In advancement and fundraising shops, some of the most strategic insights about a donor don't come from CRM fields — they come from what we observe, hear in conversation, or learn over time. Contact reports, strategy memos, and briefing documents often carry qualitative information that helps deepen relationships.

But in today's shifting privacy landscape, the way we document and share that insight matters more than ever.

As of May 2025, 20 U.S. states have enacted comprehensive consumer data privacy laws, with more pending. The risks around damaged data governance, trust, and reputation are real — especially when donor data is shared or recorded carelessly. Additionally, it's important to note that data deemed sensitive in legal criteria carries with it heavier obligations in terms of consent and protection.

The stakes are higher than you might think. A single contact report with sensitive health information, family details, or wealth speculation can:

• Damage donor trust if inadvertently shared
• Create legal exposure under state privacy laws
• Become discoverable in litigation or public records requests
• Violate your organization's own data governance policies
• Undermine years of relationship-building in a single breach

This post outlines practical guidance for handling qualitative donor information with intention and care.

What We Mean by "Qualitative Data"

Qualitative data includes information that doesn't live in standard CRM fields but often shows up in:

• Contact reports
• Strategy documents
• Executive briefings
• Hand-off memos between gift officers
• Email communications about donors

This includes:

• Giving motivations and philanthropic interests
• Life transitions (divorce, illness, career changes, family events)
• Social or professional context and networks
• Observed patterns, preferences, or behaviors
• Unconfirmed insights (e.g., "appears to be philanthropic through a family foundation")
• Personal opinions about causes or other organizations
• Sensitive details shared in confidence — health conditions, family conflicts, financial stress

Understanding the Risks

The risks of careless documentation fall into three categories:

Legal and Regulatory Risks: State privacy laws increasingly give individuals rights over their personal information. While nonprofit exemptions exist, they're not universal and donor information can fall outside those exemptions. Health information, financial speculation, and family details all carry particular risk.

Reputational Risks: Your documentation practices signal how your organization views donor relationships. Contact reports that feel intrusive or speculative can erode trust if a donor sees them (via data access requests or accidental disclosure).

Operational Risks: Over-documentation creates data sprawl, inconsistency across staff members, and retention liability when old documents with sensitive information should have been purged.

The line between strategic documentation and unnecessary risk isn't always obvious, especially when dealing with complex donor situations or sensitive personal information.

Five Core Principles for Responsible Documentation

1. The Confidence Test

Before writing anything down, ask: "Was this shared with me in confidence, and would the donor expect privacy?"

If someone shares sensitive personal information that doesn't directly relate to their philanthropic interests, you likely don't need to record it. If it does relate, document only the philanthropic motivation or the strategic implication, not the underlying personal detail.

Don't write: "She's going through chemo right now and doesn't want to be contacted for the next few months"

Instead write: "Requested pause in outreach until spring; will reconnect in April"

2. Flag What's Inferred or Estimated

If something wasn't disclosed directly by the donor, label it clearly as inference or external data.

Examples:

• "Estimated capacity tier based on external modeling: $1M+"
• "Appears to have interest in climate-focused giving based on public board service"

Why this matters: If information is later challenged or a donor requests their data, you can distinguish between what they told you and what you inferred.

3. Document Motivations, Not Personal Details

Your role is to understand why someone gives and what they care about, not to build a dossier on their personal life.

Don't write: "Really angry about the election outcome, wants to do something" \

Instead write: "Increased urgency around supporting democracy and civic engagement initiatives"

4. Write Like Your Notes Will Be Read by the Donor

Treat your documents like they could be shared with leadership, forwarded externally, requested by the donor, or discovered in litigation. Use professional, factual language that respects the donor's dignity and wouldn't embarrass your organization if made public.

Don't write: "Husband is a total control freak about their giving decisions"

Instead write: "Primary decision-maker appears to be spouse; recommend joint cultivation"

5. Ask: Will This Help the Next Person Move the Relationship Forward?

The purpose of documentation is to support continuity and strategy, not to create a comprehensive record of every interaction.

Document: Philanthropic interests, communication preferences, key relationships, giving history and future interests, strategic next steps

Consider leaving out: Personal health details unrelated to giving interests, political opinions (unless directly tied to programmatic interests), gossip, negative personal judgments, sensitive family information shared casually

Working through what belongs in each category for your specific donor relationships and organizational context is where the real nuance comes in.

When It Gets Complicated

Health information, wealth research, political reactions, and family dynamics are areas where the line between helpful context and unnecessary risk gets blurry. The right call often depends on:

• Your organization's mission and programmatic focus
• The specific donor relationship
• How the information was shared
• What strategic purpose it serves

This is where having clear organizational policies and ongoing training makes the biggest difference.

Some Common Red Flags

Certain categories of information almost never need to be documented:

• Specific health conditions or treatment details
• Children's personal struggles or challenges
• Marital or family relationship problems
• Detailed political reactions (beyond general programmatic interests)
• Financial stress or change
• Negative characterizations of personality or family dynamics

When you encounter these in conversation, the question isn't "how do I document this?" It should be: "do I need to document this at all?"

From Individual Practice to Organizational Culture

Getting this right isn't just about individual discipline. It requires organizational support through training, templates, clear policies, and leadership modeling. The documentation practices of your most senior gift officers set the tone for everyone else.

Strong documentation:

• Helps your successor understand what the donor cares about
• Enables your executive team to have a meaningful conversation without you in the room
• Protects the donor's privacy while preserving institutional knowledge
• Builds trust by respecting boundaries
• Positions your organization as a professional, trustworthy partner

Weak documentation:

• Records everything indiscriminately
• Includes speculation presented as fact
• Captures sensitive details that don't serve a strategic purpose
• Creates compliance and reputational risk
• Treats donors as subjects rather than partners

As new regulations continue to evolve, it's smart to treat all donor information with care, especially if it lives outside the CRM.

That doesn't mean hiding insight. It means writing it down in a way that builds trust, avoids overreach, and keeps your team future-ready.

The trust donors place in you when they share personal information is a gift. Honor it by documenting with care, purpose, and respect.

The challenge? Every organization's context is different. What's appropriate for a healthcare system cultivating grateful patients looks different from a university tracking alumni, which looks different from an advocacy organization engaging activists. And within each organization, different donor relationships require different judgment calls.

Need Help Navigating the Gray Areas?

If your team is grappling with what to include (or not) in contact reports or briefing docs, I work with advancement teams to:

• Review real contact reports and identify risk areas
• Develop organization-specific documentation policies
• Train gift officers on privacy-conscious practices that still capture strategic insight
• Work through the scenarios where the right call isn't obvious

The framework above gives you the principles. Implementation is where it gets interesting and where most organizations need support. Contact me with any questions.