Donor Privacy for Fundraisers: The $5,000 IRS Rule and Vendor Risks

October 12, 2026

Donor Privacy for Fundraisers: The $5,000 IRS Rule and Vendor Risks

Protecting donor privacy means three things, done together: publish a clear, specific privacy policy, lock down donor systems with encryption and multi factor authentication, and vet every vendor who touches donor data with a signed contract. The Supreme Court, the IRS, and the FTC have all weighed in on how charities must handle donor information, and we’ve built our own charity practices for donor privacy around that same foundation of law, security, and trust.

TL;DR:

• Charities report contributors giving $5,000 or more annually to the IRS, but most public 501©(3) charities’ Schedule B names are not open to public inspection.
• Encrypt donor records in transit and at rest, require multi factor authentication, restrict access by role, and approve and log every bulk data export.
• Privacy policies should explain collected data, its uses and sharing, retention periods, and anonymous giving or opt out choices on donation forms and receipts.
• For anonymous gifts, keep donor identities in restricted internal records and use redacted versions for disclosures; acknowledgment letters must still substantiate deductions above $250.
• Before vendors handle donor data, verify security practices and breach history, then sign agreements covering deletion, audit rights, breach notice deadlines, and liability.

Table of Contents

• Legal baseline and sector standards for donor privacy
• Data security controls fundraisers should require and prioritize
• What to include in a donor privacy policy and how to present it to donors
• Vendor and third-party risk: vetting checklist and contract provisions
• Incident response and donor notification: an immediate checklist
• IRS compliance and practical handling of anonymous or large gifts
• HCRF resources, templates, and examples to adapt
• Privacy as stewardship
• Give privately, give with purpose
• FAQ
• Sources

Legal baseline and sector standards for donor privacy

Donor privacy isn’t just a courtesy we extend, it’s a right with real legal weight behind it. In Americans for Prosperity Foundation v. Bonta, the Supreme Court struck down California’s blanket demand for unredacted donor lists, ruling that compelled disclosure of major donors’ identities burdens First Amendment associational rights when the state cannot guarantee confidentiality. That precedent now shapes how any organization should think about who gets to see a donor’s name and why.

On the tax side, the IRS Schedule B instructions require charities to report contributors who give $5,000 or more in a tax year, but for most 501©(3) public charities, those contributor names and addresses are shielded from public inspection. That distinction matters: reporting to the IRS and exposing donor identities to the public are two very different obligations, and confusing them erodes the trust donors place in us.

Sector norms echo the same principle. The Donor Bill of Rights calls for confidentiality “to the extent provided by law,” and groups like CharityWatch benchmark whether charities share donor data, offer opt-in choices, or keep everything private by default.

• Courts limit compelled disclosure of donor identities absent narrow tailoring.
• IRS Schedule B shields most contributor names from public view.
• The Donor Bill of Rights makes confidentiality an explicit donor expectation.

Data security controls fundraisers should require and prioritize

A privacy policy means little without the technical backbone to enforce it. The FTC’s cybersecurity guidance for nonprofits treats this as routine business practice, not an optional upgrade, and we’ve found the same handful of controls do most of the heavy lifting.

1. Encrypt donor data at rest and in transit so a stolen laptop or intercepted email never exposes a usable record.
2. Require multi factor authentication on every system touching donor information, from the CRM to the email platform.
3. Apply least-privilege access so only the staff who need donor records can see them, with role-based controls that limit what each login can touch.
4. Patch systems on a regular schedule, back up data offsite, log access activity, and schedule periodic penetration testing or security audits.
5. Build approval workflows for donor data exports and share records only through secure, time-limited links rather than open email attachments.

None of this requires a dedicated IT department. A small fundraising team can delegate access thoughtfully, require a second person’s sign off before any bulk export, and still meet the same standard a large institution follows.

Pro Tip: Treat every donor data export like a withdrawal from a bank vault: log who requested it, who approved it, and when it was deleted.

What to include in a donor privacy policy and how to present it to donors

A donor privacy policy earns trust when it answers plain questions in plain language: what we collect, how we use it, whether we ever share it, how long we keep it, and how a donor can opt out or give anonymously. Each of those points deserves its own sentence, not legal shorthand.

• State exactly what information is collected, from names and addresses to payment details.
• Explain how that data is used internally, including for mailings, acknowledgments, and reporting.
• Disclose whether any data is ever shared with outside organizations, and under what conditions.
• Set a retention schedule so old records don’t linger longer than necessary.
• Offer a clear opt-out or anonymous-giving option, with a named contact for privacy questions.

CharityWatch’s benchmarks sort charities into no-sharing, opt-in, and opt-out categories, and donors increasingly expect the first two. An opt-in approach, where sharing happens only with explicit permission, builds more goodwill than a buried opt-out checkbox ever will.

This language belongs in more than one place: the donation form itself, the response card for mail donors, every acknowledgment receipt, and a dedicated privacy page donors can find without digging.

Vendor and third-party risk: vetting checklist and contract provisions

Every vendor who touches donor data becomes an extension of our own privacy promise, which means vetting them matters as much as vetting our own systems.

1. Confirm the vendor holds relevant security certifications and ask directly about any past breach history.
2. Verify how donor data is segregated from other clients’ data and who internally has access to it.
3. Require a signed data processing agreement that spells out retention and deletion obligations in writing.
4. Insist on audit rights so we can verify compliance rather than take it on faith.
5. Set firm breach-notification timelines and clear liability terms before any contract is signed.

The FTC’s 2024 order against Blackbaud is the cautionary tale worth knowing. After a breach exposed millions of consumers’ personal data, the FTC required Blackbaud to delete unnecessary information and build a comprehensive security program it should have had from the start. A retention-limit clause and a mandatory security-audit clause, negotiated up front, would have mitigated exactly that kind of exposure.

Incident response and donor notification: an immediate checklist

When a breach happens, speed and honesty protect donors more than silence ever will.

• Contain the breach immediately: isolate affected systems before anything else.
• Engage legal counsel early so notification decisions follow the law, not guesswork.
• Preserve logs and evidence rather than wiping systems clean in a rush to fix them.
• Assess precisely what data was exposed before drafting any donor communication.
• Notify donors with specifics: what happened, what information was involved, and what steps we’re taking.

Timing matters as much as content. Regulators may set their own notification windows, and donors deserve to hear from us before they hear about it elsewhere.

Pro Tip: Draft a breach-notification template in advance, calm, factual, and specific, so a crisis never becomes an excuse for vague language.

IRS compliance and practical handling of anonymous or large gifts

The IRS Schedule B threshold requires charities to report any contributor who gives $5,000 or more in a tax year, but that report goes to the IRS, not the public. For most 501©(3) public charities, contributor names and addresses on Schedule B are not subject to public inspection, which gives us real room to honor a donor’s request for anonymity while staying fully compliant.

Good recordkeeping makes anonymous giving workable rather than risky.

• Keep an internal, access-restricted record of every contributor’s identity even when a gift is publicly anonymous.
• Maintain a parallel, redacted version for any disclosure that doesn’t require the donor’s name.
• Issue acknowledgment letters that satisfy IRS substantiation rules for deductions above $250 without naming the donor publicly.
• Reconcile anonymous recognition at events with accurate internal records so stewardship and privacy coexist.

Handled this way, a donor can give generously, remain unnamed in a gala program, and still receive the documentation needed to claim a deduction.

HCRF resources, templates, and examples to adapt

We’ve built several resources that double as working templates for other fundraising teams.

• Our guidance on anonymous charitable donations walks through how to give privately while staying IRS-compliant.
• Our notes on protecting privacy for gifts over $250 cover the substantiation paperwork anonymous donors still need.
• Our donation receipt templates show how to acknowledge a gift without exposing unnecessary detail.
• Our Form 990 filings offer a real example of transparent nonprofit reporting.

Borrow the structure, adapt the language, and build your own version around these starting points.

Privacy as stewardship

Protecting a donor’s information is never just a compliance checkbox for us, it’s how we honor the trust that makes every gift possible. Every encrypted record and every anonymous acknowledgment is a quiet promise that generosity will never be exploited. That promise is what keeps donors giving year after year, and we hold it close in everything we build at HCRF.

— HCRF

Give privately, give with purpose

For donors who want a private way to support cancer research, events offer a warm, discreet path to giving. Cocktails for a Cure welcomes supporters in an intimate setting built on trust, and the Annual Wings To Cure Gala carries that same spirit on a larger stage.

Whichever path fits you, your privacy stays protected every step of the way. Visit the Hippocratic Cancer Research Foundation to explore how your gift can quietly fuel research that changes lives.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What is the difference between a private nonprofit and a private for profit?

A nonprofit organization reinvests any surplus revenue into its charitable mission rather than distributing profit to owners or shareholders, which is the defining distinction from a for-profit company. Nonprofits like HCRF also operate under specific tax rules, including the Schedule B reporting requirements set by the IRS.

What is a person who donates to charity called?

A person who gives money or resources to a charitable cause is generally called a donor or a philanthropist when giving is substantial and ongoing. Charities often recognize different donor types, including anonymous donors, major donors, and recurring donors, each with their own privacy considerations.

Is there a database for nonprofit organizations?

Yes, nonprofit organizations file Form 990 annually with the IRS, and many charities, including HCRF, publish these filings for public review. These filings show financial activity and governance but, under IRS rules, generally exclude individual donor names from public inspection.

What is the downside to a donor-advised fund?

A donor-advised fund can limit a donor’s direct control once a gift is made, since the sponsoring organization legally owns the assets and the donor can only recommend, not direct, how grants are distributed. Donors considering this route should weigh that tradeoff against the privacy and flexibility of giving directly to a charity.

Sources

• Americans for Prosperity Foundation v. Bonta — Supreme Court opinion
• Instructions for Schedule B (Form 990) — IRS
• FTC: Order will require Blackbaud to delete unnecessary data, boost safeguards
• Cybersecurity resources for non-profits — Federal Trade Commission

Recommended

• Anonymous Charitable Donations: Give Privately and Stay IRS-Compliant
• Charitable Donation Receipts: IRS Rules and Templates