Nonprofit Cybersecurity in Quebec: Small Budgets, Real Risks

A food bank in Notre-Dame-de-Grâce: six staff, about sixty volunteers and an online donation campaign starting in November. The "info@" mailbox is shared by eight people, the password is on a sticky note by the photocopier, and a former volunteer is still an admin on the Facebook page.

None of this comes from bad intentions. In a nonprofit, every dollar goes to the mission, the team turns over constantly, and IT falls to "whoever's good with computers." The problem is that nonprofits often hold some of the most sensitive information there is: data about vulnerable people.

The good news is that the most effective measures cost little or nothing. Here's where to start.

Does Law 25 apply to your nonprofit?

Quebec's private-sector privacy act (CQLR, c. P-39.1), as modernized by Law 25, covers personal information collected in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code. That article defines carrying on an enterprise as an organized economic activity, whether or not it is commercial in nature, that includes providing services.

The Commission d'accès à l'information (CAI) states that the law can cover nonprofits, but that a case-by-case analysis is needed to determine whether the organization truly carries on an organized economic activity. An organization that employs staff, delivers services in a structured way and handles donations has every reason to prepare as if it's covered. Check your situation with your legal advisor.

If you're covered, the core obligations are the same as for a small business: a privacy officer (by default, the person with the highest authority, who can delegate the role in writing), governance rules, an incident register and reporting incidents that present a risk of serious injury. Our Law 25 checklist covers it all. Nonprofits elsewhere in Canada fall under different privacy rules, but every security measure below applies to them as well.

What your organization actually holds

An example: a family support centre in Verdun discovers that its case notes sit in a cloud folder shared with "anyone with the link." The link had been emailed to a partner organization two years earlier. Nobody knew who still had it.

Volunteers, turnover and shared accounts

Businesses have departures; nonprofits have seasons. Volunteers join for a campaign, leave, then come back the following year. Three habits cause trouble:

• Shared accounts. When eight people use "info@", there's no way to know who did what, and no way to cut off just one person.
• Personal devices. Client lists downloaded to a family laptop tend to stay there for good.
• Unmanaged departures. The former treasurer still has online banking access; the former coordinator still runs the Facebook page.

The fixes are well known. Give every staff member and regular volunteer a named account: Google's and Microsoft's nonprofit programs offer free or discounted licences, under terms that change, so check the current offer. For accounts that must stay shared, such as social media or the donation platform, deploy a password manager. And run an offboarding access checklist every time someone leaves, volunteers included.

One simple rule prevents a lot of grief: every critical account (domain name, Facebook page, donation platform, online banking) should have at least two named administrators, including one staff member.

Online donations: protecting the organization and its donors

Online giving exposes you on two fronts.

Payment data. Use a recognized donation platform or payment provider, and never keep card numbers in a spreadsheet, an email or a homemade form.

Your name. The Canadian Anti-Fraud Centre describes the scenario: a fraudster asks for a donation on behalf of a charity that doesn't exist, or one they have no connection to, and pressures the target to give on the spot. It also warns about fake crowdfunding campaigns. To limit the damage:

• Publish your only official donation channels on your website.
• Protect your domain against spoofing with SPF, DKIM and DMARC; our DMARC checker shows where you stand.
• Remind donors that registered charities can be verified with the Canada Revenue Agency.

Finally, watch for the nonprofit version of CEO fraud: an email from the "board chair" asking the treasurer for an urgent transfer or a gift card purchase.

A realistic plan for a tight budget

Most of the measures below cost nothing but time:

• Multi-factor authentication on email, the donation platform, social media, online banking and the accounting software.
• One account per person for staff and regular volunteers.
• A password manager for accounts that must stay shared.
• Automatic updates on every computer, including the old laptop at the front desk.
• Backups of essential files, with a tested offline copy.
• File shares reviewed: no client file open to "anyone with the link."
• An inventory of critical accounts, each with two named administrators.
• Any transfer or gift card purchase requested by email confirmed in person or by phone.
• A 30-minute session for volunteers: phishing, confidentiality and what to do when in doubt.
• A confidentiality incident register, even for a list sent to the wrong person.
• Cybersecurity on the board's agenda at least once a year.

To go further at no cost, the Canadian Centre for Cyber Security publishes free guides and baseline controls designed for small organizations.

An outside review doesn't have to cost a fundraising campaign. Our team can review your accounts, file shares and procedures as part of a cybersecurity audit scaled to your organization. If your offices are in Greater Montréal, one of our experts can also meet you on-site with your executive director or treasurer.