Think for a moment about everything people have handed you. A new family fills out a card and writes down their address, their kids’ names and ages, maybe a note about a hard season they’re walking through. A donor sets up recurring giving and trusts you with a bank routing number. Someone asks the prayer team to hold something they’ve told almost no one else. A volunteer submits a background check. None of these people thought of it as handing over data. They thought of it as trusting you.
That trust is the real thing you’re protecting. The spreadsheets and the database and the giving platform are just where the trust happens to live. When we talk about protecting member and donor information, we’re not talking about a technical chore. We’re talking about a form of care — the same care you’d give if someone left their house key with you for the weekend. Guarding what people entrust to you is part of stewardship, right alongside how you handle the offering.
Here’s the freeing part, and it’s the single most important idea in this whole post: you cannot lose what you do not have. The most powerful thing you can do to protect people’s information is to collect less of it and keep it for less time. Every field on a form, every old spreadsheet, every archived inbox is something you’re now responsible for. So the question to ask about any piece of information isn’t “could this ever be useful?” — almost anything could. The question is “do we actually need this to do what we do?” If a volunteer form asks for a Social Security number that no one has looked at in three years, that’s not data you’re protecting. It’s data that’s quietly protecting no one and putting people at risk. Collecting only what you truly need is the closest thing to a magic wand you’ll find here.
Once you’ve trimmed down to what you genuinely use, the next habit is simply knowing where it lives. This sounds obvious, but most ministries have never actually mapped it. Member details might be in your church management software, but also in a deacon’s personal spreadsheet, in three or four staff inboxes, on a sign-up sheet someone photographed, and in a shared drive folder no one remembers creating. You can’t protect what you can’t find. Spend an afternoon writing down, in plain language, every place sensitive information sits: which platforms, which spreadsheets, whose inboxes, which shared folders. The Federal Trade Commission, in its guide “Protecting Personal Information: A Guide for Business,” makes exactly this point — knowing what personal information you have and where it’s stored is the foundation everything else rests on. You’re not doing anything fancy. You’re just turning on the lights.
With the lights on, two things usually become clear. The first is that too many people can see too much. Not out of any bad intent — access just accumulates. A volunteer who helped with one event three years ago still has the keys to the whole directory. The gentle fix is to let access follow need: the person who counts the offering sees giving records, the person who plans meals sees dietary notes, and neither needs the other’s information. Limiting who can see what isn’t about distrust. It’s about not asking people to carry a responsibility they never signed up for.
The second thing that becomes clear is that some of your most sensitive information is living in the most fragile places — a benevolence log on someone’s personal laptop, a donor list emailed around as an attachment, counseling notes in a plain document anyone with the link can open. This is where reputable platforms earn their keep. A well-chosen church management system or giving platform encrypts information, controls who can open it, and keeps it off random personal devices and out of unprotected spreadsheets. You don’t need to understand encryption to benefit from it; you just need to choose tools built by people who do, and then actually use them instead of the convenient workaround. Moving the benevolence records off the laptop and into the system your church already pays for is often the single most protective thing a small office can do in an afternoon. The National Council of Nonprofits, in its cybersecurity guidance for nonprofits, encourages exactly this posture — relying on trustworthy tools and sound basic practices rather than assuming your size makes you invisible.
Then there’s the part almost everyone forgets: letting go. Information doesn’t stop being a risk when you stop using it. The former volunteer’s file, the ten-year-old member list, the giving records from a program that ended — all of it sits there as risk with no remaining benefit. So build a simple habit of disposing of what you no longer need. Decide, in plain terms, how long you’ll keep different kinds of records, and then actually delete or shred them when that time comes. Old data you’ve responsibly let go of is old data that can never be lost, leaked, or misused.
The last habit costs nothing and buys enormous goodwill: be honest with people about what you keep. A short, plain sentence — “here’s what we collect, here’s why, and here’s how we protect it” — turns a vague unease into trust. People rarely mind that you hold their information. They mind being surprised by it.
You do not need to become a privacy lawyer to do any of this well. You don’t need to memorize regulations or buy expensive tools. A handful of sensible habits — collect less, know where it lives, limit who can see it, use good platforms, throw out what you don’t need, and tell people the truth — covers the large majority of the real risk. The rest is just the ordinary faithfulness of taking care of what you’ve been given.
If you’d like a simple, plain-English starting point, MissionDefend is building a free assessment to help churches and nonprofits see where their information lives and where the gaps are. You can get on the launch list and be first in line when it opens.
Sources
- Federal Trade Commission, “Protecting Personal Information: A Guide for Business” (ftc.gov)
- National Council of Nonprofits, cybersecurity and data-protection guidance for nonprofits (councilofnonprofits.org)
- National Institute of Standards and Technology, Small Business Cybersecurity Corner (nist.gov)