Fundraising Commons Team 4 min read How to benchmark fundraising against peers without exposing a single donor record
About the Author
The open, vendor-neutral commons behind the Advancement Common Data Model (ACDM™) and its free educational resources. We write about trustworthy advancement data, portability, and AI-readiness for fundraising teams of any size. Stewards are credited in the colophon, never in the byline.
You can benchmark your fundraising against peers without exposing a single donor record. The key is to stop sharing data and start sharing definitions: every organization computes its own metrics inside its own walls, against the same agreed rules, and only the summary numbers (never the underlying records) are ever pooled. Comparison happens on aggregates, not on donors.
How do you benchmark fundraising without sharing donor data?
The instinct is to send everyone’s data to a central place and compute there. That instinct is the problem. Flip it: send the math to the data instead of the data to the math.
- Agree on the metric definition. Everyone uses the identical numerator, denominator, time basis, and population: the same definition of
donor_retention, the same window, and the same rule for who counts. - Each organization computes locally. The calculation runs inside each shop’s own environment, on its own records. Raw donor data never moves.
- Pool only aggregates. What leaves each organization is a single summary number (a retention rate, a median gift), not a list of people. The comparison is built from those aggregates.
The one rule
No donor record ever crosses an organizational boundary. You still learn exactly where you stand.
Why benchmarking usually means handing over data, and why that’s a dealbreaker
Traditional sector benchmarking asks you to upload your donors to a third party, who then computes everyone’s numbers in one pile. For an advancement shop, that’s often a non-starter, and rightly so: a CISO won’t sign off on shipping constituent records to an outside aggregator, donors didn’t consent to it, and privacy regimes like GDPR and CCPA treat that movement as exactly the kind of thing you have to justify. So the organizations who most need to compare notes (the under-resourced ones) opt out, and the sector stays unable to learn from itself.
The fix isn’t better legal language around data sharing. It’s not sharing the data.
The shift: share definitions, not data
This works because of a simple separation. A benchmark needs two things: a common question and comparable answers. The common question is the metric definition, and a definition is not sensitive.
”Retention, counted this specific way” can be published openly; it reveals nothing about anyone’s donors. The sensitive part, the records, never has to leave.
So the only thing that has to be shared and standardized is the part that’s safe to share. This is why the groundwork matters: you can only compute comparable aggregates if everyone’s definitions actually match, which is the whole reason “how many donors do we have?” and a neutral model like ACDM come first. Benchmarking is what becomes possible after your definitions agree.
A worked example
Three synthetic shops want to compare donor retention (illustrative figures):
| Shop (synthetic) | Computes locally | Shares | Never shares | |---|---|---|---| | Riverbridge Land Trust | retention = 0.46 | 46% | the donor list | | Hollow Creek Arts | retention = 0.39 | 39% | the donor list | | Pinemark Education Fund | retention = 0.52 | 52% | the donor list |
Riverbridge learns it’s mid-pack and below Pinemark, a genuinely useful signal, and not one donor record left any of the three buildings. Each ran the same definition, so the 46% and the 52% mean the same thing and are actually comparable. That last clause is the whole game: comparing differently-defined numbers is worse than not comparing at all, because it looks like insight and isn’t.
What about small cohorts and re-identification?
Aggregates aren’t automatically safe. A “retention rate” computed over five donors can leak information about those five people.
Aggregates still need guardrails
Real privacy-preserving benchmarking sets minimum cohort sizes before a number is shared, suppresses cells too small to aggregate safely, and checks that combinations of metrics can’t triangulate an individual. The principle holds (raw data never leaves), but the aggregates themselves need thresholds.
This is an area we’re developing in the open, and we’d rather say plainly that it needs rigor than wave it away.
What you need to make it work
- Defined metrics everyone computes the same way, maintained openly in the metric-definitions repository so a definition lives once.
- A neutral data model so “donor,” “gift,” and “retention” mean the same thing across shops with different CRMs: that’s ACDM.
- The discipline to keep computation local: the comparison consumes aggregates, never records.
Get those three in place and you close the gap the sector has lived with for decades: you can finally see how you compare and keep every promise you made to your donors about their data.
An honest note
Privacy-preserving benchmarking is early and evolving here; the standard and tooling are still maturing. The architecture above (local computation, shared definitions, aggregate-only pooling, cohort thresholds) is the durable principle; treat current releases as drafts and expect the methodology to sharpen over time.
For the leadership and security view of “raw donor data never leaves your walls,” see How It Works and the FAQ.
Examples use synthetic data. ACDM and the metric definitions are open and early; treat current releases as drafts.
Related Articles
Grateful patient fundraising and HIPAA: what donor data can a hospital foundation use?
HIPAA allows grateful patient fundraising with a limited data set and a required opt-out. Here's how to model that boundary so you can prove it's respected.
Why the fundraising sector can't learn from itself, and what a commons would change
Nonprofits can't benchmark against each other because data is trapped twice over and comparing has meant exposing donors. A commons changes both. Here's the whole argument.
Synthetic donor data: how to test cadences and policies safely
Synthetic donor data is artificial records that mirror your real data's patterns but describe no actual person, so you can test cadences, models, and policies without risk.