Blackbaud, Inc.
Round 1 · Operational Triage · Operational Triage — Round 1 · assessed
🟠 Insufficient — Request Data-Processing Agreement
Privacy score 52.0% · band Poor
This reads as a general website privacy policy, not a data-processing agreement: 11 of 16 questions are simply not addressed. That's a wrong-document signal, not a vendor judgment — the 52.0% reflects silence, not bad practice. Enterprise vendors' real assurance lives in their DPA, a security cert (e.g. ISO 27001), or a completed questionnaire. Request those and assess in Round 2.
Unaddressed gate(s): Q3, Q5, Q16 — not covered by the public policy. Confirm before relying on this.
Quote check: 6 of 8 quotes found in the vendor's document. 2 not found (Q11, Q18). Each of those answers is set to unclear and cannot support an approval.
Q8: the quote joins separate passages with "...". Every part is in the document.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection |
| 20.0% |
| Purpose & Use GATE ⚠ |
| 20.0% |
| Data Sharing GATE ⚠ | n/a | — |
| Data Sold GATE |
| 100.0% |
| Data Rights |
| 100.0% |
| Retention | n/a | — |
| Data Security | n/a | — |
| Breach Notice | n/a | — |
| Biometrics & Surveillance GATE | n/a | — |
| Payments | n/a | — |
| AI & Model-Training GATE ⚠ |
| 20.0% |
| Jurisdiction & Residency | n/a | — |
| Contract & Assurance | n/a | — |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection and use of staff personal information to what the service needs?
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state a data minimisation principle or limit collection to what the service needs. It describes collection practices but without a limiting statement.
Q2Does the vendor name the categories of sensitive staff data it holds (government ID or SSN, bank details, health or benefits data, biometrics)?
✗ Concern
T3
Answer: No
“We don't collect, use, or disclose any sensitive personal information, as defined under state or federal law.”
Policy explicitly states it does not collect sensitive personal information categories.
Purpose & Use
Q3Does the vendor commit to use the school's data only to provide the contracted service, and not for its own purposes? GATE
? Not addressed
T0
Answer: Unclear
Policy states Blackbaud acts as a service provider for customer data but does not clearly commit to use school data only to provide the contracted service and not for its own purposes.
Q4Does the vendor use school or staff data for marketing, profiling or product analytics beyond operating the service?
✗ Concern
T3
Answer: Yes
“We use aggregated and personal data about you and/or your constituents' use of our websites and the Blackbaud Services to develop, improve, and test those services.”
Policy indicates use of personal data for product improvement beyond operating the service.
Data Sharing
Q5Does the vendor limit sharing with third parties to the purpose for which the data was collected? GATE
? Not addressed
T0
Answer: Unclear
Policy mentions sharing with service providers and affiliated organizations but does not clearly limit sharing to the purpose for which data was collected.
Q6Does the vendor publish or offer a list of sub-processors, naming its cloud host, and commit to notice before adding one?
? Not addressed
T3
Answer: Unclear
“Our Trust Center is regularly updated to reflect the latest audit results, and subprocessor disclosures.”
Trust Center mentions subprocessor disclosures but the policy documents provided do not name a specific sub-processor list or cloud host, nor commit to notice before adding one.
Data Sold
Q7Is staff or school personal information ever sold or rented to any outside party? GATE
✓ Good
T3
Answer: No
“Blackbaud doesn't sell any of your personal information, or share your personal information with any third parties for targeted behavioral advertising.”
Policy explicitly states it does not sell personal information (except for Target Analytics® service, which is a separate business line).
Data Rights
Q8Does the vendor support access, correction and deletion requests from the school, with a stated process or response time?
✓ Good
T3
Answer: Yes
“The forms below allow you to submit data subject rights requests, including: Deletion of your personal information, Correction of your personal information, Access to your personal information... You may also contact us at this Toll-Free Phone Number +1 (844) 532-0022.”
Policy describes access, correction and deletion request processes with contact method. Median response times are disclosed: 6.28 days for deletion, 12.80 days for access, 4.90 days for opt-out.
Q9Does the school keep ownership of its data, with return or deletion at the end of the contract?
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state that the school owns its data or that data is returned or deleted at the end of the contract.
Retention
Q10Does the vendor state a retention period for staff data after the service ends, and whether deletion is automatic?
? Not addressed
T3
Answer: Unclear
“We keep your personal information in an identifiable form for as long as we have a legitimate reason to use the data and as required by law.”
Policy states retention is 'as long as necessary' but does not specify a concrete retention period or automatic deletion rule after service termination.
Data Security
Q11Does the vendor disclose baseline safeguards: encryption in transit and at rest, single sign-on with MFA for admin roles, and an independent attestation (SOC 2, ISO 27001) or equivalent?
? Not addressed
T0
Answer: Unclear
Policy names SOC 2 and other attestations, and mentions password-controlled servers and restricted access. However, it does not explicitly name encryption standards (TLS, AES-256) in transit and at rest, nor does it clearly state SSO/MFA for administrative access. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “Trusted security program validated through third-party assurance reports, including SOC 1, SOC 2, PCI DSS, and HIPAA. We maintain appropriate physical, electronic and procedural safeguards to protect your personal information collected via the website. We protect our databases with various physical, technical and procedural measures and we restrict access to your information by unauthorized persons. Inside Blackbaud, data is stored in password-controlled servers with limited access.”
Breach Notice
Q12Does the vendor commit to notify the customer of a security incident without undue delay, with a stated hour count?
? Not addressed
T0
Answer: Unclear
Policy does not commit to notify customers of security incidents without undue delay or within a stated timeframe.
Biometrics & Surveillance
Q13For products that capture faces, fingerprints or other biometric identifiers: does the vendor require written notice and consent before collection, and publish a retention and destruction schedule? GATE
— N/A
T0
Answer: N/A
not applicable to this product type
Q14Does the vendor use customer video, images or biometric data for its own analytics or model training?
— N/A
T0
Answer: N/A
not applicable to this product type
Payments
Q15For products that take card payments: does the vendor state PCI DSS compliance and name the scope it covers for the customer?
— N/A
T0
Answer: N/A
not applicable to this product type
AI & Model-Training
Q16Does the vendor use customer or staff data, including uploaded documents, to train or improve AI or machine-learning models? GATE
? Not addressed
T0
Answer: Unclear
Policy does not explicitly address whether customer or staff data is used to train or improve AI or machine-learning models.
Q17Does the vendor disclose automated decisions that affect staff (screening, scheduling, pay, access) and offer human review?
✗ Concern
T0
Answer: No
Policy does not disclose automated decisions affecting staff (screening, scheduling, pay, access). No mention of such automated decision-making.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy laws it complies with?
? Not addressed
T0
Answer: Unclear
Policy discloses data storage in the United States and names compliance with Data Privacy Framework (EU-U.S., UK Extension, Swiss-U.S.). · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “Blackbaud is headquartered in the United States of America. When Blackbaud collects personal data of individuals located in the European Union, United Kingdom, or Switzerland, we may transfer such data to the United States. Blackbaud has self-certified to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework.”
Contract & Assurance
Q19Does the vendor offer a data-processing agreement or equivalent written terms to customers?
? Not addressed
T0
Answer: Unclear
Policy does not explicitly mention a data-processing agreement or DPA available to customers.
Jurisdiction & residency — your footprint
Vendor does not disclose data-storage location or applicable privacy regimes. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ⚠ Gap |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ⚠ Gap |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ⚠ Gap |