{"id":10397,"date":"2018-05-22T14:13:25","date_gmt":"2018-05-22T19:13:25","guid":{"rendered":"http:\/\/www.globalgiving.org\/learn\/?p=10397"},"modified":"2018-09-19T20:29:01","modified_gmt":"2018-09-20T01:29:01","slug":"nonprofitdataprotection","status":"publish","type":"post","link":"https:\/\/www.globalgiving.org\/learn\/nonprofit-data-protection-tips","title":{"rendered":"17 Smart Ways To Protect Data At Your Nonprofit"},"content":{"rendered":"

With GDPR<\/a> coming into effect in the European Union and privacy scandals making headlines, many nonprofit professionals are concerned about data protection. The process can be intimidating! If you don\u2019t have a technology or legal background, where do you start?<\/p>\n

While the exact details of your organization\u2019s security policy may differ based on your line of work and IT resources, there are some things that everyone can do to protect confidential information. These guidelines can also inform the development of your nonprofit\u2019s security policy, if you do not have one already.<\/p>\n

Here is a collection of tips to make nonprofit data protection easier:<\/h3>\n

1.<\/strong> Develop and adhere to your organization’s privacy policy and safeguarding policy<\/a>. Need an example? Here is GlobalGiving\u2019s Privacy Policy<\/a>.<\/p>\n

2.<\/strong> Only access or knowingly attempt to access data that you are authorized to use as a part of your role and job responsibilities.<\/p>\n

3.<\/strong> Safeguard all passwords, codes, badges, and physical keys assigned to you. Don\u2019t share them or write them down. (See Tip #11<\/a>)<\/p>\n

4.<\/strong> Protect confidential information by encrypting it, limiting access to it, minimizing the number of copies of it, and deleting the data when it is no longer needed. This goes for laptops as well as any servers or databases. If your organization limits the amount of data it retains by deleting it after a defined period, there\u2019s less data that can be exposed in a data breach or security incident.<\/p>\n

5.<\/strong> Always use systems in a professional manner and with good judgment.<\/p>\n

6.<\/strong> Make sure that your laptop\u2019s hard drive is encrypted, and use encrypted devices whenever possible to minimize the risk of a data breach. If you aren\u2019t sure, work with your IT provider to review your encryption settings. Mozilla has instructions<\/a> on how to encrypt your hard drive.<\/p>\n

7.<\/strong> Report security incidents, loss, or theft as soon as reasonably possible to the appropriate personnel in your organization.<\/p>\n

8.<\/strong> Understand if you need to get permission from your manager or IT team to install new software on devices. Make sure any software you install will not compromise the security of your data.<\/p>\n

9.<\/strong> Use antivirus software and keep it up to date. ClamAV<\/a> is a popular open-source option. However, check with your IT provider first as you generally do not want to use two antivirus solutions since they can conflict with each other.<\/p>\n

10.<\/strong> Lock your computer when you are not using it. This may mean turning on the screensaver with password lock if you\u2019re in the office but away from your desk, or physically locking your computer using a secure cable if you are leaving for an extended period.<\/p>\n

11.<\/strong><\/a> Use a password manager (like LastPass<\/a> or 1Password<\/a>) to create complex, dedicated passwords for each website or application that you use.<\/p>\n

12.<\/strong> Change your password periodically in accordance with your policy. Many professionals recommend changing passwords every 90 days, or more frequently for systems with sensitive data.<\/p>\n

13.<\/strong> Always use two-factor authentication whenever possible. Use security keys, RSA keys, or apps like Google Authenticator<\/a> when available. Using SMS or text messaging for two-factor authentication is also possible, but is less secure than other means.<\/p>\n

14.<\/strong> Use dedicated logins for each person whenever possible. Don\u2019t use shared logins.<\/p>\n

15.<\/strong> Backup critical data using whatever method is approved for your organization. Systems like Google Drive, Box, or DropBox provide convenient, secure solutions for backup and file sharing.<\/p>\n

16.<\/strong> Be aware of social engineering risks<\/a> and train staff on how to avoid them. Social engineering is the art of manipulating people so they give up confidential information.<\/p>\n

17.<\/strong> Ensure that you are properly disposing of used computers and IT equipment. Make sure that all data is securely wiped from devices before they are sold, donated, or recycled. DBAN<\/a> is one popular open-source option to assist with this.<\/p>\n

\n
\n
\n
\n

Want more tips like this? Subscribe to get the best content from the Learn Library once a month.<\/p>\n \n