Principle 33

A charitable organization should respect the privacy of individual donors and, except where disclosure is required by law, should not sell or otherwise make available the names and contact information of its donors without providing them an opportunity at least once a year to opt out of the use of their names.

Preserving the trust and support of donors requires that donor information be handled with respect and confidentiality to the maximum extent permitted by law. Charitable organizations should disclose to donors whether and how their names may be used, and provide all donors, at the time a contribution is made and in any future solicitations, an easy way to indicate that they do not wish their names or contact information to be shared outside the organization. In all solicitation and other promotional materials, organizations should also provide a means, such as a check-off box or other “opt-out” procedure, for donors and others who receive such materials to request that their names be deleted from similar mailings, faxes or electronic communications in the future. The organization should immediately remove a donor’s name from any lists upon request and should ensure that at least once a year all donors are provided information about how they may request that their names and contact information not be shared outside the organization.

Organizations that gather personal information from donors and other visitors to their websites should have a privacy policy, easily accessible from those websites, that informs visitors to the site what information, if any, is being collected about them, how the information will be used, how to inform the organization if the visitor does not wish personal information shared, and what security measures the charity has in place to protect personal information.

In addition, the board of directors should adopt and enforce a policy stipulating that all information about donors is to be treated as the proprietary information of the organization, and not of internal or external fundraisers. The policy should further stipulate that such information cannot be sold, shared, or otherwise transferred to another organization without clear written permission of both the donor and the organization.