We have significant concerns about this change as it relates to Canadian privacy laws, best practices, and donor accessibility, which we believe must be addressed before moving forward.
Our organization operates under Canadian privacy legislation and industry guidelines that explicitly advise against collecting CVV information through mailed or paper-based forms. The CVV is intended solely for use at the point of transaction, meaning it should be entered only by the donor to authorize a payment in real time. It should never be recorded, mailed, or handled by a third party. As a result, we have already removed CVV fields from all our paper-based and mail-in donation forms to remain compliant with these standards.
Requiring CVV for back-office credit card entry workflows creates a direct compliance conflict for our organization. Under Canadian guidelines, collecting CVV outside of a live, donor-authorized transaction is not simply discouraged — it is contrary to recommended practice. This requirement does not appear to account for organizations operating under Canadian regulatory frameworks.
We also have serious concerns about donor accessibility. Many of our donors — particularly seniors and those who are not comfortable with technology — rely on mailed forms as their primary and preferred way to give. Blackbaud's suggestion to redirect donors to QR codes or online donation forms is neither realistic nor equitable for this segment of our donor base. Donors should be able to give in the way that is most convenient and familiar to them, without unnecessary barriers. Placing additional friction on paper-based giving risks excluding some of our most loyal supporters and disproportionately impacts those who are already underserved by digital-first approaches.
We would ask that Blackbaud:
- Review and acknowledge the specific privacy and security guidelines that govern Canadian charitable organizations before implementing this requirement universally.
- Provide an exemption or alternative workflow for organizations that cannot collect CVV through back-office or paper-based processes under Canadian guidelines.
- Clarify how this requirement aligns with PCI DSS obligations for organizations that do not and cannot collect CVV at the point of data entry.
- Reconsider the suggestion that QR codes and online forms are adequate alternatives, and engage with the accessibility implications of this change for diverse donor populations.
We are committed to protecting our donors' payment information and to maintaining an inclusive, accessible giving experience. How will Blackbaud support Canadian organizations in meeting both your new requirements and our own regulatory and ethical obligations?
