Navigating AI, Copilot and data security for Australian not-for-profits

Not-For-Profit (NFP) National Leader, Elizabeth Blunt, recently hosted a webinar focused on AI adoption, while maintaining and strengthening privacy, security, and governance. Joined by Julie Kilner, BDO in Australia Partner, Digital, Wayne Anderson, Managing Director, Cyber Security and Digital Innovation, BDO USA, and Margaux Guidon, Microsoft AI, Copilot and agents specialist, they covered the data privacy expectations, potential governance, and compliance, how AI can help address long-standing sector challenges, and what successful implementation and adoption can look like. Watch the full webinar.

Data privacy and regulatory expectations for Australian NFPs

Across the industry, there is data everywhere, but often, we don’t know what we have, where it is, or what we’re supposed to do with it. In the NFP sector this challenge is amplified, because you are holding people’s stories, health information, financial information, family, cultural, and community context.

In the Australian data landscape, three main shifts are underway. Our Privacy Act is currently under reform and to date has introduced increased enforcement powers, penalties and individual rights under privacy laws. More broadly, there is increased regulatory focus on data handling practices, where regulators are prioritising the over-collection of data, poor retention and disposal practices, weak access controls, and a lack of transparency. Alongside these focuses, AI is now firmly within regulators’ scope. Australia does not currently have a single AI act, however the expectations are clear, AI must be safe, explainable, and fair. Organisations must understand how AI uses their data and align with frameworks such as Responsible AI principles and risk-based AI governance.

What this means for NFPs is where historically organisations have applied the small business exemption under the Privacy Act, these exemptions are becoming increasingly irrelevant in practice, as many NFPs now fall within the scope of the reformed Act. Government contracts often impose privacy regulations regardless of size and regulators are implying that exemptions may be reduced or removed over time. More importantly, community expectations are that data is protected, information is respected and privacy is taken seriously, seeing a shift from “are we regulated” to “are we acting responsibly”.

There are four core expectations for NFP compliance:

• Collect only what you need
• Know what data you hold and where it is stored
• Manage the full data lifecycle, collections, storage, and deletion when no longer required
• Control and monitor access, including third-party and cloud providers, with accountability remaining with the organisation.

Meeting these expectations can be difficult for many NFPs because many organisations are longstanding and not starting the compliance journey from a blank slate. Many are dealing with constraints such as legacy systems, limited funding, decentralised operations, unfamiliarity with the Privacy Act, and passion-driven service delivery.

Which is then compounded by the key challenges many are facing, which are:

• AI risk and governance – staff using tools like ChatGPT or Copilot
• Increasing regulatory scrutiny – more proactive enforcement
• Managing unstructured data – tackling archive folders and large caches of stale documents
• Resource constraints – doing more with limited funding and capacity.

Ideally you need to be targeted and pragmatic, not perfect.

In the not-for-profit sector, data is not just an asset, it is a reflection of the people you serve, and how you manage that data is increasingly how you will be judged, not just by regulators - but by your communities, your funders, and your future partners. Documentation must go beyond privacy policies and include data-handling procedures and practised breach response plans. Your staff awareness and training are critical as we see most risks arising from everyday behaviour, not malicious intent. Moving forward this training and awareness should cover AI governance including staff using AI tools with sensitive data.

How AI tools are transforming productivity

Tools such as AI offer a new way to tackle many ongoing challenges in the NFP sector including stretched teams and high turnover, administrative burdens that pull staff away from mission work, disconnected systems, and growing expectations for transparency and accountability. With the right AI systems, we’re able to reduce processes, simplify work, and free up time for your work that truly matters.

Microsoft Copilot and their agents can be integrated into daily workflows and adapt to support individual roles, with the potential to build custom agents specific to your organisation’s internal needs, while also critically working with built-in compliance and security. Utilising AI tools like Copilot can lead to organisations experiencing reduced time toggling between systems by unifying them into one intelligent experience, freeing up hours by automating tasks, improving staff retention by reducing burnout through personalised AI assistance, and the ability to strengthen trust and scalability by adopting secure, compliant AI that evolves with the organisations needs. 

It’s important that AI products are based on a responsible AI framework, one of Microsoft’s main principles to ensure responsible AI is building trust. Key components of this trust include your data remains your data, and it’s not used to train or enrich foundational AI models without permission. It can, however, help shine a light on your data, showing how it’s structured, who has access, and how it flows. Introducing AI doesn’t mean choosing between innovation and security, it’s about understanding and utilising the right tools.

BDO supporting NFPs through implementation and change

As Australian NFPs navigate rapid advances in AI, there is a clear opportunity to reduce administrative burden, support stretched teams, and redirect effort to the organisation’s critical work. Success with AI and data depends on getting the fundamentals right, understanding what data is held and where, strengthening lifecycle and access controls, and establishing practical governance to meet rising regulatory expectations for transparency, safety, and fairness.

Building on this, we’ll continue to share further insights with an article series over the coming weeks to support leaders as they consider how emerging technologies, data and governance overlap with their mission and operations.

Staged approaches balancing technology, people, and process change allow NFPs to adopt AI with confidence, strengthen trust with communities and regulators, and deliver greater impact at scale. If your organisation is ready to explore how AI can support your organisation, BDO’s NFP and cyber security specialists can help you move into the next step.

Watch the webinar or learn more about our not-for-profit webinar series.