Nonprofit Privacy Evidence Pack Checklist: A Practical Guide for Website Owners

Introduction

*Updated for 2026 compliance practices.*

If you run a nonprofit website, you might assume that privacy compliance is less critical than for commercial entities. That assumption can lead to serious gaps. The **nonprofit privacy evidence pack checklist** is a practical compliance topic for website owners validating consent, tags, and disclosures. It helps you systematically gather and verify the evidence needed to demonstrate GDPR compliance. This guide focuses on technical implementation and verification steps, not legal advice. By the end, you’ll know how to audit your site, close common gaps, and maintain a defensible privacy posture.

What Is a Nonprofit Privacy Evidence Pack Checklist?

A **nonprofit privacy evidence pack checklist** is a structured set of verification points that help a website owner confirm that their site’s consent mechanisms, tag management, and privacy disclosures are working correctly. It’s not a one-time document but a living reference that you update whenever you change your site’s cookies, tracking technologies, or consent management platform (CMP).

For nonprofits, the stakes are high. Donor trust depends on transparent data practices, and regulators do not exempt charitable organizations from GDPR obligations. The checklist typically covers:

• Consent banner behavior (appearance, language, reject-flow)
• Pre-consent network requests (tags that fire before consent)
• Privacy policy accuracy and accessibility
• Data subject access request (DSAR) readiness
• Evidence of regular compliance reviews

By working through this checklist, you create a pack of screenshots, scan reports, and configuration exports that you can present to a supervisory authority if needed. This pack is your evidence that you’ve taken reasonable steps to comply.

Why Nonprofits Need a Privacy Evidence Pack

Nonprofits often operate with limited resources, but GDPR obligations apply regardless of budget. A privacy evidence pack helps you:

• **Demonstrate accountability**: Under GDPR, you must be able to show how you comply (Article 5(2)). A well-maintained evidence pack does exactly that.
• **Catch configuration drift**: Consent tools, tag managers, and plugins update frequently. A checklist ensures you verify behavior after each change.
• **Protect donor data**: Nonprofits handle sensitive information, including financial details and personal stories. Evidence of proper consent management reduces the risk of data breaches and misuse.
• **Avoid fines**: While fines for nonprofits are less common, they do happen. An evidence pack shows good-faith efforts.

How to Build Your Nonprofit Privacy Evidence Pack Checklist

Building your checklist involves five key areas. We’ll walk through each with concrete steps and verification methods.

1. Close the Consent Mode Gap

Consent Mode is a mechanism that adjusts how Google tags behave based on user consent choices. If you use Google Analytics, Google Ads, or Floodlight, you need to ensure Consent Mode is correctly implemented.

**Steps:**

1. **Check your CMP integration**: Your consent management platform must support Google Consent Mode v2. Verify that the CMP sends the correct default consent states (`ad_storage`, `analytics_storage`, etc.) before any tags fire.
2. **Test default behavior**: Open your site in an incognito window. Before interacting with the consent banner, check the browser’s developer console for the `dataLayer`. You should see a `consent` event with all storage types set to `denied`.
3. **Verify after consent**: Accept all cookies and check that the `consent` event updates to `granted` for the appropriate storage types.
4. **Scan for gaps**: Use a scanner like GDPRChecker to detect whether any Google tags fire before consent is granted. The scanner will flag pre-consent network requests.

**Common mistake**: Setting Consent Mode defaults to `granted` and relying on the CMP to update them later. This causes tags to fire before the user interacts with the banner, which violates GDPR.

2. Close the Google CMP Gap

If you use a Google-certified CMP, you must ensure it’s properly configured and integrated with your site. Even certified CMPs can be misconfigured.

**Steps:**

1. **Confirm certification**: Check Google’s list of certified CMPs to ensure your provider is listed.
2. **Validate the integration**: Use Google Tag Assistant or the GDPRChecker scanner to verify that the CMP’s API is correctly communicating with Google tags.
3. **Test the reject flow**: Click “Reject All” on your banner and confirm that no Google tags fire. Then, reload the page and check that the banner does not reappear unnecessarily.
4. **Check for TCF compliance**: If you serve ads, your CMP must support the IAB Transparency and Consent Framework (TCF). Verify that the TCF string is present and correctly formed.

**Common mistake**: Assuming that installing a certified CMP is enough. You must still configure it to match your specific tag setup and test it regularly.

3. Close the Cookie Banner Gap

Your cookie banner is the most visible part of your compliance setup. It must meet several requirements.

**Steps:**

1. **Check banner timing**: The banner must appear before any non-essential cookies are set. Use a scanner to confirm that no cookies are dropped before the banner loads.
2. **Verify language and options**: The banner must offer a clear “Reject All” option that is as prominent as “Accept All.” Pre-ticked boxes are not allowed.
3. **Test on all devices**: Check the banner on mobile, tablet, and desktop. Ensure it’s not obstructed by other elements.
4. **Document consent logs**: Your CMP should keep a record of user consents. Export these logs periodically and store them as evidence.
5. **Scan for hidden cookies**: Some scripts set cookies without going through your CMP. A scanner can detect these.

**Common mistake**: Using a banner that only offers an “Accept” button with a link to settings. This does not meet the requirement for a one-click reject option.

4. Close the Privacy Policy Gap

Your privacy policy must accurately reflect your data practices. For nonprofits, this includes donor data, volunteer information, and newsletter subscriptions.

**Steps:**

1. **Audit your data flows**: List all the ways you collect personal data (donation forms, email sign-ups, event registrations). For each, note the purpose, legal basis, and retention period.
2. **Update your policy**: Ensure your privacy policy covers all these data flows. It must be written in clear, plain language.
3. **Check accessibility**: The policy should be linked from every page, usually in the footer. It must be easy to find and read.
4. **Include cookie information**: Your policy should list all cookies and trackers in use, with their purposes and durations. A scanner can help you generate this list.
5. **Review third-party disclosures**: If you share data with service providers (e.g., Mailchimp, Salesforce), your policy must name them and explain why.

**Common mistake**: Copying a generic privacy policy template without customizing it to your actual practices. This can be considered misleading.

5. Close the DSAR Gap

Data subject access requests (DSARs) allow individuals to ask what data you hold on them. Nonprofits must be prepared to respond within one month.

**Steps:**

1. **Create a DSAR process**: Designate a person or team responsible for handling requests. Document the steps from receipt to response.
2. **Provide a contact method**: Your privacy policy should include an email address or form for DSARs.
3. **Test your ability to retrieve data**: Can you quickly export all data related to a specific email address from your CRM, email platform, and website?
4. **Verify identity**: Have a procedure to confirm the requester’s identity before releasing data.
5. **Keep records**: Store copies of requests and responses as part of your evidence pack.

**Common mistake**: Ignoring DSARs because you think you don’t hold much data. Even a simple newsletter subscription triggers the right of access.

Real-World Examples

Example 1: The Donation Form Leak

A nonprofit added a new donation form using a third-party plugin. The plugin loaded a Facebook pixel before the consent banner appeared. A GDPRChecker scan flagged the pre-consent request. The nonprofit fixed it by adjusting the plugin’s tag firing trigger in Google Tag Manager to wait for consent.

Example 2: The Outdated Policy

After a website redesign, a nonprofit’s privacy policy still listed old cookies and didn’t mention their new email provider. A manual review caught the discrepancy. They updated the policy and documented the change date.

Example 3: The Missing Reject Button

A small nonprofit used a free CMP that only offered an “Accept” button. A compliance check revealed this didn’t meet GDPR standards. They switched to a CMP with a proper reject option and rescanned the site to confirm.

Comparison: Manual Audit vs. Automated Scanner

| Aspect | Manual Audit | Automated Scanner (GDPRChecker) | |--------|--------------|----------------------------------| | **Time required** | Hours to days | Minutes | | **Accuracy** | Prone to human error | High, detects hidden requests | | **Pre-consent detection** | Difficult without technical skills | Automatic | | **Evidence generation** | Manual screenshots | Dated scan reports | | **Frequency** | Hard to repeat often | Easy to run after every change | | **Cost** | Free (but time-intensive) | Subscription-based |

While a manual audit is a good starting point, an automated scanner provides consistent, verifiable evidence that is hard to achieve manually.

How to Validate with GDPRChecker

GDPRChecker scans help verify pre-consent network requests, banner behavior, and disclosure gaps after changes. Here’s how to integrate it into your checklist:

1. **Run a baseline scan**: Before making changes, scan your site to understand your current compliance posture.
2. **Scan after every update**: Whenever you update your CMP, add a new tag, or modify your privacy policy, run a new scan.
3. **Review the report**: Focus on pre-consent requests, missing cookie declarations, and banner behavior.
4. **Document findings**: Save each scan report with a date and description of what was changed. This becomes part of your evidence pack.
5. **Fix and rescan**: If the scan finds issues, fix them and rescan to confirm resolution.

Try GDPRChecker to scan your site now and start building your evidence pack.

Implementation Checklist

Use this numbered checklist to build your own nonprofit privacy evidence pack. Check off each item as you complete it.

1. Confirm your CMP supports Google Consent Mode v2 and is correctly configured.
2. Test default consent states: all storage types should be `denied` before user interaction.
3. Verify that accepting all cookies updates consent states to `granted`.
4. Scan for pre-consent network requests using GDPRChecker.
5. Check that your CMP is Google-certified (if applicable) and properly integrated.
6. Test the reject flow: no non-essential tags should fire after rejection.
7. Ensure your cookie banner offers a one-click reject option equal to accept.
8. Audit your privacy policy against actual data collection practices.
9. Verify that your privacy policy lists all cookies and third-party services.
10. Establish a DSAR handling process and test it with a sample request.
11. Export and store consent logs from your CMP.
12. Schedule monthly scans and reviews to maintain compliance.

Common Mistakes and How to Avoid Them

Even well-intentioned nonprofits make these mistakes. Here’s how to avoid them:

• **Assuming plugins handle consent**: Many plugins load their own scripts. Always check that they respect your CMP’s consent signals.
• **Forgetting about embedded content**: YouTube videos, Twitter feeds, and donation widgets can set cookies. Ensure they are blocked until consent is given.
• **Neglecting mobile**: Test your banner and consent flow on real mobile devices, not just browser emulators.
• **Ignoring cookie expiration**: Cookies should not have excessively long lifetimes. Review and set appropriate durations.
• **Lacking documentation**: Without dated evidence, you can’t prove compliance. Keep scan reports, policy snapshots, and configuration exports.

For a broader compliance overview, see our GDPR checklist for small businesses, which applies to nonprofits as well.

Maintaining Your Evidence Pack Over Time

Compliance is not a one-time project. Your evidence pack should be a living collection. Set a recurring calendar reminder to:

• Run a GDPRChecker scan monthly.
• Review your privacy policy quarterly.
• Check for CMP updates and new features.
• Test your DSAR process annually.
• Revisit your [cookie banner requirements](/guides/cookie-banner-requirements) whenever you change your site design.

By making these tasks routine, you reduce the risk of configuration drift and ensure you’re always prepared for a regulatory inquiry.

FAQ

What is a nonprofit privacy evidence pack checklist? A nonprofit privacy evidence pack checklist is a structured set of verification points that help a website owner confirm that their site’s consent mechanisms, tag management, and privacy disclosures are working correctly. It serves as a living reference for ongoing compliance.

Do I need a nonprofit privacy evidence pack checklist for GDPR? Yes. GDPR requires all organizations, including nonprofits, to demonstrate accountability. An evidence pack provides the documentation needed to show that you have taken reasonable steps to comply with consent and disclosure requirements.

How do I implement a nonprofit privacy evidence pack checklist? Start by auditing your current consent setup, tag management, and privacy policy. Use a scanner to detect pre-consent requests and banner issues. Document each step with screenshots and scan reports, then schedule regular reviews.

How can I verify my nonprofit privacy evidence pack checklist with a scanner? Use a tool like GDPRChecker to scan your site for pre-consent network requests, missing cookie declarations, and banner behavior. Run scans before and after changes, and save the dated reports as evidence.

What are common nonprofit privacy evidence pack checklist mistakes? Common mistakes include assuming plugins handle consent, forgetting about embedded content, neglecting mobile testing, ignoring cookie expiration, and lacking documentation. Regular scanning and manual reviews help avoid these.

Which cookies and trackers should I check for my nonprofit privacy evidence pack checklist? Check all cookies and trackers set by your site, including those from analytics, advertising, social media embeds, and donation plugins. A scanner can identify both first-party and third-party cookies.

How often should I review my nonprofit privacy evidence pack checklist? Review your checklist monthly with an automated scan, and perform a deeper manual review quarterly. Also review after any site update, new plugin installation, or change in data processing activities.

What evidence should I keep for my nonprofit privacy evidence pack checklist? Keep dated scan reports, screenshots of consent banners, CMP configuration exports, consent logs, privacy policy snapshots, and records of DSAR responses. Store them securely and organized by date.

Next Steps for Nonprofit Compliance

Building a **nonprofit privacy evidence pack checklist** is a practical way to manage GDPR compliance without overwhelming your team. Start with a scan, fix the gaps, and document everything. For more detailed guidance, explore our related guides:

• [Privacy policy requirements](/guides/privacy-policy-requirements)
• [GDPR requirements for websites](/guides/gdpr-requirements-for-websites)
• [What is GDPR?](/guides/what-is-gdpr)

Remember, this guide provides technical implementation guidance, not legal advice. For legal questions, consult a qualified professional.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Nonprofit Privacy Evidence Pack Checklist: A Practical Guide for Website Owners", "description": "A practical nonprofit privacy evidence pack checklist for website owners. Learn how to verify consent, tags, and disclosures with step-by-step guidance and scanner validation.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/nonprofit-privacy-evidence-pack-checklist" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice