Client Data Risk for Not-for-Profits: Where Sensitive Information Usually Leaks

Many not-for-profits think client data risk sits mainly inside the case management system. In practice, sensitive information usually spreads far wider than that. It moves through email, spreadsheets, Teams chats, SharePoint folders, online forms, PDFs, staff laptops, mobile phones, and now AI tools.

That is why client-data handling is one of the core review areas inside the NFP Technology Health Check NSW. The real issue is not just where the official record lives. It is where sensitive information travels while work is being done.

Why this matters for not-for-profits

Smaller not-for-profits often work under tight capacity and real service pressure. Staff need to act quickly. A referral arrives, a case note is updated, a document is shared, a report is prepared, a form submission is downloaded, or a spreadsheet is emailed to another team member. Each of those actions may be completely understandable in context. Over time, though, they create a scattered data footprint that is hard to see and harder to govern.

This becomes a leadership problem when the organisation cannot answer simple questions such as:

• where does our sensitive client information actually sit
• who can access it
• which copies are still needed
• how is it being shared externally
• what happens when staff leave
• what data is ending up in AI tools, forms, or local devices

Common places client data leaks or accumulates

1. Email inboxes

Email is one of the biggest hidden data stores in many not-for-profits. Referral details, reports, attachments, ID documents, complaints, and follow-up notes often sit in personal or shared mailboxes long after they should have been moved, archived, or deleted.

2. Spreadsheets

Spreadsheets are often used for waitlists, triage, incident tracking, outreach, funding evidence, and reporting. They are flexible, but they also create multiple copies of sensitive information and can be shared far too broadly.

3. Teams, SharePoint, and OneDrive

These tools are useful, but permission sprawl is common. Sensitive folders get inherited into broad groups, old links remain active, and staff copy data into convenience folders that no one reviews properly.

4. Online forms

Referral and intake forms can expose risk when the receiving workflow is unclear. Data may be emailed in full, downloaded into spreadsheets, stored in multiple platforms, or accessed by too many people.

5. PDFs and attachments

Sensitive client information is often packaged into PDFs that are then stored in email, desktops, downloads folders, and shared drives. These copies are easy to overlook during reviews.

6. Staff devices

Laptops and phones may contain downloaded reports, synced files, screenshots, attachments, and cached documents. If device controls are weak, this becomes an avoidable exposure point.

7. AI tools

When staff are under pressure, they may copy case summaries, referral details, or report text into AI tools without appreciating the governance implications. That is why data risk and AI policy must be looked at together.

Why scattered data is risky

Scattered data creates problems even before a breach happens. It makes it harder to:

• control access properly
• honour privacy expectations
• know what information is current
• produce clean evidence for audits or complaints
• remove access when staff leave
• respond confidently during incidents
• explain the data environment to a board or regulator

In other words, data sprawl creates both operational and governance drag.

What good looks like

A strong client-data handling model does not require perfection. It does require visibility and discipline. Good usually looks like:

• a basic data map that shows where sensitive client information sits
• clear rules for email, forms, file storage, and downloads
• fewer unnecessary spreadsheets and duplicate copies
• clearer permissions in Microsoft 365
• device controls that reduce local-data risk
• staff guidance on what must never go into AI tools
• an owner who can explain the current handling model to leadership

Microsoft 365 external sharing is often the hidden issue

One of the most common problems is not an obvious hack. It is routine oversharing. A folder is shared too broadly. A OneDrive link remains open. A Teams site is more permissive than intended. Sensitive board or client material ends up in a space that was originally created for convenience.

That is why this topic connects closely with Microsoft 365 Security Checklist for Not-for-Profits.

A simple data map template

Smaller organisations can start with a plain-language table covering:

1. data type
2. where it is collected
3. where it is stored
4. who can access it
5. how it is shared
6. what the main risk is
7. what needs fixing first

That table does not need to be fancy. It just needs to exist.

Red flags leaders should take seriously

• nobody can say where client data sits outside the main system
• staff regularly download and email sensitive files
• referral forms feed multiple manual processes
• broad Teams or SharePoint groups have access to sensitive material
• staff use spreadsheets as a parallel case system
• AI use is happening without clear rules
• device loss or leaver access has not been reviewed recently

First steps to reduce risk

A practical first pass usually includes:

1. identifying the main locations of sensitive client data
2. reviewing who currently has access
3. checking external sharing and download habits
4. tightening the most exposed folders and workflows
5. setting clear rules for AI and email handling
6. removing unnecessary duplicates where feasible

Next step

If your organisation knows client data is spreading across too many tools, book the NFP Technology Health Check NSW. It is designed to map the real handling model, identify the highest-risk leakage points, and give leadership a practical action plan without turning the work into an MSP takeover.