Every supporter record your charity holds is a responsibility. Names, addresses, phone numbers, giving history and notes from conversations all belong to people who trusted you with them.
Many charities still hold years of this information about people who stopped engaging long ago. Nobody decided to keep it. It simply built up. But every record you hold and no longer need adds to your risk:
- Data breach exposure. If your systems are compromised, every out-of-date record becomes part of the breach. That means more people to notify, more harm to supporters and more damage to your reputation.
- Regulatory scrutiny. The Office of the Australian Information Commissioner has made clear that donor information shouldn’t be kept indefinitely. Personal information should be destroyed or de-identified once it’s no longer needed.
- Supporter trust. Donors increasingly expect charities to look after their information as carefully as their gifts.
For Boards and leadership teams, data retention is a governance issue as much as an operational one.
Step one: adopt a policy
Our friends at Equitable Philanthropy, led by founder Catherine Brooks, have partnered with EP Law to release a free Donor Data Retention Policy template to the sector. It helps charities of any size adopt a seven-year retention standard. The result is a policy ready for Board approval.
Download the Donor Data Retention Policy template
Step two: make sure it’s followed
Approving a policy doesn’t reduce risk on its own. The policy only works if your database can tell you which supporters have passed seven years without engaging. In most charities, nobody can answer that question without days of manual work.
That’s why we built the Retention Clock for Salesforce NPSP.
It tracks how long it’s been since each supporter last engaged with you, and it updates automatically every day. Any real engagement, such as a gift, an event ticket, a campaign response or a call, resets the clock, so your loyal supporters are never affected. Records past seven years are flagged for review, so your team can act on the policy you approved.
For leadership and Boards, this means:
- Visibility. You can see how much data is held beyond your retention period.
- Evidence. You can show that your policy is being applied, not just approved.
- Reduced exposure. Fewer unnecessary records means less to lose if something goes wrong.
How to get started
Every Salesforce org is different, so we start with a discovery session and Salesforce health check. We review how your data is structured, what counts as engagement for your organisation, and how much historical data you hold. We then give you a tailored quote to implement the Retention Clock.
Book a discovery conversation with our team
Thank you to Catherine and the teams at Equitable Philanthropy and EP Law for sharing such a valuable resource with the sector.
