record you hold. The engagement usually starts when Law 25 demands a published person in charge, when a funder or accreditor asks who owns privacy, or when a donor question about wealth screening or anonymity lands with nobody equipped to answer it. Your VPO settles the which-law-applies question, builds the routines, and stays on call.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
The privacy questions a charity VPO takes off your desk
Privacy in the charitable sector is less about firewalls and more about judgment calls on consent, retention and disclosure that recur weekly. A VPO owns those calls.
Consent language across the giving journey
Donation forms, peer-to-peer campaign pages, event registrations and newsletter sign-ups each collect data on different terms. The VPO aligns what you promise at collection with what development actually does afterwards.
Wealth screening and prospect research ethics
Screening donors through iWave-style tools without a transparency and governance framework invites exactly the reputational harm the Blackbaud exposure demonstrated. The VPO sets the rules before the major-gifts team runs the next batch.
Anonymity and stewardship promises
Donors who give anonymously, in memoriam, or through bequests carry explicit and implied confidentiality expectations, reinforced by Imagine Canada's Standard C3. Someone has to make those promises operational in the CRM.
Beneficiary and volunteer information flows
Intake forms, case notes, vulnerable-sector checks and emergency contacts move between program staff, spreadsheets and paper. The VPO defines who may see what and for how long.
Requests, inquiries and complaints
When a donor asks what you hold about them, or a program participant wants a record corrected, the VPO runs a documented process instead of an improvised email thread.
Regulatory map
The legal patchwork your privacy officer must navigate
Charities sit in the least intuitive corner of Canadian privacy law, where the honest answer to which statute applies is that it depends, and getting the dependency wrong is expensive in Quebec.
The PIPEDA commercial-activity boundary
Fees, newsletters and fundraising are not commercial activity in the OPC's view, but list selling, bartering or leasing is, and findings against a subsidized daycare and an exam administrator show how fee-based services can cross the line. A VPO keeps your activities on the right side of it.
Law 25 duties for any Quebec footprint
The enterprise test catches most charities and foundations, bringing a published person in charge, privacy assessments for new systems, incident registers and pre-transfer assessments, with fines reaching $25,000,000 or four percent of turnover.
Two provincial PIPAs, two opposite answers
BC's statute expressly covers not-for-profits in everything they do, while Alberta exempts locally incorporated societies outside commercial dealings yet fully covers federal corporations. Your VPO documents which regime attaches to each branch, chapter and activity.
CRA retention as your records floor
Receipt duplicates kept two years past year-end, most other books six years, originals in Canada: the retention schedule the VPO maintains has to respect these floors before any privacy-minded deletion happens.
CASL consent tracking beyond the exemption
The fundraising exemption covers messages whose primary purpose is raising funds, and implied consent from a donation lasts two years. The VPO keeps the CRM's consent fields accurate so every send has a defensible basis.
What goes wrong
Failures ongoing privacy oversight prevents
Most sector incidents trace back to routine decisions made without a privacy lens, exactly what monthly oversight exists to catch.
Quiet scope creep in data use
A list shared with a partner campaign, a spreadsheet export for a mail house, an analytics pilot on donor data: each seems minor until it crosses the commercial-activity line or breaks a stewardship promise. The VPO reviews such moves in advance.
Retention drift in the CRM
Constituent records accumulate for decades because nobody owns deletion. When a breach eventually comes, the exposure includes every lapsed donor since the database was founded, multiplying notification and reputational costs.
An unprepared answer to a regulator
Alberta's commissioner expects notice without unreasonable delay when harm is real, and Quebec requires a maintained incident register. A VPO keeps the assessments and logs ready rather than reconstructing them under pressure.
Vendor promises nobody verified
Donation platforms and mail agencies handle your file under contracts signed years ago. Ongoing oversight includes rechecking what those agreements actually commit vendors to, a lesson the sector learned from Blackbaud the hard way.
Our vpo for charities & foundations
What the Virtual Privacy Officer delivers each month
The retainer translates standard VPO functions into charity operations, working through your ED, finance director and CRM administrator.
A designated privacy coach and named lead
One accountable expert your team, board and regulators can reach, who can serve as or support the Law 25 person in charge where required.
Compliance monitoring and risk assessments
Recurring reviews of campaigns, new tools and data flows against the statutes, standards and contracts that bind your organization.
Policy and agreement review
Donor privacy commitments, volunteer confidentiality terms and vendor clauses kept current as laws and platforms change.
Incident management protocol and support
A ready procedure for misdirected emails, vendor notices and mailbox compromises, with the VPO guiding assessment and notification decisions when something happens.
Training and human-risk assessments
Awareness sessions sized for staff and key volunteers, with seats included in the retainer, so the people touching donor data recognize the mistakes that cause sector incidents.
Audit-ready documentation
Registers, assessments and monthly reporting that satisfy an accreditor, funder or commissioner without a scramble.
How the engagement runs
How the VPO retainer begins and runs
Setup front-loads the legal mapping; the rhythm then follows your fundraising calendar.
Step 1
Applicability mapping
We chart which of PIPEDA, the PIPAs, Law 25, CRA rules, CASL and your contracts govern each activity and jurisdiction, producing the definitive answer to the which-law question.
Step 2
Baseline review of data practices
Collection points, CRM fields, consent records, retention reality and vendor list examined against that map, with gaps ranked by harm and effort.
Step 3
Standing privacy operations
Monthly coaching hours, policy updates, campaign reviews and complaint handling, scheduled light during giving season and receipting periods.
Step 4
Quarterly reporting to leadership
Progress, incidents, upcoming regulatory changes and decisions needed, delivered in language a volunteer board absorbs in ten minutes.
What it costs
VPO pricing for charities and foundations
The Virtual Privacy Office runs from $2,200 CAD per month on a twelve-month term, including ten monthly coaching hours, a designated privacy coach, incident management protocol, inquiries and complaints handling, policy review and training seats. For most charities that is a fraction of one junior hire, for a function no junior hire could cover.
Where your footprint is larger, say multiple provinces, a Quebec chapter, or a service arm holding beneficiary files, we scope additional hours honestly against the extra jurisdictions and systems. A short discovery call produces a firm quote.
Charities & Foundations: VPO questions, answered
For core activities, probably not. The OPC's position is that collecting donations, running newsletters and fundraising are not commercial activity, so PIPEDA does not attach to them. It does attach if you sell, barter or lease donor, membership or fundraising lists, and certain fee-based services have been found commercial in past cases. Absence of a statute is not absence of duty: contracts, accreditation standards and litigation risk still bind you, and provincial laws in BC, Alberta and Quebec may apply regardless.
By default the function falls on the person with the highest authority, typically your executive director, who may delegate it in writing. The title and contact information for the person in charge of the protection of personal information must be published, normally on your website. A VPO can carry the operational duties behind that title, preparing the assessments, register and responses the role demands, so the ED signs off rather than does it all.
Treat CRA as the floor, not the ceiling. Duplicates of official donation receipts must survive two years from the end of the calendar year they relate to, and most other books and records six years from the end of the last taxation year, kept at your Canadian address. Beyond those floors, a VPO sets defensible maximums so constituent records, bequest files and screening profiles do not linger indefinitely as breach liability.
Quietly compiling estimated-wealth and bequest-likelihood profiles is the practice most likely to shock donors if revealed, and those were the very fields stolen in the Blackbaud incident. Where BC PIPA or Law 25 applies, collection from third-party sources needs a lawful footing; everywhere, accreditation commitments and donor trust argue for transparency in your privacy statement, limits on what is recorded, and tight access. A VPO drafts that framework with your development team rather than against it.
November and December are deliberately quiet on the change front: no new policies, no system reviews mid-campaign. Instead the VPO stands by for live questions, watches incident channels while volume and temporary staff peak, pre-clears any late campaign data uses, and prepares the January receipting checks. Structural work resumes once receipts go out.
They solve different problems. A lawyer gives opinions on discrete questions and defends you in disputes; a VPO runs the ongoing function, from consent fields to incident registers to training, and knows when a question genuinely needs counsel. Most small charities need steady operational ownership far more often than formal opinions, and the retainer prices accordingly.
More for charities & foundations
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.