Nonprofits
Donor data protection for charities and NGOs.
Security built for mission-driven organizations
Donors, staff and the people a nonprofit serves entrust it with sensitive information. Practical monitoring and data protection help preserve that trust without demanding a large internal security team.
Duties
| Who asks | What they ask for | Security support | Not covered |
|---|---|---|---|
| Charity Commission | A prompt report of a significant data breach. | A signed record and case timeline. → | Filing the report. |
| PCI DSS | Protection of cardholder data on donation pages. | Card numbers caught before email or upload. → | The payment page itself. |
| Federal grantees, 2 CFR 200.303(e) | Reasonable measures to safeguard personal information. | Email and uploads checked before they leave. → | The single audit. |
| GDPR | Applicable personal-data breach reporting. | A case timeline and impact assessment. → | The notice decision and filing. |
| CRM vendor | Not applicable. | Not covered → | Data held inside the vendor’s systems. |
PCI DSS
Content inspection by a DLP can identify card and bank information on covered transfers. Handling rules help staff share what is needed while preventing or reviewing inappropriate disclosure.
Trustee duty
In England and Wales, trustees must report serious incidents, including significant data breaches, to the Charity Commission promptly. A signed SIEM record and case timeline let them report from evidence.
Account security
Spearphishing or spyware can leave an attacker using a legitimate account. Behavioral context from AI Detection helps reviewers spot changes in access and follow the supporting events.
Managed service
A managed provider can operate monitoring and data protection for the organization. Agree who reviews findings, who is contacted and who may authorize actions affecting the nonprofit’s work.
By rule
Charity Commission
A prompt report of a significant data breach. A retained incident timeline and protected source records help reviewers follow the evidence and decisions.
Federal grantees, 2 CFR 200.303(e)
Reasonable measures to safeguard personal information. DLP policies inspect covered transfers and apply the organization’s blocking or approval rules.
GDPR
Where notification is required, GDPR sets a 72-hour supervisory-authority timeline where feasible. A dated case record supports the assessment and reporting decision.
CRM vendor
CRM-provider records can contribute to an investigation where the service makes them available. The provider retains responsibility for its own systems, with evidence sharing defined in the service relationship.
Questions
Can donor bank details leave by email?
A DLP rule can stop them before the email is sent.
Can it spot a compromised account?
Unusual account or host activity flagged by AI Detection can provide a lead for investigation. The finding should show the evidence and relevant history so a reviewer can assess it.
We have no security staff.
A managed service can provide daily operation and review. The nonprofit still needs a named contact for business context and decisions that require its approval.
What stays with the organization?
The organization owns donor-data policy, provider relationships and reporting decisions. Confirm which CRM and donation-platform records are available to the monitoring service.
Guide
Do nonprofits need to follow PCI DSS?
Yes, if they take card donations. PCI DSS applies to anyone who stores, processes or transmits cardholder data.
When must a charity report a data breach?
In England and Wales, trustees report serious incidents to the Charity Commission as soon as reasonably possible.
How can nonprofits get security without staff?
A managed service provider can run monitoring and data protection for them.
How ARRTECH takes care of nonprofit security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
