Many charities in Singapore use established platforms such as Giving.sg or Stripe to manage donations.
When asked about cybersecurity, a common response might be:
“We use Giving.sg for donations. We don’t store credit card information, so our exposure is quite limited.”
But is that really the full picture?
While donation platforms may handle payment transactions, your charity still collects, stores and manages plenty of other personal information.
Think about the information your organisation handles every day:
- NRIC details and identification documents.
- Household income and financial assistance applications.
- Medical records and information about disabilities.
- Counselling notes and family circumstances.
- Scholarship applications and beneficiary records.
- Donor and volunteer personal information.
For the people receiving your services, this information is deeply personal. Its exposure could have consequences far beyond financial loss.
Your website is only one part of the picture
Many charities rely on third-party vendors and cloud-based applications (SaaS) to manage their daily operations.
These may include case management systems, beneficiary databases, data analytics platforms and programme administration applications.
This makes operations more efficient, but it also means personal data may travel between multiple systems and organisations.
For example:
- A beneficiary submits personal information through your charity’s website, which is subsequently transferred to an external case management platform.
- Beneficiary records are shared with a third-party service provider for data analysis or reporting.
- Different applications exchange information automatically to support programme delivery.
- External vendors are given access to your systems or databases to provide maintenance and support.
Here is an important question:
Has your organisation assessed whether these systems AND the connections between them are adequately protected?
Even if your charity uses reputable software providers, it does not automatically mean every part of the arrangement is secure.
A weakness could exist in your own website, the third-party application, the way information is transferred between systems, or the access given to external parties.
Under Singapore’s Personal Data Protection Act (PDPA), organisations have a responsibility to make reasonable security arrangements to protect personal data in their possession or under their control. Engaging third-party service providers does not mean these responsibilities can simply be overlooked.
Five questions every charity management team should ask
You don’t need to be an IT expert to start reviewing your organisation’s exposure.
Ask your management team these five questions:
1. Do we know where all our beneficiary and donor data is stored and shared?
Including old databases, online forms, shared folders, third-party applications and external service providers.
2. Have we assessed how personal data is transferred between systems and external parties?
Do we know who receives the information, who can access it and how it is protected during the transfer?
3. Can unauthorised people access confidential beneficiary documents?
For example, uploaded NRIC copies, medical reports or financial assistance applications.
4. Are our websites and online systems regularly maintained?
When were they last reviewed for security weaknesses and outdated software?
5. When was our last independent security assessment or penetration test?
Has anyone actually tested whether your systems and applications have security weaknesses, rather than simply assuming they are secure?
Protecting personal data is protecting your mission
For charities, a data breach is not just an IT incident.
It could undermine beneficiary trust, damage donor confidence, attract regulatory scrutiny and affect relationships with institutional funders and partners.
Your organisation exists to help people. Protecting the personal information entrusted to you should be part of that responsibility.
At Perennial Consultancy, we help organisations identify security weaknesses through independent penetration testing.
Our approach combines AI-assisted analysis with human-led testing to assess web applications, APIs and infrastructure, validate vulnerabilities, evaluate their potential impact and provide practical remediation guidance.
NCSS members also qualify for up to 80% funding support under the CSA CISO-as-a-Service (CISOaaS) initiative for qualifying VAPT services, subject to programme criteria and approval.
So, before assuming your organisation is safe because it uses established platforms, ask yourself:
- Do we know where our beneficiary data is stored?
- Do we know who has access to it?
- Do we know how it is transferred between systems?
- And most importantly, when was the last time we independently checked whether these arrangements are secure?
Don’t just assess where your data is stored. Assess how your data moves.
Because protecting personal data is not just an IT responsibility. It is part of protecting the people and mission your organisation serves.
Need help assessing your organisation’s security?
Find out how Perennial Consultancy can help identify vulnerabilities and strengthen the protection of your organisation’s personal data through VAPT.
