Keep one master copy in a system with named logins and MFA, share links with the narrowest access that works, avoid emailing exports, and delete downloaded copies when the task ends. The main risk is not hackers, it is forgotten copies in inboxes, downloads folders and personal drives.
Where copies multiply
A single donor export can turn into ten files within a week: the version emailed to the board, the one a volunteer downloaded to merge mail, the copy on a thumb drive, the one in a chat thread. Each is a place the data can leak, and you cannot control or delete most of them.
Principles that cut risk quickly
- One source of truth. Pick the system that holds the master list. Everything else is temporary.
- Share a view, not a file. Prefer links with view only access over attachments.
- Minimum columns. Export only the fields needed. A mail merge needs a name and address, not a giving history.
- Name a purpose and an end date. Write in the file name or a note: "event invite, delete by 30 Nov".
- Delete on schedule. Make deletion a task, not a hope.
Practical settings
| Where the data lives | Safer habit |
|---|---|
| Shared drive | Folder access limited to named people; no "anyone with the link" |
| Do not send lists; send a link and ask the recipient to sign in | |
| Laptop downloads | Empty the downloads folder weekly |
| Chat tools | Do not paste rows of donor data |
| Memory sticks | Avoid; if needed, use encryption and keep track |
Check sharing settings today. Many drive tools let you list files shared with anyone who holds the link. Review that list and switch anything sensitive to named access.
Encrypt devices
If volunteers work from laptops or phones, ask them to enable the built in disk encryption and a screen lock. A lost laptop then exposes much less. Keep the instruction short and offer help.
Mail merge without the mess
For a mailing, use the mail tool's own audience features rather than exporting a list to a spreadsheet and uploading it elsewhere. If you must export, delete the file after the send and note it in your log.
Redact before sharing with advisors
When a volunteer analyst or consultant needs data to test or analyze, remove names, emails and addresses first. Use IDs. This is the same principle as giving a sample, not the full set, when a helper asks. See questions to ask about a volunteer built website or app.
Review who can see what
Quarterly, list who can open the donor system and the folder with exports. Remove anyone who no longer needs it. Pair this with your volunteer offboarding checklist.
Quick check
Is a password protected spreadsheet enough?
It helps against casual access, but the password usually travels with the file by email. Prefer a system with named logins and MFA.
How long should we keep exports?
Only as long as the task needs them. Set a delete by date at the time you create the file. Retention rules for the master list vary by law, so check with counsel.
Last reviewed: 19 October 2026.
