The increasing digitalization of society has intensified the importance of secure and effective data management. For human rights defender organizations, these demands are complicated by scarce resources and risks of surveillance and online harassment. Simultaneously, regulatory frameworks such as the GDPR shape how these organizations are required to handle data. This paper examines how human rights defender organizations in Sweden navigate data practices, focusing on their strategies, challenges, and the effects of legal requirements. Drawing on critical data literacy and data feminist perspectives, we conceptualize data literacy as the ability to interpret and act on data in relation to its social and political effects. We show that limited resources significantly constrain organizations’ ability to adopt robust data practices. Nonetheless, data remains crucial for their advocacy and support of marginalized communities. We contribute to HCI by showing how human rights defender organizations develop situated, feminist forms of critical data literacy that challenge dominant assumptions about security, compliance, and good data practice.