Experts say nonprofits should use new rules as an opportunity to rethink how they manage data and privacy.