Your website provider may already have talked with you about how referrals and enquiries are stored and protected. In our conversations with not-for-profit clients, though, we’re finding this hasn’t always been discussed
While we don’t manage websites, we care about how information is handled across your organisation. That includes helping you recognise risks in places you might not have thought to look.
It’s easy to think of your website as somewhere people learn about your organisation, find contact details or make a donation. When it accepts referrals or enquiries, it also becomes part of how you collect and handle information about people.
For not-for-profits, a referral or enquiry might include health concerns, financial difficulties or details about someone’s family. Referrals from other organisations may also include supporting documents.
You may have clear processes for protecting that information once it reaches your team. What’s less obvious is whether a copy also remains in the website or the service behind the form.
Depending on how it has been set up, sending you an email notification or transferring a referral into your client management system may leave the original submission stored elsewhere. Over time, those submissions could become a collection of sensitive information that nobody has thought to review.
In September 2026, the Australian Government disclosed that OpenAI agents had gained unauthorised access to its Medicare statistics portal in June. At the announcement, no personal information was believed to have been accessed. The incident concerned a statistics service, rather than patient records, but it caught our attention as an example of how risks to public online systems are changing rapidly with the evolution of artificial intelligence.
New Zealand’s Privacy Commissioner sets out two relevant principles: NZ organisations much ensure that personal information has reasonable safeguards against loss, misuse and unauthorised access or disclosure, and it should not be kept longer than needed for a lawful purpose.
Those principles matter just as much for copies retained behind a website as they do for information in your main client management system.
You don’t need to know the technical details to start this conversation. Ask your website provider to walk you through what happens when someone submits a referral or enquiry:
• Where does it go?
Is it emailed to your team or sent to another system? Does a copy remain in the website or form platform, including any attachments?
• Who can access it?
Which staff or external providers can view or download submissions, and how is that access protected?
• How long is it kept?
Is there an agreed retention and deletion process, including what happens to backup copies?
The answers will help you decide whether anything needs to change. That might mean collecting less information, limiting access or agreeing when unnecessary copies should be removed.
People trust your organisation with sensitive information about their lives. If that information is exposed, it can cause harm to those involved and damage the trust your organisation has worked hard to build. Knowing where it is held and how it is protected is an important part of looking after both the people you support and your organisation.
Our advisory team helps organisations look beyond day-to-day IT and make informed decisions about technology. We work alongside leaders to understand what’s changing, consider risk and governance, and agree practical next steps.
This includes helping organisations make sense of artificial intelligence: understanding the opportunities, setting clear boundaries and supporting people to use it confidently and responsibly.
If you’re working through what these changes mean for your organisation, we’d welcome a conversation.
%20(3).jpg)
