If There’s a Data Breach—Who’s Responsible?
Let’s ask the question no one wants to ask—but everyone should:
If our nonprofit suffers a data breach, who is responsible?
It’s a tough question. One that keeps operations managers, executive directors, and board members up at night—especially when sensitive donor or program data is at stake. As someone who’s been on both the nonprofit and tech support side, I want to offer clarity, not fear.
So let’s walk through it calmly, together.
The Hard Truth: No System Is 100% Unbreakable
Cybersecurity is like locking your doors, and training your team to spot suspicious activity. But even the best precautions can’t promise perfection. What matters most is how prepared you are, how quickly you respond, and who shares the responsibility when things go wrong.
Shared Responsibility: What IT Support Really Means
In most nonprofit/IT relationships, accountability is shared between the organization (you) and the service provider (IT provider).
🧩 Your Responsibilities:
- Choosing strong passwords and enabling multi-factor authentication (MFA)
- Training staff to avoid phishing scams and unsafe clicks
- Following data policies and access guidelines
- Reporting suspicious behavior or incidents immediately
🛡️Your Tech’s Responsibilities:
- Monitoring systems for threats 24/7
- Keeping software and security tools up to date
- Backing up data and testing recovery procedures
- Advising you on best practices and compliance requirements
- Responding fast when something goes wrong
A good IT provider won’t just sell you antivirus software—they’ll act as a partner in prevention and a first responder in a crisis.
What Happens If a Breach Occurs?
- Detection
The MSP should identify the breach quickly, alert your team, and begin investigating. - Containment
They’ll isolate affected systems and limit further exposure. - Recovery
They’ll restore from backups (if they’ve been tested) and guide your team through cleanup. - Reporting
Depending on what was exposed, your nonprofit may be legally required to notify donors, partners, or regulators.
This is why clear roles and a written incident response plan are vital. You don’t want to be Googling “data breach response” at midnight.
Who’s Legally Responsible?
It depends on your contract and local laws, but generally:
- Your organization is ultimately responsible for how donor data is handled.
- Your IT support is responsible for the tools, systems, and services they manage.
- If a breach results from negligence on either side, that party may be liable.
That’s why your agreement with your IT service should clearly define:
- Security responsibilities
- Data access protocols
- Service Level Agreements (SLAs)
- Breach notification timelines
Don’t Just Outsource—Collaborate
Your IT support should be more than just tech support. With co-managed IT services, they become strategic partners Who:
- Help build your data policies
- Train your team
- Provide breach drills or “what-if” scenarios
- Keep you compliant with regulations like PIPEDA and CRA requirements
It’s not just about blame. It’s about building a resilient, trusted partnership.
Nonprofits like yours deal in trust. A data breach doesn’t just threaten your systems, it threatens your credibility. But with the right IT support partner by your side, you’re not alone. You have guidance, protection, and someone who speaks your language. Human IT understands the unique pressures nonprofits face—and they’re here to help you stay safe while you stay focused on what matters.