When adding users to your donor database, the easiest approach is to have one or two accounts that provide access to just about everything and allow users to perform virtually any task. Usernames and passwords for these accounts are typically shared by multiple users.
The problem with this approach is that it creates serious security risks and jeopardizes the integrity and accuracy of your data.
- If you have a data breach, how will you investigate the cause and identify the individual responsible, whether it was an innocent mistake or something more insidious?
- If someone leaves your organization, how do you prevent them from continuing to access sensitive data?
- If multiple people are sharing the same account, how do you know who’s doing what?
- If you uncover errors, how do you get to the source and address the problem to prevent future errors?
- If data has been updated or changed, how do you know who made those edits?
These are just a few questions and headaches that nonprofits face when taking an “easy” approach to establishing and maintaining user roles. Let’s discuss the importance of user roles and best practices that protect your data and help you operate more efficiently!
What Are User Roles and Permissions in a Nonprofit Donor Database?
User roles are predefined permissions assigned to individuals based on their responsibilities within an organization. Each user role should be customized. For example:
- An admin is often a senior-level user role with access to virtually all data and the ability to change data.
- A data entry user is only permitted to enter new data into the system.
- A volunteer coordinator only has access to volunteer data and the inputting of volunteer hours.
Why do User Roles Matter in a Nonprofit Donor Database?
User roles establish clear responsibilities in the database that reflect the individual’s duties within your nonprofit. You gain clarity and avoid confusion and disputes about who can access, edit, delete, and view specific types of data.
From an operational efficiency standpoint, user roles simplify the onboarding process. You can focus on showing new team members what they need to know instead of walking them through parts of the donor database that they won’t use. By limiting access to sensitive data and complex tasks, you reduce the risk of errors and redundant work. You can then track user activity to provide accountability about who did what and when.
Given the high cost of data breaches and noncompliance, the security benefits of clearly defined user roles are extremely important! Even a relatively minor data breach can be crippling for a small nonprofit when you account for the costs and resources involved with responding to the breach, notifying those affected, correcting the problem, and dealing with negative publicity.
Defined, well-managed user roles reduce the risk of errors and exposure of sensitive data, whether accidental or malicious. User roles also make it easier to comply with data protection regulations and respond to regulatory audits.
As responsibilities change, user roles and permissions in the donor database can be updated accordingly. If someone leaves the organization – and turnover is high in the nonprofit community – their account can be deactivated.
Best Practices for User Role Creating, Implementation, and Updating
User role permissions should be based on the minimum access and functions required by an individual to do their job. IT security experts refer to this as the “principle of least privilege.”
In other words, don’t give someone more permissions than they need. An intern shouldn’t be able to edit donor data. That would just create more risk!
This requires a deep understanding of your donor database functionality. User roles should be matched to specific features in a way that balances flexibility and control. Not too broad, not too restrictive – juuuust right!
Look for a donor database that supports unlimited users so there’s no need to share accounts. Eleo offers unlimited users and maintains an activity log, which allows you to see exactly who’s doing what and possibly even recover lost information.
Review accounts on a quarterly or semiannual basis to make sure everyone with an account is still actively involved with your nonprofit, whether as a volunteer, staff member, or intern. Regular reviews will also ensure user roles are still aligned with each user’s responsibilities. Set calendar reminders for these reviews.
To protect yourself from errors and data breaches, configure your donor database for regular backups. Eleo automatically backs up every nonprofit’s donor database to Microsoft Azure almost daily.
User roles are like most other settings in the technology you use every day. Once you set them up, they only require periodic maintenance and reviews to continue functioning as they should. If you’d like to learn more about defining user roles in Eleo, contact us for a demo!
