Every non-profit makes a promise: "your information is safe with us." Donors, volunteers and the people you help rely on that promise. But it only holds if your organisation controls where that information goes. When your email and files run on a platform you don't control, part of your promise is in someone else's hands.
A garden full of personal data
Take Riverside Community Garden, a small charity that runs a shared garden, cooking classes and a food-sharing programme. Five volunteers keep it going. On the surface, they grow vegetables. Behind the scenes, they hold a surprising amount of personal data:
- Donors — names, addresses, bank details, how much they give.
- Volunteers — contact details, availability, sometimes health information or background checks.
- Participants — families in the food-sharing programme, which can reveal financial hardship.
- Partners — conversations with the city council, schools and local businesses.
All of it flows through one shared mailbox and a shared drive. Like many charities, they started on a free plan from a big American provider because it was easy and it cost nothing.
It cost something after all: control.
Trust is your most valuable asset
For a business, a data problem is a setback. For a non-profit, it can be existential. Charities run on goodwill. If donors or the families you serve stop trusting you with their information, they stop showing up.
That is why the question "where does our data live, and who can access it?" is not an IT detail. It is part of your mission.
What the GDPR expects from you
Under the GDPR, your organisation is the controller of the personal data you collect. Your email and file provider is a processor, acting on your behalf. That has consequences:
- You stay responsible. If your provider mishandles data, you answer to the people involved — and to the regulator.
- You must know where data goes. Transfers outside the EU need a legal basis and proper safeguards.
- You must be able to act on requests. If a volunteer asks you to delete their data, you need to be able to find and remove it everywhere.
When your provider is subject to foreign law, some of these duties are hard to guarantee. (We explain the US CLOUD Act here.)
Values, not just compliance
Many non-profits work on human rights, the environment, health, refugees or local democracy. Their work can be sensitive. Their partners can be vulnerable.
It is worth asking whether your tools reflect your values:
- Does your provider scan your messages for advertising or to train AI?
- Can a foreign government demand your files without you knowing?
- If your provider changes its terms, can you say no and leave with everything?
A charity that defends independence should be independent in its own tools, too.
Practical steps for a small non-profit
You don't need an IT department. Start here:
- Map your data. Write down what personal data you hold and where it lives: mailbox, drive, spreadsheets, forms.
- Read your provider's terms on data location, AI training and government requests. Note what you cannot control.
- Choose European, open tools for the most sensitive information first: your main mailbox and shared files.
- Tell your supporters. Explaining that their data stays in European hands is a sign of respect — and it builds trust.
Built for organisations like yours
SovraQ is a sovereign workplace for organisations that take their promises seriously: email, agenda, contacts, documents, spreadsheets, files and chat, run by a European company on servers in the Netherlands, built on open source. No ads, no reading your mail, no American cloud underneath. Your community's data stays under your control.
Keep your promise to your community
SovraQ launches in March 2027. Join the waitlist and give your supporters' data a sovereign home.
Frequently asked questions
Does the GDPR apply to small charities?
Yes. The GDPR applies to any organisation that processes personal data of people in the EU, regardless of size or whether it makes a profit.
Is a free email plan from a big tech company GDPR compliant?
It can be, depending on the plan and the agreements in place. But free consumer plans often lack a proper processing agreement and may use data in ways a charity cannot control.
What data do non-profits need to protect most?
Bank details of donors, health or background information of volunteers, and anything that reveals the circumstances of the people you help — such as participation in food or support programmes.
This article gives general information and is not legal advice.
