How do I ensure my donation processing with fundraising software is compliant with PCI and data privacy rules?

To keep donation processing compliant, focus on two separate areas:

1. PCI DSS for payment card data
2. Data privacy laws for donor personal information

Here’s a practical checklist.

1) Reduce your PCI scope as much as possible

The safest approach is to avoid handling card data directly.

• Use a PCI-compliant payment processor or fundraising platform with hosted checkout / embedded secure forms.
• Make sure card numbers never hit your servers, logs, or databases.
• Prefer tokenization so the processor stores the card details and your system stores only a token.
• If you support recurring donations, confirm the platform securely manages stored payment methods.

2) Verify PCI compliance with your vendors

Ask every provider involved in donation processing for:

• Their PCI Attestation of Compliance (AOC) or equivalent
• Their responsibility matrix showing what they cover vs. what you cover
• Whether they are PCI DSS validated for their role
• Whether they provide hosted payment pages, tokenization, and secure vaulting

Your software may be compliant, but if a payment vendor is not, you still inherit risk.

3) Secure your own systems

Even if card data is offloaded, your donation system still needs strong security:

• Use TLS/HTTPS everywhere
• Restrict access with least privilege
• Use MFA for admins and finance staff
• Encrypt sensitive data at rest
• Keep systems patched and supported
• Maintain logging and monitoring
• Segment systems that handle payment-related data from other systems
• Regularly review permissions and vendor access

4) Don’t store more donor data than you need

For privacy compliance, apply data minimization:

• Collect only fields required for the donation and receipting
• Avoid storing unnecessary personal details
• Set retention rules for donor records
• Delete or anonymize data when it’s no longer needed

5) Understand applicable privacy laws

Depending on where you operate and where donors live, you may need to comply with laws such as:

• GDPR / UK GDPR
• CCPA/CPRA
• Other national or state privacy laws

Common requirements include:

• A lawful basis for processing donor data
• Clear privacy notices
• Consent where required for marketing emails or cookies
• Data subject rights handling: access, deletion, correction, portability
• Contracts with processors/data processors
• Cross-border transfer safeguards
• Breach notification procedures

6) Separate donation processing from marketing

Donor payment processing and marketing consent should be treated separately.

• Don’t assume a donation means consent to newsletters
• Use separate opt-ins for:
  • receipt delivery
  • marketing emails
  • phone/text outreach
• Keep records of consent where required

7) Use written agreements

Make sure you have:

• A Data Processing Agreement (DPA) with fundraising software vendors
• Vendor security commitments
• Subprocessor disclosures
• Breach notification timelines
• Data deletion/return clauses

If you’re a nonprofit using multiple tools, confirm they’re all contractually aligned.

8) Train staff and limit manual handling

Human error is a big compliance risk.

• Train staff not to write down or email card details
• Prohibit acceptance of card data via insecure channels
• Limit who can export donor lists
• Use approved workflows for refunds, adjustments, and donor support

9) Plan for audits and incident response

Have evidence ready:

• PCI scope assessment
• Vendor compliance documents
• Privacy policy and retention policy
• Access control records
• Incident response plan
• Security awareness training records

If there’s a breach, you need a documented response process for both card-data incidents and privacy incidents.

10) Get a formal assessment if your setup is complex

If you:

• store payment data,
• run custom donation pages,
• integrate multiple systems,
• or process large volumes,

consider a PCI Qualified Security Assessor (QSA) and, for privacy, legal counsel or a privacy consultant.

---

Quick “safe setup” recommendation

If you want the lowest-risk approach:

• Use a hosted PCI-compliant donation page
• Store only a payment token
• Keep donor data minimal
• Publish a clear privacy notice
• Sign DPAs with vendors
• Enforce MFA, encryption, and least privilege
• Review retention and consent practices

If you want, I can also give you:

1. a PCI + privacy compliance checklist for nonprofits, or
2. a vendor due-diligence questionnaire you can send to your fundraising software provider.