Розділ 6: Захист конфіденційної інформації
У цьому розділі ви навчитеся:
Protecting Sensitive Information
Your nonprofit collects and uses information to deliver programs, support clients, manage volunteers and maintain relationships with donors. Protecting that information means making thoughtful decisions throughout its life: what you collect, where you keep it, how you use and share it, and when you remove it.
The account and device safeguards covered earlier help prevent unauthorized access. This section focuses on how people handle information during everyday work, including avoiding accidental loss or disclosure.
A note about Canadian privacy requirements
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal private-sector privacy law. It generally applies to personal information handled in the course of commercial activities. Many nonprofits’ usual activities, such as collecting membership fees and fundraising, fall outside its scope. However, nonprofit status does not automatically exempt an organization: particular commercial activities can bring information handling under PIPEDA.
Whether or not PIPEDA applies, its principles provide a useful foundation: explain why information is collected, collect only what is needed, limit its use and sharing, protect it appropriately and retain it only as long as necessary. Applying these principles helps protect the people your nonprofit serves and supports their trust in your organization. Provincial or sector-specific privacy laws and contractual obligations may also apply, so these practices should support, not replace, checking your organization’s requirements.
Recognize what is sensitive
Client and participant information
Contact details, service records, health information or circumstances that could affect someone’s safety
Donor and financial information
Donation histories, banking details, payment records and financial documents
Staff and volunteer information
Applications, screening records, payroll and emergency contacts
Photographs and communications
Images, messages or mailing lists that reveal someone’s identity, location or connection to a service
Confidential organizational information
Contracts, internal plans, access instructions and documents entrusted to you by partners
Collect only what you need
Every piece of information you collect becomes something to manage and protect.
Before adding a question to a form, ask:
For example, an event registration may need an email address for updates without needing a home address or full date of birth.
The Office of the Privacy Commissioner of Canada recommends assessing the purpose and necessity of personal information before collecting it.
Explain how information will be used and follow the consent or other authorization requirements that apply to your organization. Information provided for one purpose should not automatically become available for unrelated uses.
Choose approved places to keep information
Agree where different types of information belong so staff and volunteers can find and protect the working records.
An approved location might be an organizational cloud service, a restricted program database or a secured filing cabinet. Its suitability depends on the information, available safeguards and how access is managed.
Avoid arrangements in which important records exist only in someone’s personal inbox, on an individual laptop or in an informal messaging app.
Cloud storage is not automatically private. Check who can access files, how sharing works and who manages the account.
Remember paper records too. Printed lists, intake forms and meeting notes need appropriate storage and disposal.
Limit unnecessary copies
Copies can accumulate in downloads, email attachments, spreadsheets and printed handouts. They may remain accessible after the original record has been updated or deleted.
Before making a copy, ask whether someone could work from the approved source instead. If a temporary copy is necessary, decide where it may be kept and when it should be removed.
A volunteer who needs to contact ten participants may not need a downloaded copy of the entire participant database.
Share deliberately
Before sending information or granting access, check who needs it, what they need and how it should be delivered.
Sending an attachment
Open the file and confirm its contents, then check the recipients before sending.
Emailing a group
Use an approved mailing tool or BCC where recipients should not see one another’s addresses. Check recipient fields carefully.
Sharing a document link
Restrict access to intended recipients and choose viewing or editing permissions appropriate to the task.
Preparing a report for a funder
Provide the information required; use totals or summaries where individual records are unnecessary.
Working with a partner
Confirm the purpose, authorization, information needed and agreed handling arrangements.
Publishing a photograph or client story
Confirm the appropriate permission and consider what the content reveals about the person.
A restricted link can give you more control than an attachment, but it still needs suitable permissions. Avoid “anyone with the link” access for sensitive information.
For particularly sensitive disclosures, build in a second check. This could be another authorized person reviewing the recipients and contents before release.
Include information entered into AI tools
Pasting text into an AI chatbot, uploading a spreadsheet or enabling a meeting-summary tool can disclose information to another service.
Before using a tool for organizational information, confirm:
A paid subscription or a setting that limits model training does not, by itself, establish that every use is appropriate.
Use fictional examples or remove identifying details when possible. Removing names alone may be insufficient: a combination of location, circumstances and other details could still identify someone.
Canadian privacy regulators recommend using anonymized or de-identified information where possible and entering personal or confidential information only when authorized.
Decide how long to keep information
Keeping everything indefinitely creates unnecessary work and exposure. Deleting information too soon can also interfere with services or obligations.
Establish a simple retention schedule:
Example: Client intake records
Example: To provide services and track client participation.
Example: Keep while the client receives services, then for the period required by law.
Example: Program coordinator
Check applicable legal, contractual, funding and operational requirements before setting periods. Retain records subject to an investigation or other requirement to preserve them.
Include temporary copies in your arrangements. Ask providers how deletion works, including what happens to retained backups. The next section will address backup planning in more detail.
Dispose of information appropriately
Deleting a visible file does not necessarily remove copies, shared access or information recoverable from a device.
Use disposal methods suited to the information and storage:
Assign responsibility so disposal is completed and documented where appropriate.
Report mistakes promptly
If someone sends the wrong file, exposes a distribution list, loses paperwork or makes a folder public, they should report it promptly—even if they are unsure whether anyone saw it.
Follow the organization’s response process to limit access or request secure deletion where appropriate. Record what happened rather than assuming that recalling an email or removing a link has resolved the exposure.
Section 9 will explain incident response and how to assess notification needs.
A suggested policy rule
Information must be collected for an identified purpose, stored in approved locations and accessible only to authorized people who need it. Sharing must use approved methods and disclose only the information required. Personal or confidential information may be entered into AI tools only for approved uses. Retention and disposal must follow the organization’s schedule, and possible loss or disclosure must be reported promptly.
Before adopting this rule, identify approved locations, sharing methods, AI uses, retention arrangements and the reporting contact.
Follow one set of information
Choose a familiar record, such as an intake form, volunteer application or donor list. Trace it from collection to disposal.
Висновок
До кінця цього розділу ви повинні:
- Identified information that needs restricted handling.
- Agreed where it belongs and how it may be shared.
- Established expectations for copies and AI tools.
- Assigned follow-up on retention and disposal.
Next, you will look at backups and recovery—so important information can be restored when it is lost, damaged or unavailable.
Розділ 7: Створення резервних копій та відпрацювання процедур відновлення
Резервні копії допомагають вашій некомерційній організації відновити важливу інформацію після втрати даних, виходу з ладу пристроїв або кібератак, гарантуючи наявність копій, які можна відновити, та наявність відповідальної особи за їх відновлення.
English 
French 
Chinese 
Spanish 
Ukrainian 