In this post
Key Takeaways
- Data governance for nonprofits decides who controls an organization's data and who answers for its misuse.
- Most guidance covers donor information, yet participant data from program delivery carries the highest stakes.
- Seven principles anchor sound governance policies, from purpose limitation to retention and deletion.
- Every dataset needs a named owner, and a small team can stack several roles on one person.
- Field collection adds offline phones, partner collectors and government reporting to the scope.
- CommCare builds governance into data capture itself through role- and location-based access, audit logs and AES-256 encryption.
What Data Governance Means for Nonprofits
Data governance for nonprofits is the system of rules and accountability that decides who can collect, see, share and delete an organization's data assets. It settles who calls the shots and who checks before anyone picks a database or tool.
Nonprofits hold data in four domains:
| Domain | Typical Contents | Main Risk if Ungoverned |
|---|---|---|
| Donor | Names, contact details, giving history | Data privacy complaints and lost donor trust |
| Program | Participant records, household surveys, case files, health and protection data | Harm to the people the program serves |
| Financial | Grant budgets, payments, expense records | Fraud and audit findings |
| Staff and volunteer | HR files, payroll, background checks | Employment and privacy claims |
The program domain deserves the most attention. Its files describe people at a vulnerable point: a pregnancy, an HIV status, a displacement, a report of violence. When a case file leaks, the person in it can face physical danger, a different order of harm from an embarrassing donor data leak.
Yet most guidance published for the nonprofit sector centers on CRM hygiene and fundraising records. Even the basics lag. In the Salesforce.org trends report for 2021, 76% of nonprofits said they still needed to develop an organizational data strategy.
Data Governance Principles for Nonprofit Programs
Governance principles for nonprofit programs are the commitments every later policy decision traces back to. Seven of them cover most decisions about participant data:
- Purpose limitation: data collected for a stated purpose gets used for nothing else. A nutrition survey does not feed fundraising efforts.
- Data minimization: forms ask only for the fields the purpose requires. If nobody analyzes religion or exact birth date, drop those questions.
- Informed consent: participants hear the purpose in their own language and learn how to withdraw later.
- Security: encryption, role-based permissions and protected devices.
- Data quality: validation rules sit inside the form and catch errors at entry, before anyone has to clean them up.
- Accountability: each dataset has a named owner who answers for it.
- Retention and deletion: each dataset has a defined lifespan and a documented way to destroy or anonymize it.
Two sector references back these up. The Principles for Digital Development list nine principles after a 2024 refresh. One of them, "establish people-first data practices," puts consent and transparency first and lets communities keep control of their own data.
Humanitarian teams have a dedicated guide in the ICRC data protection handbook (third edition, 2024), which treats protecting someone's personal data as part of protecting the person.
Data Governance Roles and Who Owns What
Governance roles separate decision-making authority from technical work, so no task falls between two desks. Most organizations need six of them:
| Role | Responsibility | Typical Holder |
|---|---|---|
| Executive sponsor | Accountability, resourcing, policy sign-off | Executive director or COO |
| Data owner | Decisions on data access, sharing and retention for a dataset | Program or department head |
| Data steward | Definitions, quality rules, day-to-day compliance | Monitoring and evaluation (M&E) or data lead |
| Data custodian | Storage, security, backups | IT team or platform vendor |
| Data protection lead | Legal compliance, breach response, consent standards | Data protection officer (DPO) or legal counsel |
| Frontline collectors | Accurate, consented collection in the field | Community and field staff |
A platform vendor managing data on your behalf acts as custodian, not owner. Decisions about who sees participant records and how long they stay remain with your organization.
When One Person Holds Several Roles
Small nonprofit organizations rarely staff six separate positions. At a 12-person organization, the executive director can serve as executive sponsor and data protection lead, while one manager owns and stewards the case files.
Stacking works when someone writes down who wears each hat. The data owner seat is the one most often left empty, and then access requests get approved by whoever answers the email first.
What Goes in a Policy
A nonprofit data governance policy is the written document that turns principles and roles into instructions staff can follow. A complete version covers seven areas:
- Scope and classification: which data falls under it, sorted into sensitivity tiers from public to highly sensitive.
- Access control: who sees what, set by role and, for field teams, by location.
- Consent standards: how consent gets captured and recorded, and how participants can see, correct or withdraw their data.
- Retention and deletion: how long each data class is kept and the procedure for deleting or anonymizing it.
- Data sharing: a written agreement for every transfer to partners, governments and funders.
- Breach response: who gets notified, in what order and how fast, and who reports to regulators or donors.
- Review cycle: a named owner for the document and a fixed review date, at least once a year.
Incident plans get used. In the UK government's Cyber Security Breaches Survey for 2025/2026, 28% of charities reported a breach or attack in the previous 12 months, and phishing was the most common type.
NetHope's governance toolkit, built in 2022 with Plan International and SOS Children's Villages, saves teams from starting with a blank page. It includes template policies, role definitions, roadmaps and key performance indicators (KPIs) grounded in NGO best practices.
Governing Program Data Collected in the Field
Program data collected in the field needs controls that office-based guidance skips, because it lives on phones, passes through partners and ends up in government reporting systems. Six areas need specific attention.
Offline Data on Phones and Shared Devices
Records captured without a connection stay on a device, sometimes for days, until it reconnects and syncs. Offline data collection is only as safe as the phone it runs on. Field device standards should require:
- Encryption of every record stored on the phone or tablet
- Separate logins for each frontline worker, including on shared devices
- Reporting steps for lost or stolen phones, with a named contact
- Automatic sync as soon as a connection returns, so data spends less time on the device
CommCare builds in the first safeguard by design. Data on the device is encrypted with keys tied to the user's password and is never written to storage unencrypted, so a logged-out phone that goes missing gives up nothing readable.
Partner Organizations Collecting on Your Behalf
Your organization stays accountable for participant data even when a local partner runs the enumeration or case work. The written agreement should name the fields, the tool, the staff who can view it and the fate of the data when the partnership ends.
Sensitive Categories That Need Extra Controls
Health status, gender-based violence (GBV), child protection and displacement records can expose participants to stigma, retaliation or legal risk. Put these categories in the strictest sensitivity tier with shorter retention. For GBV and child protection files, limit identifying details to a small circle of named staff.
Government and Donor Reporting as Data Sharing
Reporting to a ministry or funder counts as data sharing and needs the same governance. A line list with names carries far more risk than aggregate indicators. Each reporting arrangement should state which fields leave the organization, in what form and for what use.
Hosting Location as a Governance Decision
Hosting location decides which laws, such as GDPR, apply to stored data and who can demand it. Some governments require health data to stay in-country. Pick the region at setup, since on many platforms, CommCare included, project spaces cannot move between regions later.
Why Fragmented Tools Weaken Governance
The International Rescue Committee works in more than 40 countries and once relied on data tools that were neither standardized nor interoperable. Staff spent more time building Excel workbooks than on analytics, and the patchwork created data security risks. IRC's data standardization on one platform let the team manage project spaces centrally, with standard tool versions and identity access management.
Data Governance Frameworks Nonprofits Can Adapt
A data governance framework that nonprofits can adapt saves months of design work, because the structure, from policy templates to performance metrics, already exists. Four options fit most needs:
| Framework | Best For | What It Provides |
|---|---|---|
| DAMA-DMBOK (second edition, revised 2024) | Organization-wide data programs | The reference body of knowledge for data management practices, including governance |
| NetHope toolkit | NGOs building a first program | Templates, roles, roadmaps and KPIs, with terminology mapped to DMBOK |
| ICRC Handbook | Humanitarian and protection data | Data protection guidance for crisis settings |
| CAN/DGSI 100-11:2025 | Community and human services | A standard covering informed consent, minimal collection, ethical sharing and Indigenous data sovereignty |
DAMA-DMBOK is broad and enterprise-oriented, so smaller teams get the most from its vocabulary. For most NGOs, NetHope's toolkit is the quicker starting point, with the ICRC handbook added for protection work.
Consolidating Tools as a Governance Step
Each extra data tool is one more system where permissions have to be configured and audited. Fewer platforms make a policy enforceable. The data centralization playbook lays out four steps: build a task force, run a needs assessment, select a partner and tool, then roll out with clear owners and training. One practitioner quoted in it said the shift took 2.5 years and more than 50 hours of instructional material, a realistic benchmark for budgeting the initiative.
Governing Program Data With CommCare
CommCare supports program governance by building controls into the data capture workflow, so safeguards apply from the first form a frontline worker fills in.
- Maturity planning: the data management playbook maps eight data lifecycle stages, from generation and collection to analysis and interpretation, against three maturity levels sized by team.
- Encryption and certified security: CommCare's security controls include AES-256 encryption and role-based permissions from the moment data is captured, detailed audit logging and SOC 2 Type 2 certification on paid plans, audited annually. Data is hosted on AWS in the United States, the European Union or India.
- Access by role, group and location: case management lets teams assign cases by role, group or location and escalate them to supervisors, so each frontline worker sees their own caseload instead of every client record. Location-based sharing starts on Advanced plans.
- Quality rules after collection: the data cleaning guide covers setting a cleaning cadence, choosing who owns it and using Case Search, bulk editing (Advanced plans and above) and exports to fix duplicate cases and mis-typed names.
To build governance into your program data from the first form, contact the CommCare team.
FAQ
Quick answers to common governance questions.
What Is a Data Sharing Agreement?
A data sharing agreement is a written contract that sets the purpose, fields, security measures and retention period for data one organization shares with another. It should also limit onward sharing and require the recipient to delete or return the data when the partnership ends.
How Is Data Governance Different From Data Management?
Governance sets the decision-making processes for data: who decides, under which rules and with what accountability. Data management is the technical work of collecting, storing, cleaning and analyzing data under those rules.
Does a Small Nonprofit Need a Data Governance Policy?
Yes. Small teams need a policy scaled to their size, and a few pages with one accountable person can be enough. CommCare's playbook starts its maturity levels at community health programs with 5 to 10 members, where the goal is secure collection and storage plus compliance with basic regulations.
How Long Should a Nonprofit Keep Program Data?
Keep program data only as long as the law, funder terms and the original purpose require. For US federal awards, 2 CFR 200.334 requires recipients to keep award records for three years from the final financial report. When the period ends, delete or anonymize the data and document that you did.
