Charities mostly use personal information to manage volunteers, donors, beneficiaries, and campaigns. Salesforce centralises these records, making access, data sharing controls, and retention essential. Salesforce GDPR compliance for charities depends on how the platform is configured and how the organisation governs its use.
The UK GDPR requires organisations to process data lawfully and transparently, collect it for a defined purpose, limit retention, keep it accurate, and protect it appropriately. The Office of the Information Commissioner explains these principles in its guide to data protection principles. Moreover, Salesforce also features support for compliance but does not guarantee it.
Why Charities Should Review Salesforce Data Protection?
Charities might store donation histories, contact details, and beneficiary notes. Records also reveal that health conditions or even religious beliefs might be special category data, requiring additional safeguards, although risk depends on access, retention and purpose.
The Cyber Security Breaches Survey of UK Government 2025/26 has found that 28% of charities had identified a cyber security breach and also got attacked in the previous 12 months. This statistic measures cyber incidents, not GDPR non-compliance, but especially highlights the need for effective security.
Salesforce GDPR compliance for charities should therefore always be treated as an ongoing governance responsibility and not a one-off technical setting. Salesforce GDPR compliance for charities also depends on clear ownership. Furthermore, the charity explains responsibilities, while the implementation team configures controls and the test data flows. Let’s further divide it and understand it.
- Document The Lawful Basis For Each Purpose
Before collecting or importing records, document why each category is needed and identify its lawful basis. Possible bases include consent, contract, legal obligation, public task or legitimate interests. One basis may not cover every activity. The ICO’s lawful basis guidance explains that the basis depends on purpose and context. Special category data also requires an additional condition. Reflect decisions in privacy information.
Salesforce fields can support these processes, but a consent checkbox alone is insufficient. Record the purpose, channel, date, source, and withdrawal method, retaining evidence where consent is the basis.
- Restrict Access According To Role
Fundraisers, finance staff and volunteers need different access. Configure profiles, permission sets, field-level security, organisation-wide defaults, role hierarchy and sharing rules together. Test permissions using representative accounts. For example, an event volunteer may
need attendee names and check-in status, but not donation histories or confidential beneficiary notes. Restrict sensitive fields, review administrator privileges, and remove access promptly when someone changes role or leaves.
Include reports, dashboards, exports and connected applications in access reviews.
Document who approves access and how often it is checked. Test controls regularly because broad sharing rules can undermine restrictive settings.
- Keep Privacy Notices And Communication Preferences Aligned
Explain why information is used, who may receive it and how people can exercise their rights. The ICO’s right to be informed guidance outlines privacy notice requirements. A supporter may agree to email updates but object to telephone marketing. Record communication preferences in a structured way and ensure connected fundraising and email platforms receive changes.
Moreover, do not treat a donation or existing relationship as blanket permission for every type of communication. Test preference updates across connected systems, including how conflicting or delayed changes are handled. Withdrawals and direct-marketing objections must not be lost in synchronisation.
- Apply Retention And Individual-Rights Processes
Indefinite retention increases risk and may breach storage limitation. Set periods for donor, volunteer, employee, beneficiary and event records, considering legal and safeguarding needs. Assign an owner to review and approve disposal.
Deletion may affect related records, files, exports, integrations and backups. Map these locations and test the process before automating it. Assess whether restriction is appropriate where deletion is not.
The ICO’s individual rights guidance covers access, rectification and erasure. Document how staff identify requests, verify identity, assign responsibility, track deadlines and assess exemptions.
- Review Integrations, Suppliers And International Transfers
Salesforce may connect to donation, finance, email and event tools. Document transferred data, purpose, field ownership, sync frequency and how errors or duplicates are handled. Review supplier contracts, processor roles, data locations, and international transfer requirements.
An available connector does not prove that a setup meets the charity’s obligations. For charities taking online payments or selling merchandise, Salesforce Commerce Cloud Consulting may help assess data flows between commerce and CRM systems. Review customer accounts, order details and marketing preferences against the architecture, limiting transferred data to what each process requires.
- Prepare For Incidents And Demonstrate Accountability
Incidents may involve exposed reports, compromised accounts or misdirected spreadsheets. Define reporting, risk assessment, evidence preservation and notification responsibilities. The ICO explains that a personal data breach posing a risk to people’s rights and freedom must be reported without undue delay and, where feasible, within 72 hours of awareness. Not every incident is reportable, so document the assessment and its reasoning.
See the ICO’s personal data breach reporting guidance. Keep data maps, lawful-basis records, privacy notices, access reviews, retention rules, supplier assessments and incident logs. Consider a DPIA where processing is likely to create high risk.
Build Compliance Into Implementation
You can start with a data inventory and list each record type, purpose, its sources, owner, lawful basis, retention, and user period. This also exposes information collected and also helps teams to decide what should not be migrated.
Clean duplicates and also inaccurate fields before import, and then test mappings with a controlled sample. Where processing is likely to create high risk, also complete a DPIA before processing, assess necessity, possible harm, proportionality, and safeguards, and then document the decision with assigned actions. Moreover, review the assessment when the data categories, purpose, integrations, or processing scale changes significantly over time.
How Can ProvidusCRM Support Your Salesforce Environment?
Start by mapping roles, data flows, integrations, and reporting requirements, with this, involve data protection, operational, fundraising, and technical stakeholders. Moreover, prioritise risks and test controls before the deployment phase.
Salesforce Nonprofit Consulting can help with CRM architecture, permissions, migration, and integrations. ProvidusCRM provides Salesforce Implementation, integration, migration, development, and also consulting services, technical support does not replace legal accountability. Contact ProvidusCRM to discuss your objectives with our experienced consultants.
Conclusion
Salesforce GDPR compliance for charities needs more than enabling security features. Charities also need documented purposes, accurate communication preferences, appropriate access, tested retention processes, controlled integrations, and also an incident response plan. Salesforce GDPR compliance for charities needs regular reviews as teams and systems change.
Frequently Asked Questions
1. Does every charity need a Data Protection Officer?
No, a DPO is required only when the organisation’s processing activities meet the relevant legal criteria.
2. Can a charity use Salesforce for donor profiling?
Potentially, but it must assess the purpose, lawful basis, transparency, individual rights and risks before profiling begins.
3. Is a data protection impact assessment required for every Salesforce project?
No, a DPIA is required when the proposed processing is likely to result in a high risk to individuals.
4. Does cloud hosting transfer GDPR responsibility to Salesforce?
No, the charity remains responsible for its own processing decisions, governance and appropriate use of suppliers.
5. How often should Salesforce access permissions be reviewed?
Use a documented, risk-based schedule and review access whenever roles, systems, integrations, or data sensitivity change.
