Nonprofit data licensing and privacy: a practical review guide

Nonprofits should review privacy before agreeing to license operational records. A useful review establishes whose information appears in the records, why it was collected, what the organization is permitted to do with it, and how a proposed recipient would use and protect it. Removing names is only one part of that work.

You can explore an opportunity without uploading a donor list, exporting a mailbox, or sending client files. Start with a description of your records and the questions you need answered. This guide provides a practical review process for U.S. nonprofit leaders; it does not determine whether a particular transfer is lawful.

Start with a specific proposal

“We protect your data” is too broad to evaluate. Before discussing a transfer, ask for a description of the proposed arrangement in ordinary language: the records requested, the reason for requesting them, the parties receiving access, the intended uses, and what happens afterward.

The answers may change the decision. A limited set of organizational training manuals presents different questions from several years of unrestricted email. A temporary review environment differs from permission to distribute copies to additional customers. A promise to remove identifiers after collection leaves a separate question about access to the original records.

Write down the proposed use before reviewing permission. Otherwise, different people may approve different versions of the opportunity without realizing it. The introduction in data licensing for nonprofits explains the commercial process and where an initial referral fits.

Inventory information without making a new sensitive archive

Ask each department to describe relevant collections in place. Record categories, approximate dates, systems, and the person who understands them. The first inventory can be a list of collections; it does not need copies of the underlying documents.

Separate the organization's knowledge from information about identifiable people. A program manual might contain reusable procedures alongside a real client's story. A spreadsheet described as “attendance totals” might have a hidden sheet with individual names. Labels supplied by a department are a starting point for review, not proof of what a file contains.

Use this original worksheet to organize the discussion:

These actions are suggested review steps, not a finding that any collection can be licensed. Keep the inventory somewhere staff can maintain without broadly exposing confidential details.

Check permission separately from possession

An organization may control a system while lacking permission for a particular use of its contents. Identify the original reason for collecting information, the notices and agreements in effect then, and any later permissions that can actually be documented.

Keep distinct questions separate: who owns relevant copyright, what confidentiality obligations apply, what individuals were told, and whether a proposed commercial use is authorized. A staff member's ability to download files answers none of those questions by itself. Use the guide to ownership of nonprofit records for the intellectual-property side of this review.

Historical promises deserve attention even when the proposed project seems beneficial. The FTC's discussion of changing privacy commitments for AI training warns companies against quietly expanding uses after collection. FTC jurisdiction has exceptions, including for some nonprofits; the source is not a universal nonprofit rule. Ask counsel which commitments and laws govern your organization.

Identify applicable rules without assuming an exemption

Your nonprofit's status, activities, funding, location, relationships, and the people represented in the records all matter. A general privacy-law answer may miss a program-specific duty or an agreement with a school, clinic, funder, or government agency.

For example, the Colorado Attorney General expressly includes qualifying nonprofits within the Colorado Privacy Act. That does not mean every nonprofit falls within it. It does mean that “we are a nonprofit” is not a complete analysis.

Record the question and assign it to someone qualified to answer it. Avoid asking a program manager to declare a collection “compliant” without knowing the proposed recipient and purpose. Identify unresolved legal questions before anyone promises delivery.

Ask what de-identification will actually accomplish

Determine who would perform de-identification, when it would happen, which information it would address, and how the result would be evaluated. Ask what the recipient could infer from the remaining context, including information it already holds.

The HHS de-identification guidance explains that even properly applied HIPAA methods retain some identification risk. HIPAA rules apply in their own defined context; they are not a universal certificate for nonprofit records. The comparison of de-identification and anonymization provides questions for evaluating these terms.

Request evidence proportionate to the collection. A statement that software “automatically scrubs everything” does not explain how unusual names, attachments, dates, or narrative details are handled. Ask who resolves errors and what happens if the proposed approach cannot adequately address a sensitive category.

Draw the entire access path

Make a simple list of every stage: initial review, preparation, transfer, processing, use, onward access, storage, and closure. For each stage, identify the responsible organization and the information it receives.

This exercise often reveals that a conversation about a final dataset has skipped the original upload. If identifiable records would be sent to a provider for preparation, review that first disclosure as well as the later output. Ask whether a narrower method could answer the evaluation question without granting broad access.

NIST's guidance on de-identifying datasets discusses release risks and different sharing models. It is technical guidance for government agencies, not a legal approval for this transaction. For your review, compare the proposed arrangement with realistic alternatives, including limiting the scope or deciding not to share a collection.

Get answers that can be checked

The following questions make a useful meeting agenda. Ask for written explanations and the relevant contract provisions rather than treating a sales presentation as the final agreement.

1. Which exact record categories are requested, and which are excluded?
2. Who can see identifiable originals before any transformation?
3. What uses are permitted, including training, evaluation, redistribution, or product development?
4. Can another organization receive the records, and under whose responsibility?
5. What prevents prohibited uses, and how would a problem be investigated?
6. How long are originals, working copies, backups, and outputs retained?
7. What can be deleted or withdrawn, at which stage, and with what limitations?
8. Who contacts the nonprofit if information is exposed or used incorrectly?
9. Who pays for preparation, specialist review, and required corrections?
10. What happens if only a small subset passes review?

Missing answers are useful findings. They identify the work required before a decision. Put them into the agreement review checklist so they remain visible when commercial terms are discussed.

Consider the people affected by the decision

Legal permission and organizational acceptability are related but distinct. Ask whether the proposed use fits the relationship people have with your nonprofit and whether you could explain it accurately without minimizing what happens.

For a community organization, a technically permissible use might still undermine trust if participants reasonably understood their stories to be shared only with their caseworker. Conversely, a carefully bounded organizational resource may raise fewer concerns than an archive of personal narratives. Evaluate the actual collection and proposed use rather than treating all records as equally sensitive.

Invite the program lead and a staff member who hears community concerns into the review. Depending on the circumstances, consider an appropriate way to obtain stakeholder input without exposing confidential records or making promises the organization cannot keep.

A hypothetical review that changes the scope

Imagine a workforce-development nonprofit considering a request for historical documents. Its first inventory lists training materials, employer correspondence, and participant case notes. No offer or outcome is assumed in this example.

The operations lead identifies a limited collection of organization-written manuals. The program lead identifies confidential participant narratives mixed into some examples. The finance lead finds a grant agreement that needs review. Instead of exporting the whole shared drive, the organization records these questions and asks whether an evaluation can begin with descriptions of the manuals.

That is a useful result even if no transaction follows. The nonprofit has narrowed the proposed scope, assigned unanswered questions, and prevented an early conversation from becoming an unexamined disclosure. Further review could still conclude that the material should not be licensed.

Record a decision, including a decision to pause

Create a brief decision record with the collection and version considered, proposed uses, evidence reviewed, unresolved issues, responsible people, and approval conditions. Distinguish permission to explore from permission to transfer. Name the person authorized to make the next decision.

The National Council of Nonprofits' board guidance places prudent asset use, mission, and conflicts within board oversight. Whether a specific transaction requires a board vote depends on the organization's circumstances and authority structure.

A workable outcome may be “continue with questions,” “consider a narrower collection,” or “do not proceed.” Avoid assigning a green label to a project merely because no one has yet identified a problem. Revisit the decision if the requested records, recipient, or permitted uses change.

Explore the next step without sending records

Datifide provides free initial guidance and referral support. Its intake asks for organization information and estimates, not operational files or passwords. With the permission given at intake, Datifide may forward the submitted information to one selected partner; a later process determines whether any records are licensed.

Before starting, note your major privacy questions and any categories you want excluded. You do not need to solve every issue to ask about the opportunity, but an initial conversation should never be presented as clearance to transfer sensitive material.