Non-Profit Data Governance: Protecting Trust in 2026

For non-profits, good data governance isn’t a luxury anymore. It’s fundamental to keeping donor trust and making sure your operations don’t fall apart. As more people scrutinize how organizations handle sensitive information, you have to establish clear policies and solid systems for managing your data. The question is, how do you build a data governance framework that actually protects your mission and the people you serve?

Step 1: Define Your Data Governance Framework in Salesforce NPSP

The first real step is to define and document your non-profit’s data governance policies inside your main data system. For a lot of non-profits, that’s Salesforce Nonprofit Success Pack (NPSP). We’re not writing abstract policies to sit in a binder. We’re configuring your CRM with actual settings, fields, and user permissions that will enforce those policies automatically.

1.1 Establish Data Classification Levels

Inside Salesforce NPSP, you need to go to Setup > Object Manager and select the “Contact” object. You’re going to create a custom picklist field called “Data Sensitivity Level.” This field’s entire job is to classify each contact record based on the info it holds. The options should be very clear: “Public” (for things like publicly listed contact info), “Internal” (maybe for volunteer history), “Confidential” (donation amounts, personal notes), and “Restricted” (health information, legal case details). This classification system is the foundation for all your access controls.

Once that field is created, head over to Setup > Security > Field Accessibility. Here, you’ll go through each user profile and set who can see and edit this new “Data Sensitivity Level” field. Your Data Governance Officer or a specific senior manager should be the only one with “Edit” access. Everybody else gets “Read-Only” or “Hidden,” which is how you maintain the integrity of the classification.

1.2 Implement Role-Based Access Controls (RBAC)

The security model in Salesforce NPSP is flexible, which means you can dial it in precisely. Go to Setup > Users > Profiles, where you’ll see your various profiles like “Standard User,” “Marketing User,” “Fundraising User,” and “Program Staff User.” You need to review and tweak the object permissions for “Contacts,” “Accounts,” and “Opportunities” for each one. For instance, a “Program Staff User” might need to read all contact records, but they should only have “Edit” rights on custom objects related to program beneficiaries, not donor financial data. On the flip side, a “Fundraising User” needs to edit “Opportunity” records but should probably have “Read-Only” or zero access to confidential data about program participants.

Next, go to Setup > Users > Permission Sets to create more granular access rules. You could create a “Confidential Data Viewer” permission set that grants “View All” on the “Contact” object but only for records marked as “Confidential.” You then assign these permission sets to specific users, not the profiles themselves. This gives you way more flexibility and helps you stick to the principle of least privilege, meaning a user has access only to what they absolutely need to do their job. So many organizations get this wrong by granting overly broad permissions, which just erodes data trust.

1.3 Configure Data Retention Policies

You can’t keep sensitive data forever. In Salesforce NPSP, handling this takes a mix of process and automation. While Salesforce doesn’t have a built-in “auto-delete after 7 years” button for every record, you can build your own automation. Go to Setup > Process Automation > Flows and create a new scheduled flow to run monthly. This flow can be set up to query “Contact” records where the “Last Activity Date” is older than seven years and the “Data Sensitivity Level” is “Confidential,” and then automatically update a custom field called “Ready for Archival/Deletion” to “True.”

A designated Data Steward would then review these flagged records each quarter. For the actual deletion or archival, you’ll probably want a third-party app from the Salesforce AppExchange that’s built for data archiving and deletion, especially if you need to comply with GDPR or CCPA. These tools plug into NPSP and give you a full audit trail of what was disposed of and when, which is essential for accountability. If you don’t have a clear, technically enforced retention policy, you’re just hoarding risk.

Step 2: Implement Data Quality and Integrity Measures

Bad data leads to bad decisions, but for non-profits it’s worse: it destroys trust. Keeping your data clean is a constant effort that requires both proactive setup and reactive cleanup inside your NPSP environment.

2.1 Standardize Data Entry with Validation Rules

Consistency in data entry is everything. In Salesforce, go to Setup > Object Manager > Contact > Validation Rules. This is where you create rules that force good data at the point of entry. For example, you can set up a validation rule to check that the “Email” field actually contains a valid email format using something like REGEX(Email, "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"). You could make another rule that ensures “Phone” fields only have numbers and are a certain length, stopping typos before they happen. You can also make rules that require a “Donation Date” to be filled out if a “Donation Amount” is entered.

These rules prevent the most common errors. I’ve seen orgs where phone numbers were a mess of dashes, spaces, and parentheses, making it impossible to run any kind of automated outreach. Validation rules fix this from the start. This proactive work saves a ton of time on data cleaning down the road.

2.2 Use Duplicate Management Rules

Duplicates are a constant headache for non-profits, causing you to send redundant emails and messing up your reports. In Salesforce NPSP, head to Setup > Data > Duplicate Rules and create a new rule for “Contact” records. You can configure matching rules to find duplicates based on combinations like “First Name + Last Name + Email” or “First Name + Last Name + Phone Number.” Set the rule to “Block” or “Alert” on create and edit. Blocking is usually the better option for critical donor records because it stops the duplicate before it’s even created.

You should also look at the “Matching Rules” section under Setup > Data > Matching Rules. Here you can create custom rules that are more specific to your org’s data. For instance, if you get a lot of donations from couples who share a last name and address, you might want a matching rule that looks at “Last Name + Street Address” but ignores the first name, flagging those records for a person to review instead of automatically trying to merge them. Getting this nuance right is how you avoid accidentally merging two different people.

2.3 Regular Data Audits and Cleaning

Even with good validation and duplicate rules, data gets messy over time. You should schedule data audits every quarter. NPSP can help here. You can create custom reports for things like “Contacts with No Activity in X Months” or “Contacts with Missing Email Addresses” that show you exactly where to focus. Assign a dedicated Data Steward or a small team to review these reports and fix things, whether that means updating contact info, merging duplicates, or archiving records that are just collecting dust. For bulk work, a tool like Data Loader is your best friend for exporting and updating records during these cleaning cycles.

Step 3: Establish Data Security Protocols

Access controls are just one piece of the puzzle. Real data trust comes from having security measures in place to protect against actual breaches and unauthorized access. And this thinking has to apply to your whole tech stack, not just Salesforce.

3.1 Enforce Strong Authentication and Network Security

You absolutely must mandate Multi-Factor Authentication (MFA) for every single Salesforce user. In Salesforce, go to Setup > Identity > Session Settings and make sure the setting “Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org” is checked. It’s a simple change, but it’s one of the most effective things you can do to reduce the risk of someone getting into your system who shouldn’t be. A Microsoft report found that MFA can block over 99.9% of automated attacks.

Beyond Salesforce, your internal network needs to be locked down with firewalls, intrusion detection systems, and regular vulnerability scans. If your non-profit handles sensitive information like health data, for example, your network infrastructure must meet HIPAA standards. This usually means hiring a specialized IT security firm in the Atlanta metro area (or wherever you are) to run penetration tests and compliance audits. You can’t just assume your network is secure, you have to get it verified.

3.2 Implement Data Encryption at Rest and in Transit

Salesforce already encrypts data being sent back and forth using TLS 1.2 or higher, and data stored on their servers is encrypted by default. But for extremely sensitive data, you should look at Salesforce Shield Platform Encryption. It’s an add-on that lets you encrypt specific fields with your own key, adding another security layer. To set it up, you’d go to Setup > Platform Encryption > Encryption Policy and choose which fields to encrypt, like “Social Security Number” (if you have to collect it) or “Bank Account Number.” Just be aware that once a field is encrypted like this, certain functions like searching or filtering can act differently, so you need to plan it out.

For any data you store outside of Salesforce, like in Google Drive or SharePoint, you need to ensure it has equivalent encryption. Always double-check that data is encrypted both where it’s stored (at rest) and while it’s being sent between systems (in transit).

3.3 Develop a Data Breach Response Plan

No system is 100% bulletproof, so you have to have a well-defined data breach response plan ready. This plan needs to be written down and should include:

1. Identification: How will you know a breach happened? (e.g., security monitoring alerts, user reports).
2. Containment: What are the first things you’ll do to stop the bleeding? (e.g., shutting down affected systems, forcing password changes).
3. Eradication: How will you get rid of the cause of the breach? (e.g., patching a vulnerability, removing malware).
4. Recovery: How will you get your systems and data back to normal? (e.g., restoring from backups).
5. Notification: Who do you need to tell, and how? This includes the people affected, regulators (like your state’s Attorney General), and your board.
6. Post-Breach Review: What went wrong, and what can we learn to stop it from happening again?

This plan needs to be documented, shared with the right people, and tested every year with a tabletop exercise. A quick, transparent response to a breach can make a huge difference in managing reputational damage and keeping donor trust.

Step 4: Ensure Ongoing Compliance and Training

Data governance isn’t a project you finish. It’s a discipline you practice, and it requires constant attention and education.

4.1 Regular Policy Reviews and Updates

Data privacy regulations are always changing. You need to review your non-profit’s data governance policies at least once a year, and definitely anytime a major new law is passed (like a new state privacy act). This means sitting down and comparing your internal rules against what the law currently requires. For instance, if you get donations from anyone in Europe, your policies must comply with GDPR. If you operate in California, you have to follow CCPA. You should get legal counsel that specializes in data privacy to make sure your policies are current and legally sound. This is a legal necessity.

4.2 Mandatory Staff Training

Your technical controls are only as good as the people using the system. You need to run mandatory annual training for all staff on data privacy, security basics, and how to properly use Salesforce NPSP. The training should be interactive and use real-world scenarios from your own non-profit. For example, show someone how to correctly redact information from a document before sending it, or how to spot a phishing email that looks like it’s from a board member. You should track who has completed the training and send out reminders. You can even use your NPSP instance to track this.

4.3 Monitor and Audit Data Access

You need to be watching who is accessing your data. In NPSP, go to Setup > Monitor > Login History and Setup > Security > Event Monitoring (if you have it). These logs tell you who accessed what, when they did it, and from where. Keep an eye out for weird login patterns, people trying to access restricted data, or massive data exports. You can set up automated alerts for suspicious activity, like a notification that fires if a user tries to export more than 1,000 contact records at once. This kind of proactive monitoring helps you catch potential problems before they blow up.

Pro Tip: Seriously consider a “clean desk” policy in your office. Physical security is just as important as digital. That means no sensitive donor lists left on desks and no passwords on sticky notes attached to monitors. It sounds basic, but physical breaches are a real thing.

Step 5: Integrate Third-Party Tools Securely

Most non-profits use a lot more than just one system. When you integrate other tools like email marketing platforms or donation processors, you have to pay close attention to data governance.

5.1 Vet Third-Party Vendors Thoroughly

Before you connect any new tool to Salesforce NPSP, you need to vet the vendor. Ask them direct questions about their security:

• Are you SOC 2 compliant?
• Do you encrypt data at rest and in transit?
• What are your data retention policies?
• Do you have a data breach response plan?
• Where do you physically store data?

Get copies of their security certifications and actually read their privacy policies. Don’t skip this due diligence. A weak link in your supply chain is your weakness. For example, if your email marketing platform has sloppy data handling, that’s now your problem. Don’t just click “accept” on the terms of service. Read them.

5.2 Configure Secure Integrations

When you connect a tool to NPSP, lock it down using the principle of least privilege. Give the integration only the permissions it needs to do its job, and nothing more. If your email platform just needs to read contact names and emails, don’t give it “Edit” access to donation records. You should also use a dedicated integration user in Salesforce with a specific, limited permission set, instead of just using an admin’s login. This contains the damage if that integration account ever gets compromised.

You should also regularly check your connected apps in Salesforce (Setup > Apps > Connected Apps OAuth Usage) to see what’s hooked into your system. Revoke access for any tools you’re not using anymore. Every unused connection is a potential backdoor you don’t need.

Getting your data governance framework right ensures that every donation and every program interaction is built on a foundation of trust and transparency. It’s an ongoing effort, but it’s what safeguards your mission and in the end strengthens your impact. For more ideas on improving your digital strategy, check out these approaches for non-profit marketing.