Nonprofit Donor Data Security: The Hidden Cost of “Free”

Send us Fan Mail Nonprofit donor data security starts with the everyday tools your team uses . . .and “free” can come with a very expensive plot twist! Dan Hernandez of PCS Technology connects cybersecurity, AI policies, and smarter IT budgeting to protecting donor trust, preventing payment fraud, and keeping services running. That discounted software looked like a win. The volunteer’s personal email seemed convenient. And the enthusiastic intern connecting AI to your CRM? Just trying to help! Each decision deserves a closer look at who controls your information, what support costs, and how your organization would recover if something went wrong. Dan put nonprofit cybersecurity strategy where it belongs: alongside finance, fundraising, governance, and mission delivery. He shares a St. Vincent de Paul project that he says saved approximately $40,000–$50,000 annually by reducing licensing costs and streamlining processes. The research behind the discussion adds urgency: UC Berkeley’s CyberCAN study surveyed 68 San Francisco nonprofits, and 85% reported at least one cyberattack. Those findings describe the surveyed organizations, but the management questions travel well. We explore nonprofit AI data privacy, personal accounts, board impersonation scams, and the payment requests that arrive dressed as urgent executive instructions. Dan’s memorable finance rule: “Never change a payment from an e-mail.” Verify payment changes by calling a known number before money moves. You’ll also hear why nonprofit data breach response planning needs leadership involvement, protected backups, and a donor communication strategy. As Dan puts it, “It can be a very expensive day if you have a hacking incident.” Watch this with your finance, development, and operations teams. Key Takeaways: - Compare software’s total operating cost, including administration, support, and security. - Keep organizational email and donor information under organizational control. - Approve AI tools and review data settings before connecting business systems. - Verify payment changes by phone using a previously known number. - Train board members to recognize urgent executive impersonation requests. - Assign incident response roles and prepare recovery and donor communications. 00:00:00 Donor data breaches: the business risk 00:01:30 Meet Dan Hernandez of PCS Technology 00:02:34 Why nonprofits become cyberattack targets 00:04:19 IT strategy belongs in mission strategy 00:07:30 When discounted software becomes expensive 00:11:28 Personal email, free tools, and data ownership 00:12:23 AI policies and the helpful-intern problem 00:16:28 Device security and payment fraud prevention 00:18:01 Board cybersecurity and executive impersonation scams 00:21:34 Updates, protected backups, and recovery 00:22:56 Data breach response and donor communications #NonprofitCybersecurity #DonorDataSecurity #TheNonprofitShow Find us Live daily on YouTube! Find us Live daily on LinkedIn! Find us Live daily on X: @Nonprofit_Show Our national co-hosts and amazing guests discuss management, money and missions of nonprofits! 12:30pm ET 11:30am CT 10:30am MT 9:30am PT Send us your ideas for Show Guests or Topics: HelpDesk@AmericanNonprofitAcademy.com Visit us on the web: The Nonprofit Show