How to Respond When Donor or Client Data Is Exposed Through AI

A development associate pastes a donor list into a chatbot to draft thank-you letters. A case manager asks an AI tool to summarize intake notes. Either can become a nonprofit data breach question within minutes, and the first few hours decide how much the organization can still control.

What should happen first when donor or client data goes into an AI tool?

Stop, report and write down the facts before anything is deleted. The staff member or volunteer tells the organization's designated contact the same day, and that contact records what was entered, into which tool, from which account and when.

Speed matters more at a nonprofit than at most firms. Volunteers and part-time staff often use personal accounts on personal phones, and once a shift ends or a role changes, the organization may lose any practical way to see or delete what was entered. Capture screenshots of the conversation and of the account's data settings while the person is still available.

Which details does the organization need to record?

Enough to answer three questions: what left, where it went, and whose information it was.

• The tool and account: product name, and whether it was a personal account, a free tier or an organization account.
• The data: donor names, gift amounts, contact details, payment details, client case notes, health or eligibility information, or identification numbers.
• The people affected: how many donors or clients, and whether any are California residents.
• The settings: whether chat history and model training were on, and whether the conversation was shared by link.
• The timeline: when the data was entered, when the organization found out, and when it was deleted.

How do you contain it?

Delete the conversation after documenting it, revoke any shared links, turn off model training on the account, and change the password if more than one person used the account. If a volunteer used a personal account, ask them to make each change while a staff member watches and records it.

Vendor terms decide how long deleted content stays on their systems. OpenAI, for example, says deleted ChatGPT chats are scheduled for permanent deletion within 30 days, and that it may train on content from individual consumer accounts unless the user opts out. Save a copy of the terms that applied on the day of the exposure, because they shape the risk analysis that follows.

Is an AI exposure a reportable nonprofit data breach under California law?

It depends on the data elements. California's breach statute, Civil Code section 1798.82, applies to unencrypted personal information, which it defines as a name combined with specific elements: a Social Security number, a driver's license or other government ID number, a financial account or card number with its required security code or password, medical information, health insurance information, and a few others. A username or email address with its password also counts.

Donor names and gift amounts alone are not on that list. A spreadsheet that also held card numbers with security codes, or client records with medical information, is a different matter. Where a notice duty applies, the statute requires notice to affected residents within 30 calendar days of discovery, with limited room for delay, and a sample notice goes to the California Attorney General when more than 500 residents are notified. Whether entering data into an AI tool is an unauthorized acquisition under the statute is a question for counsel.

Nonprofits are not exempt. California's customer records chapter defines a business to include organizations whether or not they operate at a profit, and Civil Code section 1798.81.5 requires reasonable security for California residents' personal information. The California Consumer Privacy Act is narrower: its definition of a covered business is limited to entities operated for the profit or financial benefit of owners, so most charities fall outside it.

What if the data came from a health or social service program?

Then program rules can apply on top of state law. If the program is a HIPAA covered entity or business associate, an impermissible disclosure of protected health information is presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised. The assessment weighs four factors: the nature and extent of the information, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated. The first-hour record feeds every one of those factors.

Other programs carry their own confidentiality rules. The Office on Violence Against Women says VAWA grantees may not disclose personally identifying information about victims and must make reasonable efforts to prevent inadvertent releases. Federally assisted substance use disorder programs fall under 42 CFR Part 2, and records of public social services in California are confidential under Welfare and Institutions Code section 10850. Bring the program director and counsel in early when any of these may apply, and keep client case notes out of AI tools going forward.

What do you tell the board and donors?

Tell the board what happened, what data was involved and what has changed, even when no legal notice is required. California's standard of care for nonprofit directors calls for reasonable inquiry, and directors can rely only on the reports they actually receive.

Donor trust is usually the larger stake. Many donors give on the understanding that their names stay private, and the IRS generally does not require public charities to disclose contributor names reported on their annual return. Check the organization's privacy policy and any promises in gift agreements or grant contracts before deciding what to say. Counsel should review any notice to donors or clients before it goes out.

What should a nonprofit do this quarter?

Close the path that let the data out, starting with the cheapest controls.

• Approve one AI tool under an organization account with model training turned off, and give staff and volunteers access to it.
• Block sign-ups to unapproved AI apps on organization devices, and require organization accounts for volunteers who handle donor or client data.
• Turn on alerts for new AI apps connecting to the organization's email and file accounts.
• Add an AI exposure scenario to the incident response plan, with one named contact and a backup.
• Remove volunteer access to donor and client systems on the day their role ends.

How does s90 help nonprofits respond to AI exposures?

s90 sets up AI guardrails, new-app alerts and prompt monitoring so an exposure is caught early, then helps capture the facts and contain the account when something gets through. We keep the record clear for counsel and the board, and we size the controls to a nonprofit budget. If you would like a second look at how your organization would handle an AI exposure, we are glad to talk it through.