Nonprofit Data Protection Policy Generator

A donor writes a cheque. A refugee family receives resettlement support. A volunteer undergoes a DBS check. A campaign supporter signs a petition. Four interactions, each generating personal data of vastly different sensitivity levels. Compass Community Trust processes data from the widest range of sources of any organisation type, and the beneficiaries at the heart of its mission are often the most vulnerable individuals in society. This policy ensures every piece of data is protected proportionately.

Programme delivery staff, fundraising teams, volunteer coordinators, advocacy staff, communications teams, grant administrators, and board members are all covered.

Beneficiaries provide names, contact details, case histories, needs assessments, vulnerability indicators, and programme participation records. Donors share names, giving histories, payment information, and gift aid declarations. Volunteers furnish contact details, DBS check results, and training records. Campaign supporters provide names, political views, and petition signatures. Employees have payroll records and safeguarding training on file. Suppliers share contact and payment details.

Compass Community Trust operates under data protection legislation alongside charity law, fundraising regulations, and safeguarding legislation. Beneficiary data frequently constitutes special category data. The organisation applies the highest protection tier to all beneficiary data regardless of strict legal classification, as a matter of ethical obligation to those it serves.

Compass is the data controller. Where programmes are delivered in partnership, data sharing agreements document each party's obligations. CRM, volunteer management, programme delivery, payment, and email communication platforms operate under processor agreements. Community programme platform agreements include heightened security reflecting participant vulnerability.

A Record of Processing Activities covers beneficiary intake through programme delivery, fundraising, volunteer coordination, and advocacy. Impact assessments are mandatory for programmes involving vulnerable beneficiaries, donor wealth profiling, advocacy tools collecting political opinions, or beneficiary outcome tracking shared with funders. Staff and volunteer training covers beneficiary vulnerability, information sharing protocols, safeguarding confidentiality, donor stewardship ethics, and the prohibition on using beneficiary stories without explicit informed consent.