A church or nonprofit often holds more sensitive data than a small business: giving records, bank details for recurring donations, member addresses, prayer requests, counseling notes, and background-check results for volunteers who work with children. Yet security usually belongs to nobody, or to a generous volunteer.
Does Florida's breach law apply to nonprofits?
The Florida Information Protection Act (Fla. Stat. §501.171) defines a covered entity as a "sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity" that holds personal information. Most nonprofits and churches are organized as corporations or associations, so the law is likely to apply. Confirm your status with counsel. Where it applies, it requires:
- Reasonable measures to protect electronic personal information
- Notice to affected individuals within 30 days of determining a breach
- Notice to the Florida Attorney General when 500 or more Floridians are affected
Personal information under the law includes a name combined with a Social Security number, driver's license number, or financial account or card number with its access code. Online giving, payroll and background checks all create that combination.
The risks that actually hit ministries and charities
- Impersonation scams. Emails or texts pretending to be the pastor or executive director asking staff to buy gift cards or send a payment.
- Shared passwords. One login for the giving platform, used by staff and volunteers for years.
- Departed volunteers who still have access to member databases and shared drives.
- Sensitive notes (counseling, benevolence requests) stored in ordinary documents or email.
- Card payments taken outside the giving platform, which pulls you into PCI DSS requirements.
Name one person responsible for data. Turn on multi-factor authentication for email, the giving platform and the member database. Give each person their own login and remove access the day someone leaves. Keep card payments inside your giving provider. Write down who to call if something goes wrong.
Trust is the asset
For a congregation or donor base, a breach is not only a legal problem. It is a trust problem. Members who learn their giving history or prayer requests were exposed rarely complain to a regulator. They quietly stop giving. A short written policy, a yearly check and basic staff training cost far less than rebuilding that trust.
Do churches have to follow Florida data breach law?
Florida's law covers corporations, associations and other entities that hold personal information. Most churches and nonprofits are organized as corporations or associations, so the law likely applies. Confirm with counsel. It requires reasonable security measures and breach notice within 30 days.
What is the first step to protect donor data?
Name one person responsible, turn on multi-factor authentication for email, the giving platform and member database, give everyone their own login, remove access when people leave, and keep a written plan for what to do if something goes wrong.