Your volunteer left six months ago. Why can they still access your database

by Ben Grave - Wed 14 Oct 2026

Picture this...

Sarah was a brilliant volunteer. She helped with fundraising, kept the donor database tidy and always stayed late when an event ran over.

When she moved on, there was a card, a box of chocolates and a heartfelt thank you.

That was six months ago.

Her login still works.

Nobody thinks Sarah is about to steal donor information. That isn’t the point. The point is that someone who no longer needs access to your charity’s information still has it.

And if Sarah’s account has been overlooked, whose else might be?

 

A warm goodbye. An unfinished job.

It’s easy to see how it happens.

The volunteer coordinator knows someone has left. The fundraising team assumes their account has been closed. The person who manages the database hasn’t been told. Your IT provider might not even know that particular system exists.

Everyone has done their bit, but nobody has joined the dots.

For a charity juggling fundraising, service delivery and the next funding application, removing an old login can feel like a job for another day.

But access should reflect someone’s current role, not their history with the organisation. The ICO’s access guidance recommends regular access reviews, timely removal of leavers’ permissions and a documented process for checking that this has happened.

The goodbye can be informal. The access arrangements shouldn’t be.

 

“But we trust our volunteers”

Of course you do. Their time, commitment and goodwill help your charity do what it does.

Removing access when someone leaves isn’t a judgement on their character. It’s a normal part of looking after the information entrusted to you.

Think of it like returning a key. You wouldn’t usually ask someone to keep the office key indefinitely because they were helpful and trustworthy. A database login deserves the same consideration.

An account that remains active can still provide a route to information if its credentials fall into the wrong hands. Unnecessary access also creates opportunities for information to be viewed, changed or shared when it shouldn’t be. Restricting permissions to people who currently need them reduces those risks.

It protects your former volunteers, too. They shouldn’t be left with access - or uncertainty about their responsibilities - after their role has ended.

 

It’s not just the donor database

The database is a good place to start, but it shouldn’t be where the review ends.

Depending on their role, a volunteer may also have access to:

• Charity email and shared mailboxes.
• Shared folders and documents.
• Fundraising and event platforms.
• Mailing lists and communications tools.
• Social media accounts.
• Website administration.
• Files downloaded onto a laptop or stored elsewhere.

A useful leaver process covers the systems and information someone actually used, not just their main login. Keeping an inventory of the systems holding personal information helps you identify what needs checking. Find more uidance on records management and security from ICO

Otherwise, you can close the front door and leave a side window open.

A simple leaver checklist can make a big difference

You don’t need a complicated document that nobody reads. You need a short, repeatable process with someone responsible for seeing it through.

 

1. Give the process an owner

Decide who starts the process when a volunteer leaves, who removes access and who confirms the work is complete.

Those might be three different people. What matters is that each knows their part.

“I thought IT was doing it” is not confirmation. The ICO recommends documenting the leaver process and asking managers to check that access rights have been removed.

2. Check the access they actually have

Keep a record of the accounts and permissions issued to each person. Use it to check the donor database, shared files and any other relevant services.

Give people only the access their role requires in the first place. Someone helping with event registrations may not need access to every donor record or permission to export the entire database.

3. Remove access when the role ends

Agree when access should stop and arrange for it to be removed promptly. For a time-limited project or placement, consider setting an expiry date where the system allows it.

If someone is staying on in a different role, review their permissions rather than simply leaving everything as it was. A change of responsibilities should trigger a change of access where needed.

4. Deal with equipment and information

Arrange the return of charity-owned laptops, phones and storage devices. Check whether charity information has been saved on personal devices or in other locations, and organise its secure return or deletion in line with your policies.

Removing a login does not retrieve a spreadsheet that has already been downloaded. Device returns and information handling need to be part of the same conversation.

5. Record that it’s done

Keep a simple record of what was checked, what access was removed, who completed the work and when.

That turns “we normally do that!” into something you can verify. The ICO recommends keeping records that demonstrate access rights have been reviewed and removed appropriately.

 

What about volunteers who come and go?

Some volunteer roles don’t have a neat leaving date.

Someone might help at an annual event, take a break or return whenever their availability allows. That makes it important to agree what happens to their access between periods of involvement.

Consider time limited permissions for temporary work, and review accounts regularly rather than relying on a farewell email to trigger action. Access can be reassessed when someone returns.

“We might need them again” is a reason to keep in touch. It isn’t automatically a reason to keep their donor database access switched on.

 

Found an old account? Start by checking, not blaming.

If this article has brought a few names to mind, start with an access review.

Compare the users listed in your key systems with the people currently doing those roles. Remove permissions that are no longer needed, investigate anything you don’t recognise and document what you change.

If you find evidence that personal information has been accessed or disclosed without authorisation, involve the person responsible for data protection and follow your breach-response process. Depending on the circumstances, you may need to report a personal data breach to the ICO within 72 hours.

The aim is to fix the gap and stop it happening again, not to find someone to blame for a missed task.

A thank you shouldn’t leave the door open Your volunteers deserve appreciation. Your donors deserve careful handling of their information. Those two things go together.

A clear leaving process says... thank you for your contribution, we’ve completed the handover, and we’ve taken care of the access you no longer need.

At Mark One Consultants, we can help you review who has access to your systems and put a practical process in place for starters, role changes and leavers. Contact Ben Grave, our Commercial Director for a 15-minute discovery call.