PH 02 18 - Philanthropy Customer Relationship Management System Privacy Impact Assessment

Currently, there are 4 Philanthropy databases representing the historical way the Canadian Red Cross aligned the fundraising teams across the country.  Over the past 2 years a concerted effort has been undertaken to align the 4 databases so that they are being used the same way across the country.
Based on the recommendation of the project sponsor and the ORCA Fund Development (FD) CRM RFP selection committee, Blackbaud’s CRM (BBCRM) product was chosen.  BBCRM meets or exceeds all our technical and business requirements and gets us to the project methodology of 70% out of the box, 30% configurable. CRC has also engaged Blackbaud in a hosted solution (SaS) implementation. The solution will be used/accessed across all Canadian provinces and contain donor information from all provinces and territories.
The project was formally kicked-off in the early Fall of 2017, the requirements have been validated. We are currently in the Design and Test Phase. The planned Go-Live is scheduled for February 2019.
Requirements
CRC is inviting selected Suppliers to respond to this RFQ for CRC is looking to engage the services of a consulting services vendor who has specialized expertise in conducting Privacy Impact Assessments related to Software-as-a-Solution (SaS) implementations. With this project CRC will be moving from 4 separate databases (Blackbaud Raiser’s Edge) on-premise to BB CRM hosted service. It is noted with SaS there are constraints in terms of designing changes to the software design and underlying technology infrastructure.
Objectives
The primary objectives of this consultancy are:

• Complete a privacy analysis of the proposed design of the Blackbaud CRM solution for CRC in the context of a third-party SaS solution that is utilized by CRC and key partners across Canada.
•  Outline in a PIA Report any risks to the institution and its donors and specific recommendations and action items that should be taken to avoid, mitigate any potential risks.