Playbook: Adoption Guide

BD4D offers a practical approach to data governance that can be adapted across many nonprofit contexts. Depending on your organization’s size, sector, and scale of data operations, this may be a simple or complex task. This section recommends a general series of steps that may not apply in every context; adopting BD4D does not require taking these actions or setting new processes to fulfill them if they do not apply in your particular context. For example, if your Data & IT review shows that your organization does not share Your Data with any third parties, you would only need to communicate that fact to your data stakeholders.

In all contexts, adopting Better Deal for Data consists of more than just completing a one-time implementation checklist. It requires a continuous process of data stewardship across the organization, and engagement with the individuals and communities you serve. Your clients, funding, programs, technology, and your external environment are all likely to change over time, affecting your use of data.

The BD4D Standard is designed to be adaptable, and implementation may look much different for a small community nonprofit than it will in a large global NGO. In a smaller organization, the Executive Director and a volunteer may be managing the entire process, while in a larger organization, a data manager may be leading a cross-departmental team in a year-long data governance initiative.

This section outlines the general areas of organizational accountability, common roles, and initial tasks to support most BD4D Adopters. Note that in some organizations, one person might fill multiple roles; what’s important is that all of an organization’s functions are represented and engaged in the process.

In any organization, successfully adopting BD4D requires strong leadership, ideally:

• An executive sponsor who can lead organizational accountability, and will ensure that the entire organization, including the board, is strategically aligned around the principles the Commitments represent.
• A “champion” who will drive adoption and awareness, often bridging an organization’s data culture, strategic priorities, and tactical processes.
• A project lead who will coordinate activities, teams, and timelines, managing planning and execution.

A critical step in adopting BD4D is to understand what data exists in your organization. Often, this involves working with administrative, program, operations, or IT teams to determine how, and where, both paper and digital data are collected and stored and the processes that keep it secure. Specific data practices and program requirements are detailed later in this Implementation section.

Recommended Actions:

1. Identify and designate the people who will act as executive sponsor, champion, and project lead. Ensure that there is clear ownership, accountability, and succession: are you prepared if someone in a key role leaves, or if there is a reorganization?
2. Determine whether BD4D adoption is part of a larger data governance initiative, or if it is a standalone project. Does its implementation require additional budget allocation or funding?
3. The project lead should:
   • Create and maintain a shared workplan for internal project management.
   • Work with administrative, operations, and/or IT team members to map data processes and workflows.
   • Work with representatives from every department to determine how adopting BD4D might affect their operations. It’s key that each person brings their unique knowledge and expertise to BD4D adoption, and considers the Readiness questions in the context of their department’s responsibilities.
   • Develop an internal communications and training plan to ensure that the BD4D Standard is understood, met, and its Commitments fulfilled across the organization.

Community engagement is a core tenet of the Better Deal for Data, and successfully implementing the BD4D Standard requires intentional and ongoing engagement with data stakeholders. Often, this happens at the program development and delivery level.

Referring back to the Readiness questions, do the individuals and communities you serve know how you collect, analyze, use, and share their data? Have they given implicit, or explicit, permission for you to do so? Do they have a clear way to request data deletion or transfer?

If you have not communicated how you use your constituents’ data to them, or if members of your community have ever expressed surprise at something your organization does with data, BD4D implementation offers the opportunity for thoughtful and positive change.

Recommended Actions:
The project lead should work closely with community and program teams to:

• Identify how and what data is collected, used, and shared for program delivery, monitoring, evaluation, and learning.
• Consider whether there are others who are affected by your organization’s collection and use of data, and how they may be impacted.
• Understand the expectations, needs, and concerns of your constituents and your community around how their data is used.
• Learn how BD4D adoption might impact all your data stakeholders.
• Establish the least disruptive paths to delivering on the BD4D Commitments within your programs.
• Build communication channels that provide consistent transparency about your programmatic data practices, and offer a continuous feedback loop for stakeholders.
  
  

Organizations collect and use data for a myriad of reasons: delivering and improving programs and services, administration and finance, legal compliance, research, development, marketing, and more. This means that Your Data might be processed and stored across an organization’s functions and teams, with multiple owners and uses. Meeting the BD4D Standard requires first understanding how Your Data is being managed, then ensuring that the Commitments are being met in practice.

Recommended Actions:

1. Complete and maintain a Data Inventory:
   A data inventory provides a detailed assessment of the data your organization collects, stores, processes, and shares. With respect to the data governed by the BD4D Standard, identify:
   • What data is being collected, by whom, and from whom? Can any of the data be classified as “sensitive data”? Is any data collected from, or about, children or other protected or vulnerable populations?
   • Why is Your Data being collected or gathered? Is it only used for its intended purpose? Have your data stakeholders provided informed, voluntary consent for those uses?
   • How is the data, including copies, being stored? Is it on a third-party cloud service, such as AWS, Box, or Drive? Are there versions saved on individual employee computers, or on a shared, private server in your office?
   • What happens to the data when it is no longer needed for its intended purpose? What is your data retention policy?
2. Review how Your Data is shared:
   • Are your data stakeholders aware that the data is being shared, and why?
   • Are your data recipients and sharing partners mission-aligned, and using the data for social benefit? Are they BD4D Adopters?
   • Is the data anonymized, aggregated, or de-identified? If not, should it be?
   • Is the data being exchanged, sold, or otherwise monetized by you or its recipients? Does this use align with the BD4D Monetization commitment?
3. Review how Your Data is secured:
• Who can access the data? Does anyone have access to the data who doesn’t require it? Are permissions audited and revoked regularly?
• Is sensitive data encrypted when it is being transmitted and stored?
4. Ensure that the outside processors and third-party software, platforms, and services used to collect, analyze, store, or transfer Your Data keep your organization’s data confidential, private, and secure. Accounting, collaboration, CRM, email, fundraising, social media—what tools does your organization use?
   • Check each provider’s data protection, privacy, and security settings to disable inadvertent exposure.
   • Is the data being combined with outside companies’ records to profile or re-identify individuals or communities?
   • Is the data being used to train a third-party AI tool?
   • Is identifiable data being passed to third parties via beacons or widgets on fillable forms or your website?

Although some organizations may choose to incorporate the BD4D Commitments in their terms of service, privacy policy, or other legal agreements that govern their organization’s data practices, this is not a requirement for BD4D adoption.

Many organizations do have existing legal agreements which address data collection, storing, and/or transfer. Common examples of these, and what should be reviewed, are included in the Recommended Actions below.

Recommended Actions:

1. 1. Consult your legal counsel to determine how implementing Better Deal for Data affects your operations and legal agreements.
   2. Review data protection and privacy laws which may apply to you to ensure that your data practices comply.
   3. Identify any agreements or contracts which touch Your Data and do not align with the BD4D Standard. For example:
      • Beneficiaries: do your terms of service reserve the right to sell data as an asset?
      • Funders: do your grant agreements require the disclosure of sensitive data?
      • Partners: do your partnership agreements require you to provide identifiable data about your clients or users without adequate guarantees of confidentiality?
      • Vendors: do your third-party tools include a data processing agreement which allows AI model training on personal data, or doesn’t commit to confidentiality?

Contracts that require you to take actions that directly conflict with the BD4D Commitments must be amended in order to implement the BD4D Standard. Other conflicts may be remedied as contracts are renewed, as long as any discrepancies are communicated to those whose data might be involved.