This is the briefing I give a charity board before we move supporter and client records into Zoho CRM. It covers where the information is held, what the law asks of the charity and how each point is met. Most of it applies to any cloud system, not only Zoho.
What is built in from day one
- Sign-in. Multi-factor authentication, and access set by role so each person sees what their work needs.
- Logins. Limited to trusted IP addresses where that suits your team, with encryption in transit and at rest.
- A record. Zoho keeps a record of changes. If you hold sensitive records, I can add a trail showing who viewed them and when.
- Where it sits. Zoho’s Australian data centres, under a data processing agreement that your charity signs.
What changes when you move off spreadsheets
Moving from spreadsheets to a CRM raises the level of protection in five ways:
- Sign-in. Multi-factor authentication on every login. A shared spreadsheet often relies on one password.
- Access. Set by role and by record, instead of whole-file access to everything in the sheet.
- Visibility. A record of who changed what, and who viewed sensitive records.
- Control. Information stays in one managed system, not in copies that can be saved, emailed or lost.
- Assurance. A signed data processing agreement, and independently certified security standards behind it.
A spreadsheet isn’t careless. It just wasn’t built to hold other people’s personal information.
Where the information is held
- The data centres. Zoho’s Australian cloud runs from Sydney as the main site and Melbourne as the backup, in Equinix facilities. Zoho’s infrastructure FAQ lists both.
- How you can tell. When your account is in the Australian centre, you log in at an address ending in zoho.com.au. I confirm that on your account.
- Protection. Zoho’s security FAQ says data is encrypted at rest and in transit, that data in the main centre is replicated to the backup, and that backups are kept for three months.
- Certification. The same page says Zoho holds ISO 27001, 27017 and 27018 certification and SOC 2 Type 2 reporting, audited every year. Ask Zoho for the current reports if your board wants to see them.
The law, and how it is met
Agents (Privacy Act 2020, section 11)
What it says. Information a provider holds for you as your agent is treated as held by you, unless the provider uses or discloses it for its own purposes. The Privacy Commissioner says that in most cases you aren’t required by law to have a special agreement with an overseas cloud provider, because you stay responsible for the information.
How it is met. Zoho processes the information on your charity’s instructions. I help you sign Zoho’s data processing agreement and ask Zoho to confirm in writing that it doesn’t use your data for its own purposes.
Information held outside New Zealand (IPP 12)
What it says. Before a true overseas disclosure, your charity needs to be satisfied that the receiver will protect the information with comparable safeguards to the Privacy Act, for example because it is subject to similar laws or bound by an agreement.
How it is met. Australia has its own Privacy Act 1988, and the data processing agreement puts the protections into a contract. That is the backup if Zoho ever acts outside the agent role.
Storage and security (IPP 5)
What it says. Information must be protected by security safeguards that are reasonable in the circumstances. When a service provider is involved, the charity must do everything reasonably within its power to prevent unauthorised use or disclosure.
How it is met. Multi-factor sign-in, role-based access, trusted IP addresses and encryption, plus the viewing trail. I review Zoho’s sub-processors and switch off optional features, such as AI tools, that your work doesn’t need.
Information from other sources (IPP 3A, in force from 1 May 2026)
What it says. When you collect information about a person from someone other than that person, such as a referrer or partner agency, you must take reasonable steps to make them aware of it: that it was collected, why, who will receive it, your charity’s name and address, and their right to see and correct it.
How it is met. The CRM records where each record came from and whether the person has been told. Referral partners’ forms or privacy statements can carry the notice by agreement, but your charity checks that it was delivered, because the responsibility stays with you.
Notifiable privacy breaches
What it says. A breach likely to cause serious harm must be reported to the Privacy Commissioner as soon as practicable, and the people affected must be told. The Commissioner’s expectation is within 72 hours of you knowing the breach is notifiable. That is a guide, not a legal deadline.
How it is met. I ask Zoho to put in writing how quickly it will tell you about an incident. The record of changes and views shows what was accessed, and I can add a short breach checklist to the handover.
If your charity provides health or disability services, the Health Information Privacy Code 2020 may apply its own 13 rules in place of the privacy principles for that information. The same safeguards are a good fit for those rules too.
Questions boards ask next
Does our information have to stay in New Zealand?
No. The Privacy Act doesn’t require New Zealand-only hosting. It makes your charity accountable for the information wherever it is held, and the steps above are how that accountability is met.
Who at Zoho can see it?
Zoho’s privacy policy says access to customer data is restricted to specific individuals, logged and audited, and given on a need-to-know basis. It also says employees and contractors of other Zoho Group companies can be involved. I ask Zoho to confirm in writing which countries that covers.
Can Zoho use or sell our data?
Zoho’s privacy policy says it has never sold personal information for advertising or made money by showing other people’s ads, and that it only processes your data according to your instructions. The data processing agreement and Zoho’s written confirmation lock that in.
What if we want to leave Zoho?
You can export your data at any time, and I set up regular exports. Zoho’s privacy policy says that after an account closes, your data is deleted from its live database within six months, and from its backups within three months after that.
Other charities already do this
The Men’s Table, an Australian men’s peer-support charity, moved from spreadsheets to Zoho CRM because of the sensitivity of the personal data it holds. It now runs events, member participation and funding in the CRM, and relies on being able to trace the cause of any change to a record. That is from Zoho’s customer story, not a Good Systems client.
Six things to ask any provider in writing
- Which data centre holds our account?
- Do you use our data for your own purposes?
- Which countries can your staff and group companies reach it from?
- How quickly will you tell us about an incident?
- How do we export everything, and what happens to our data when we leave?
- Which optional features, including AI tools, can be switched off?
What I would do next
If you’re weighing up a donor system, tell me what you hold and who needs to see it. I’ll show you how the access would be set up, and put these questions to Zoho in writing before anything moves. There’s more on what a donor system costs and what’s in it, and a plain-English guide to Zoho CRM for charities.
Sources
- Privacy Act 2020 and the Privacy Commissioner’s pages on IPP 5, IPP 12, IPP 3A and disclosing personal information outside New Zealand
- What is a notifiable privacy breach? and how long is 72 hours?
- The Health Information Privacy Code 2020
- Zoho’s privacy policy, security FAQ and infrastructure FAQ