Who can still download every donor email from 2022?

Access you never revoked is still access. That includes last year’s volunteer and the spreadsheet in Drive.

Nonprofits pass around a donor CSV like a casserole dish. It sits in email, in a shared drive, on someone’s laptop, and in a tool nobody remembers approving. Then staff turns over. The list stays.

Count the copies before you count the donors

Write down every place a donor or volunteer list currently lives: CRM, email exports, Google sheets, someone’s desktop, last year’s grant folder, and any AI tool someone used to “clean up the list.”

If you cannot name the owner and the last person who left the organization, treat that copy as exposed.

• One official list. Everything else gets deleted or locked.
• Remove access the week someone leaves, including personal Gmail forwards.
• Never paste names, amounts, or emails into a public AI chat.

Make the rule short enough to stick on the fridge

A 12-page data policy will not get read. A four-line rule will: we keep donor info in X, we do not export it to email, we do not drop it in ChatGPT, and we cut access on the last day of work.

Then actually check the drive. The risk is not a sophisticated hack. It is the file named FINAL_donors_USE_THIS.xlsx still shared with “anyone with the link.”