IT for local nonprofits, churches, and faith-based organizations

Compliance Rules That May Apply

The items below are requirements your organization may face. They are not claims that RanchoIT holds these certifications.

• If the organization accepts payment cards for donations, fees, or bookstore or event sales — online or in person — PCI DSS applies to that cardholder data. Many organizations reduce scope by using a payment processor that keeps card numbers off the organization's own computers; that does not remove the need to protect donor records and admin accounts.
• California Civil Code 1798.82 can require notice to affected California residents if unencrypted personal information (for example, donor or staff data) is involved in a breach, including the 30-calendar-day resident-notice deadline in effect as of January 1, 2026.
• CCPA/CPRA generally applies to for-profit "businesses." A typical 501(c)(3) is not automatically a CCPA-covered business. A separate for-profit affiliate might be.
• HIPAA applies only if the organization is a covered entity or business associate in a healthcare role (for example, a clinic that bills insurers). A church or food pantry is not a HIPAA covered entity merely because it keeps pastoral or client notes. If a program is healthcare, use the Medical page as well.
• If the organization operates a school that receives U.S. Department of Education funds, FERPA may apply; point those readers to the Education page rather than stretching FERPA onto every nonprofit.
• California's charitable-solicitation and Attorney General registration rules are not an IT-security framework. Clergy-penitent confidentiality is likewise not a substitute for a cybersecurity program.
• There is no general federal "nonprofit cybersecurity statute." Treat donor and volunteer data with the same care you would any sensitive personal information.

Why This Matters Locally

We work with community nonprofits, churches, and faith-based organizations in Rancho Cucamonga, Upland, Fontana, Ontario, Montclair, Claremont, Pomona, Chino, and neighboring cities. This is a suburban corridor with many congregations and local charities.

Frequently Asked Questions

Can RanchoIT apply for the Microsoft or Google nonprofit discount for us?

We can help you understand the current offers and get the systems ready, but Microsoft states that a third-party IT provider may not complete nonprofit registration on your behalf. Someone at your organization has to apply. Google's process is also an application and verification by the organization, not something we can "grant" to you.

Does every church automatically get free Microsoft 365 or Google Workspace?

No. The organization has to meet the vendor's eligibility rules — for Google in the U.S., that generally means 501(c)(3) status or a qualifying group exemption — and then be approved. Even when a church is eligible, Microsoft does not allow congregants, donors, or members to use nonprofit licenses; those licenses are for staff, and in some cases volunteers or unpaid executive leadership, depending on whether the license is a grant or a discount.

We take donations online. Are we responsible for payment-card security?

If you accept cards, PCI DSS applies to the card data in your environment. Using a reputable donation processor that keeps card numbers off your own computers can reduce that scope, but you still need to protect donor records, admin logins, and email.

We are a small congregation with mostly volunteers. Is this still relevant?

Yes. Volunteer turnover and shared accounts are often the biggest risks in a small office. The plan should be sized to the organization, not copied from a large institution.