Consent before sharing nonprofit records: a review checklist

Before sharing nonprofit records for a new licensing purpose, compare the proposed use with the permission and commitments that actually apply to those records. Consent to receive a service, appear in a newsletter, or participate in an evaluation should not automatically be treated as permission for unrelated commercial use.

Whether new consent is required, who must provide it, and what makes it valid depend on the records, people, applicable laws, and agreements. Some proposed uses may remain inappropriate or prohibited even if a general permission form can be signed. The practical first step is to define the use and identify the evidence.

Describe the new use before asking about permission

A request to “use data” does not give an adviser or an affected person enough information. Describe what material is involved, who will receive it, what they intend to do, and whether they may give it to others.

Separate evaluation from later activity. Permission to examine a limited description is different from permission to receive original records. A limited review is also different from training a model, developing a commercial product, or redistributing a dataset.

If the recipient cannot yet explain the proposed uses, note that as an unresolved issue. Do not ask people to agree to language the organization itself cannot explain. The privacy review guide helps map the stages involved.

Build a purpose-and-permission worksheet

Use the following original worksheet to assemble facts for the person reviewing the proposal. Complete it separately for collections gathered under materially different notices or agreements.

Do not include unnecessary personal details in this planning worksheet. Link authorized reviewers to the underlying evidence using your existing internal controls. An empty evidence field is a review question, not proof that no restriction exists.

Keep historical versions intact

Find the language that applied when the records were collected. Current website text may differ from a notice used several years ago. If multiple versions were used, identify which collections belong to each version rather than applying the newest wording to everything.

The FTC's discussion of changing privacy policies for AI training warns companies against quietly expanding earlier commitments. Its jurisdiction does not cover all nonprofits in the same way, but the underlying factual question is valuable: what did this organization actually promise?

Retain evidence of any later permission and its scope. Record what it covers, when it was obtained, and what limits remain. Do not describe an undocumented conversation as a blanket authorization because the person generally supported the mission.

Recognize that secondary uses can trigger different rules

Oregon DOJ's nonprofit FAQ explains consent requirements for covered organizations using personal data for certain secondary purposes. It also distinguishes maintaining historical information from processing it in new ways. This is a state-specific example, not a rule that every U.S. nonprofit can apply without analysis.

Ask your adviser to consider the people represented, their locations, the organization's activities, the type of information, and any program-specific obligations. The same nonprofit can hold collections subject to different conditions.

Consent is one part of that review. It does not automatically resolve copyright ownership, contractual restrictions, or an organization's authority to approve a transaction. Keep those questions visible rather than using one document to stand in for every permission.

Make any proposed explanation understandable

If the review concludes that a consent process is appropriate, work with qualified advisers on the actual language and method. This article is not a ready-to-use legal consent form.

As an internal clarity exercise, write answers to these questions in ordinary language:

• What information would be used, and what would be excluded?
• Who would receive it, and why?
• What benefits and limitations can the organization honestly describe?
• What choice does the person have, and what happens if they decline?
• How can they ask questions or exercise any applicable rights?
• What can change later, and what cannot realistically be undone?

Have someone outside the project read the explanation. Ask them to describe the arrangement back to you. If the explanation produces a materially different understanding, the team needs to revise it or resolve the terms.

Consider relationships and power

People may feel pressure to agree when they depend on a nonprofit for assistance, employment, housing, or another important service. Evaluate that context with the program team and relevant advisers. A signed box does not by itself show that the organization has addressed every concern.

Keep the discussion proportionate to the collection and the proposed use. Do not ask people for broader permissions just because a future use might someday be convenient. Consider whether excluding a category would meet the project's needs while avoiding a difficult or unsuitable request.

For sensitive services, consult the sensitive-records guide before assuming that a general consent approach is available. Program-specific confidentiality obligations may require a different analysis.

Plan for changes, refusals, and questions

Before collecting new permissions, determine how the organization would record limits and ensure they affect the actual selection of records. A process that stores a refusal but does not prevent an export creates an obvious operational gap.

Ask what happens if the recipient, use, or scope changes. Identify who reviews the change and whether the existing permission still applies. Make sure staff know how to route a withdrawal request or complaint without promising a result that depends on law, timing, and the agreement.

The agreement checklist helps connect these questions to recipient obligations. Written promises and operational procedures need to tell the same story.

A hypothetical comparison

Imagine a fictional nonprofit with interviews collected to evaluate one program. The original explanation described internal improvement and a public report containing selected approved quotations. A later proposal would use interview transcripts in a commercial training dataset.

The organization identifies the difference in purpose and recipient. It does not treat the original participation agreement as automatically sufficient. Review might lead to a narrower proposal, an appropriate additional permission process, or a decision to exclude the transcripts.

The example illustrates the method, not a legal outcome. The relevant decision depends on the actual documents, circumstances, and applicable rules.

Keep Datifide intake permission separate

Datifide's initial form concerns submitted organization information and an initial referral. With the permission given there, Datifide may forward those details to one selected partner. That permission does not authorize licensing the nonprofit's operational records or expand permissions previously given by donors, employees, or participants.

Use the readiness checklist to organize known questions before starting. No files or passwords are required at intake. A later agreement and the nonprofit's own review determine whether a record-level proposal can proceed.