Non-profit data protection checklist
Work through this at launch, once a year, and whenever you add a form, a list or an outside service. Each line links to the page that explains it. The explanation is in Donor and volunteer data protection.
Note
Basics, not legal advice. Your data protection officer or lawyer decides what your law requires.
Contents
- Inventory
- Collect less
- Access
- Retention and deletion
- Consent
- Processors and the privacy notice
- Requests from people
- Exports, backups and incidents
- Sign-off
Inventory
- To do: Every place personal data lives is listed: submissions, accounts, orders, subscriptions, logs, audit trail, search phrases, exports, backups (Personal data in Exponential).
- To do: Each has an owner in the organization.
- To do: Records of processing kept, if your law requires them (Records of processing).
Collect less
- To do: Every form field has a purpose (Volunteer form field worksheet).
- To do: No sensitive data (health, religion, immigration status) collected through the website without a decision by the data protection contact.
- To do: Search statistics only on if used (Measuring outcomes).
Access
- To do:
infocollector/readonly for coordinators. - To do: Shop and newsletter administration only for named people.
- To do:
audit/readonly for administrators. - To do: Two-factor login for everyone with access to personal data (Two-factor login).
- To do: Accounts of leavers disabled (When volunteers leave).
Retention and deletion
- To do: A written retention period per kind of data (Data retention and deletion).
- To do: Old submissions removed on schedule (Processing volunteer applications).
- To do: Event sign-ups deleted after the event.
- To do: Backup rotation known, so deleted data also leaves backups in time.
Consent
- To do: Newsletter by double opt-in only; donors not added without their own subscription (Opt-in and consent).
- To do: Unsubscribe link in every edition (One-click unsubscribe).
- To do: Consent wording next to checkboxes on forms (Consent and forms).
- To do: Cookies and analytics: consent handled where required (Cookie banners and consent).
- To do: Photos of people published only with permission.
Processors and the privacy notice
- To do: Privacy notice names: host, payment provider or donation platform, mail delivery, CAPTCHA provider, analytics, maps and video, AI provider if used (Privacy notice outline).
- To do: Data processing agreements in place where required.
- To do: Where data is stored (country) known for each processor.
Requests from people
- To do: A named person handles access, correction and erasure requests (Right of access, Right to erasure).
- To do: Requests and answers logged (GDPR request log template).
Exports, backups and incidents
- To do: CSV exports deleted after use; the audit trail records each export with its row count (Collected information).
- To do: Backups stored securely, with restricted access.
- To do: A plan for a data breach: who decides, who informs whom, within which time (Incident notes template).
Sign-off
Data protection contact .................. date ________
Director ................................. date ________
Next review .............................. date ________Related pages
- Non-profit checklists
- GDPR basics
- Privacy by design checklist
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.