This is general information, not legal advice. The law that applies to your organization depends on where you work, and your own data protection contact or adviser should answer questions about your case. See our terms of service.

Sharing donor, member and client lists with a volunteer or an AI tool: what to remove first

Charities and other non-profits hold lists of people who trust them. This guide shows what an analysis of a donor, member or client list really needs, what to take out before the file leaves your organization, and which questions to ask first.

Published October 28, 2026

A small organization often has one person who is good with spreadsheets, and a volunteer who offers to help with the numbers. An AI assistant can be that volunteer too: it can show which campaigns raised the most, when donors stop giving, or which events bring in new members.

The lists behind those questions are different from most business data. The people on them gave their time, their money, or their trust, and some of them would not want the organization's work to be visible to anyone outside it. This guide explains what to take out of a list first, so that the analysis still works.

Key terms

Donor, member and client lists: the files an organization keeps about the people who give to it, belong to it, or receive its help.
Special categories of personal data: kinds of data the GDPR (the European Union's data protection law) treats with extra care, among them health, religious or philosophical beliefs, political opinions, trade union membership, and sexual orientation.
Case notes: free text written about a person, such as a caseworker's notes or a call record.
Stand-in: a made-up label used in place of a real name, such as PERSON_001.
Data protection contact: the person in your organization, or the adviser, who answers questions about personal data. Some organizations have a formally named data protection officer.

Why do these lists need extra care?

A name on one of these lists says something about the person, because of which list it is on.

A member list of a church, a party or a union says something about beliefs and opinions.
A client list of a health or social support charity says something about illness, money or family problems.
A donor list says who gave, how much, and how often.

The GDPR names several of these as special categories of data. A not-for-profit body whose aim is political, philosophical, religious or trade-union related may handle such data in its legitimate activities, with safeguards, under Article 9(2)(d) of the GDPR. Two conditions apply: the data concerns only its members, former members or people in regular contact with it, and it is not shared outside the body without the consent of the people concerned. That last condition is the reason to take names out of a list before it goes to an outside volunteer or an AI service.

What does the analysis need?

Write down the question first. "Which of our appeals raised the most money?" needs the date, the amount, and an appeal code. It does not need a name, an address, or a note.

List	Often needed	Usually not needed
Donors	Gift date, amount, campaign or appeal, region, first gift or repeat gift	Name, street address, email, phone number, notes
Members	Joining year, membership type, region, whether the membership renewed	Name, contact details, role in the community
Clients or beneficiaries	Service used, date, outcome category, region	Name, date of birth, address, case notes
Volunteers	Hours, event, month	Name, contact details, availability notes

What about free-text notes?

Notes are where the most private details collect: a caseworker's remark about a family, a donor's reason for stopping, a call about a bereavement. They are written in ordinary sentences, so a search for names does not find everything.

Take the notes column out unless the question depends on it. If it does, ask your data protection contact before the file goes anywhere.

Can small groups be recognized even without names?

Yes. In a small community, a postal code, a rare role, or a gift made on one known date can point to one person. A list of ten donors in a village is easier to recognize than a list of ten thousand across a country. Make the values coarser, for example the region instead of the postal code, and the year instead of the date. The guide on removing personal details from a spreadsheet explains why a combination of ordinary facts can identify someone.

What changes when an outside volunteer or tool receives the list?

An outside person or service is not part of your organization. Under the GDPR, when someone processes personal data on your behalf, Article 28 requires a contract or other legal act. In general terms it says the processor acts only on your documented instructions, keeps the data confidential, applies security measures, and deletes or returns the data when you choose.

This is the question to put to your data protection contact before you use a volunteer's own computer, or an AI service you signed up to with a personal account: does an arrangement like that exist? The terms of a consumer sign-up may not be that arrangement. Whatever the answer, a file that contains no personal data does not raise the question, which is the strongest reason to protect the file first.

How do you protect the list?

Decide the question, and list the columns it needs.
Delete every other column, starting with names, contact details and notes.
Replace what you must keep, such as a supporter number, with a stand-in that is the same every time. See replacing real names with consistent stand-ins.
Make rare values coarser, such as a small town or an unusual role.
Keep the list of stand-ins separate from the file you share. Anyone who holds it can undo the protection, so treat it as confidential too.
Write down what you did, with the date, the question, and who received the file. It helps the next person who has to repeat it, and it shows your care if anyone asks.

How do you check what is left?

Can you read the results in terms of real people?

If you kept the stand-in list, yes. When the assistant says "SUPPORTER_0412 gave most often", you put the real name back on your own computer, where only your organization sees it. See putting the original values back after an AI answers.

How can DataAttendant help?

DataAttendant is a tool that runs in your web browser, on your own computer. You open a CSV or Excel file. It looks for names, email addresses, phone numbers, account numbers and other personal details, and suggests what to do with each kind of value. It shows you a preview and a list of what remains before you download the protected copy. You decide every treatment. It also lets you save your choices as a reusable plan, which helps when the same kind of export comes round every month. It cannot find everything, so the checks above still apply, and it does not decide for you whether a file may be shared. Your file is processed in your browser and is not sent to DataAttendant. How DataAttendant works shows the steps.

Sources

Regulation (EU) 2016/679 (GDPR), Article 9 (special categories of personal data; Article 9(2)(d) on foundations, associations and other not-for-profit bodies), as published at legislation.gov.uk/eur/2016/679/article/9/adopted. Read 28 October 2026.
Regulation (EU) 2016/679 (GDPR), Article 28 (processor), as published at gdpr-info.eu/art-28-gdpr. Read 28 October 2026.
Which law applies to a particular organization (the EU GDPR, the UK's version of it, or another country's law) is not covered here; the readers' own data protection contact decides.