Non-profit websites collect some of the most sensitive personal data on the internet – names, home addresses, payment details, giving history and often clues about a donor’s health, religion or politics – usually with a team of three people and a volunteer who “knows WordPress.” Getting compliance right for non-profit websites and donor data means applying GDPR compliance, payment security and consent rules to your donation forms, CRM integrations and tracking tools, whatever your charitable status. This article covers which laws actually apply, where donor data leaks on a typical charity site, and how to set up compliance monitoring that a small team can maintain.
The Myth That Charities Are Exempt
The most persistent misconception in the sector is that non-profit status brings a lighter regulatory load. Under GDPR it doesn’t. The regulation applies to any controller processing personal data, and a registered charity is no different from an online shop.
The UK regulator has already made this clear. In 2016 and 2017 the ICO fined a number of well-known charities, including the RSPCA and the British Heart Foundation, for wealth screening donors and matching data without telling them. The amounts were modest. The reputational damage was not.
The US picture is more mixed, and this is where the myth partly comes from. The CCPA applies only to for-profit businesses, so a California-based charity may genuinely be outside its scope. Several newer state laws take a different approach: Colorado’s Privacy Act covers non-profits that meet its thresholds, and Oregon, Delaware and New Jersey have extended similar obligations to them. A US non-profit with donors in several states should check each law separately instead of assuming none of them apply.
Why Donor Data Is More Sensitive Than It Looks
A donation record is rarely just a name and an amount. A monthly gift to a mosque, a church, an LGBTQ+ advocacy group or a cancer research fund can reveal a donor’s religion, sexual orientation or health. That puts it in GDPR’s Article 9 special categories.
There is one real exemption here, and it’s an important edge case. Article 9(2)(d) allows not-for-profit bodies with a political, philosophical, religious or trade union aim to process special category data about their members and regular contacts. The data must not leave the organisation without consent, though. Once a Meta Pixel on the donation confirmation page sends “donated to [faith organisation]” to a third party, the exemption stops applying.
Where Donor Data Leaks on Non-Profit Websites
A seasoned data protection lead auditing a charity site usually starts with the donation flow, because that’s where the risk is concentrated. Picture a typical setup: a WordPress site running GiveWP or a Gravity Forms donation form, Stripe for payments, Mailchimp for newsletters, Salesforce Nonprofit Cloud or Beacon as the CRM, plus Google Analytics 4 and a Meta Pixel added by a marketing volunteer during a year-end campaign.
In that stack, donor data regularly ends up in four places nobody meant it to be. First, URL parameters, where amounts and email addresses show up in query strings that analytics tools then collect. Second, conversion pixels that fire before consent is given. Third, Zapier or Make automations that copy donor records into Google Sheets shared with personal Gmail accounts. Fourth, form plugin logs that store full submissions indefinitely.
Tracking tools deserve extra attention. Any tag that fires on a page whose URL or title reveals the cause – “/donate/hiv-support/thank-you” – can pass special category data to an ad platform. The mechanics are covered in more detail in our piece on third-party scripts and hidden data leaks.
Payment Security for Donation Forms
Card payments bring PCI DSS into scope, and version 4.0.1 has been fully enforceable since March 31, 2025. Requirements covering the scripts running on payment pages are the ones that catch non-profits off guard, because donation pages tend to carry more marketing scripts than a checkout page would.
Using a hosted Stripe Checkout page or an embedded iframe keeps most card data out of your environment and usually qualifies you for the shortest self-assessment questionnaire, SAQ A. It doesn’t remove your responsibility for the page that hosts the iframe. If an attacker injects a script into that parent page, they can swap the form or overlay a fake one. The PCI DSS essentials for card-handling sites explain which questionnaire fits which setup.
Common Mistakes Non-Profits Make
The first mistake is treating the annual website review as enough. Charity sites change constantly: campaign landing pages go live for Giving Tuesday, an agency adds a heatmap tool, a plugin update breaks the cookie consent banner. A consent tool that worked in January can be firing Meta Pixel before consent by March, and nobody notices until a donor complains.
The second is relying on consent where legitimate interest would be clearer, or the other way round. Many UK charities ask for consent to process all donor data and then struggle when donors withdraw it. Processing a gift and claiming Gift Aid usually rests on contract or legal obligation. Marketing emails fall under PECR, where charities have historically had no soft opt-in. The Data (Use and Access) Act 2025 extends the soft opt-in to charities, but only for supporters who gave their details while showing interest in the cause, and only if an opt-out was offered at that point.
The third is having no deletion process that covers the whole stack. A donor asks to be forgotten, the CRM record is deleted, and their details are still in Mailchimp, the Stripe customer list and a 2023 export on someone’s laptop. Some records can’t be deleted at all – HMRC expects Gift Aid declarations to be kept for up to six years – so the response has to explain what is retained and why. Our guide on the right to erasure goes through that workflow.
A Practical Setup for Small Teams
Organisations with fewer than 10 staff can’t run a full privacy programme, but they can cover the most important controls in a few days of focused work:
1. Map every system that receives donor data, including automations and exports, and record the legal basis for each purpose.
2. Load the donation pages in a clean browser with DevTools open, decline all cookies, and confirm that no marketing requests are sent.
3. Remove cause-revealing words from thank-you page URLs and titles, or exclude those pages from ad pixels completely.
4. Sign data processing agreements with Stripe, Mailchimp and your CRM vendor – most provide them as standard.
5. Set up continuous checks on privacy policy availability, consent behaviour, SSL certificate expiry and security headers such as Content-Security-Policy on donation pages.
The last step is the one that keeps the other four working. The failures that hurt charities are rarely deliberate. They’re drift – an expired certificate during an emergency appeal, or a privacy policy link returning 404 after a theme change.
FAQ
Does GDPR apply to a small volunteer-run charity?
Yes. GDPR applies based on processing personal data, not on organisation size or revenue. Small charities may be exempt from paying the ICO data protection fee in the UK, but they still have every other obligation.
Can we share donor lists with partner charities?
Only with clear, specific consent obtained for that purpose. Swapping or selling donor lists without it was among the practices that led to ICO enforcement against UK charities in 2016-2017.
Do we need a cookie banner if we only use Google Analytics?
In the EU and UK, yes – GA4 sets non-essential cookies that require prior consent. Some cookieless analytics tools, such as Plausible or Matomo configured without cookies, may not need consent, depending on the regulator.
Protecting Donor Trust Over Time
Donors give because they trust you, and a data leak through a donation page damages that trust faster than almost anything else. Start with the donation flow, since that’s where the sensitive data, the payment scripts and the tracking tags all meet. Check it again after every campaign launch, plugin update or agency handover – that’s when compliance gaps usually appear.