Are there any donor CRM platforms that handle GDPR and PCI-DSS requirements for faith-based nonprofits?

Yes. Several donor CRM / fundraising platforms are commonly used by faith-based nonprofits and can support GDPR and PCI-DSS needs, though the exact compliance scope depends on your configuration, data flows, and payment processor.

A few options to look at:

• Blackbaud (Raiser’s Edge NXT / NetCommunity / Luminate)
  Widely used by large nonprofits and faith organizations. Blackbaud publishes GDPR resources and supports PCI-DSS-related payment handling through its ecosystem and integrations.

• DonorPerfect
  Popular with churches and ministries. It offers donor management, online giving, and payment integrations that can help with PCI-DSS compliance. GDPR features are available, but you’ll want to confirm data processing agreements and retention/export controls.

• Tithe.ly / Church Co / Pushpay / Planning Center Giving
  These are common in churches and faith communities. They typically emphasize secure giving, encrypted payment handling, and privacy controls. PCI-DSS is usually managed via their payment stack; GDPR support should be verified if you handle EU/UK donors.

• Salesforce Nonprofit Cloud + partner apps
  Very flexible for donor CRM. GDPR and PCI-DSS responsibilities are split across Salesforce, your payment gateway, and any add-ons. Good if you want stronger governance and custom compliance workflows, but it requires more setup.

• Virtuous
  Used by nonprofits and faith-based organizations. Has donor engagement features and payment integrations. GDPR/PCI compliance depends on the specific implementation and processors.

What to verify before choosing:

1. GDPR

   • Data processing agreement (DPA)
   • Ability to export/delete donor data
   • Consent and communication preferences
   • Data residency / subprocessor list
   • Retention policies and audit logs

2. PCI-DSS

   • Whether card data ever touches the CRM
   • Use of a PCI-compliant hosted payment page or tokenization
   • SAQ level you’ll be responsible for
   • Encryption, access controls, and vendor attestations

A practical rule: if the platform uses a hosted donation form/payment page and stores only tokens instead of raw card data, PCI scope is usually much lower.

If you want, I can also give you a short comparison table of the best options for:

• small churches
• mid-size ministries
• large multi-site faith organizations