Android SMS Gateway for NGOs: Compliance notes

What these notes are not

Not a GDPR certificate. Not ICRC/Sphere policy. Not a CRM. An Android SMS gateway sends through your SIM to numbers you already hold. The NGO still decides lawful basis, retention, and whether a beneficiary MSISDN is an appropriate channel. Counsel and your data-protection officer first. Market overview lives on the NGO use of transactional SMS, not here.

If the donor list lives on a volunteer’s WhatsApp export, you do not have consent. You have a leak.

Three lanes, three lawful bases

Fundraising (appeals, receipts, gala reminders) is promotional even when the cause is good. Operational alerts (clinic hours, distribution site moved, staff recall) are a different purpose. Staff OTP for the case system is a third. Mixing those on one radio is how a STOP from an appeal kills a dispatch ping — or how a field blast lands on a lapsed donor who never opted into that program.

Traffic class table

What never goes in a PDU

Names plus clinic, HIV status, school attendance of a minor, household GPS, cash-transfer amounts tied to an identity. The gateway will send whatever you POST. That is the risk. Prefer “{org}: update for your program. Open {portal}. Reply STOP to appeals.” Contacts live in contacts and lists with a suppression flag, not in a shared drive called FINAL_DONORS2.

STOP on fundraising, not on safety

CTIA-style STOP/HELP/identification still apply to donor marketing in markets that follow those norms. Wire keywords on auto-reply and STOP. Quiet hours for appeals: scheduled SMS. Life-safety notices need written policy, not a developer “skip_stop=true” habit. US industry messaging principles: CTIA. Not a humanitarian statute.

A compliance-minded NGO send path

1. Inventory lists by purpose. Donors, volunteers, staff, beneficiaries. Separate consent records. Do not merge a gala CSV into the field-alert book.
2. Ban case data from templates. Org name, notice type, short URL without session tokens. No diagnoses, no GPS, no “your child is…”.
3. Wire STOP on the fundraising SIM. Keyword rules to suppression. HELP to a human, not an autoresponder loop.
4. Keep OTP on another radio. Staff portal and donor-portal logins never share the appeal device.
5. Minimize logs. Template id + timestamp in tickets. Full bodies with names do not belong in Slack exports.
6. Name a data owner. Who may import a list. Who deletes a volunteer’s leftover CSV. Who is on-call when the appeal phone dies at 21:00.

Pairing: device setup. Product data-handling: GDPR-minded data handling. Live params: SMS API documentation.

Whose phone, whose SIM

Dedicated charged Android, OEM exemptions, nickname per program. Dual SIM in one chassis is not two custody domains — see multi-device and dual SIM. When a country office shuts, export consent flags before you wipe the handset.

Cost and records

Service pricing is based on device count and total SMS sent through the gateway. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance. Free is 300 SMS lifetime for a canary list, not a national appeal. Paid from $19/month. Device and SMS volume pricing. Grant budgets should line-item operator airtime separately from the platform fee.

Next steps

Split SIMs, shorten templates, name a data owner, and keep case files in the case system — not in the PDU.