Nonprofit document retention policy: which donor data should you keep or purge?

Why does donor data cleanup belong on your year-end list?

Every donor record you keep is one you have to protect, and year-end giving adds new records quickly. A cleanup before the books close shrinks what a breach could expose and puts your nonprofit document retention policy into practice.

Your board sees this topic every year. The IRS instructions for Form 990 note that Part VI, line 14 asks whether the organization has a document retention and destruction policy. Answering yes is easier to stand behind when staff actually follow the policy.

California law already expects that protection. Civil Code section 1798.81.5 requires a business that owns, licenses or maintains personal information about California residents to keep reasonable security procedures. For this part of the Civil Code, section 1798.80(a) defines a business to include an association or other group "whether or not organized to operate at a profit." Data you no longer need still has to be secured until it is gone, so deleting it on schedule is one of the cheapest security controls an executive director can approve.

How long should a nonprofit keep donor records?

Keep records that support your Form 990 at least until the IRS statute of limitations runs, which is three years after the return is due or filed, whichever is later. The IRS guide for public charities, Publication 4221-PC (Rev. 3-2018), says charities must keep records "for as long as they may be needed" for federal tax purposes, and employment tax records for at least four years after filing the fourth quarter for the year.

Some records the same publication says to keep permanently: the exemption application, the IRS determination letter, organizing documents and amendments, and board minutes. Those rarely contain sensitive donor details, so they are not the problem in most cleanups.

Keep copies of gift acknowledgments as well. Publication 4221-PC explains that a donor cannot deduct any single contribution of $250 or more without a contemporaneous written acknowledgment from the charity, and that a quid pro quo payment over $75 requires a disclosure statement. Copies let you answer a donor or an auditor who asks later. Your board-approved document retention policy sets the actual periods. Check with your auditor or counsel before shortening them.

What should a nonprofit document retention policy say about donor data?

It should list each type of donor record, name the system that holds the official copy, set a retention period for each, and say how expired records are destroyed and who signs off. Copies outside the system of record, such as spreadsheet exports and email attachments, should have the shortest period of all. Ask your auditor or counsel to review the periods before the board adopts them.

Does California's records disposal law apply to nonprofits?

It can, because the law's definition of a business includes groups not organized for profit. Civil Code section 1798.81 requires a business to take all reasonable steps to dispose of customer records containing personal information when they are no longer to be retained, by shredding, erasing or otherwise modifying the information so it is unreadable or undecipherable. Section 1798.80(a) defines a business to include any group "whether or not organized to operate at a profit."

The open question is who counts as a customer. Section 1798.80(c) defines a customer as an individual who provides personal information to a business to purchase or lease a product or obtain a service. Program clients, event ticket buyers and thrift store shoppers fit that description closely. Whether a pure donor does is a question for counsel. The safer operating assumption is to dispose of every record holding personal information the same way. Section 1798.84 lets a customer injured by a violation sue for damages and allows a court to enjoin a business that violates the title.

Does the CCPA apply to nonprofits?

Usually not, because the CCPA generally covers for-profit entities. The California Consumer Privacy Act defines a covered business in section 1798.140(d) as an entity "organized or operated for the profit or financial benefit of its shareholders or other owners." Most charities fall outside that definition, though the same subdivision has separate tests that can reach an entity connected to a covered for-profit business.

Being outside the CCPA does not remove the reasonable security and disposal duties described above. It also does not change your contracts. A payment processor agreement or a government grant can impose its own data handling terms.

What donor data should you purge?

Purge donor data that creates risk and serves no ongoing purpose, starting with these categories:

• Card numbers written on paper pledge forms, typed into spreadsheets or sent by email. Once a payment is processed, the full card number has no reason to stay in your files. PCI DSS applies to any organization that accepts cards, regardless of tax status. If you take gifts online, see how to protect your donation page from card testing fraud.
• Bank routing and account numbers from paper recurring gift or ACH forms, once the information lives with your processor.
• Government ID numbers, if any were ever collected for events, volunteers or raffles.
• CRM exports: mailing lists, gala seating charts and appeal segments saved as spreadsheets in email, downloads folders, shared drives and personal cloud accounts.
• Mailboxes and OneDrive folders of former staff and volunteers that still hold donor correspondence.
• Prospect and lapsed-donor records past the period your retention policy sets.

Keep giving history, acknowledgments and the records your audit and Form 990 preparation depend on. Purge the stray copies and leave the system of record intact.

How do you delete donor data so it is actually gone?

Delete it in every place it lives, using a method that makes it unrecoverable, and keep a record that you did. For paper, that means cross-cut shredding or a destruction vendor that issues certificates. For electronic media being retired, NIST SP 800-88 Rev. 2, published in September 2025, is the federal guideline for sanitizing storage media so data cannot be recovered. Ask your IT provider or disposal vendor which sanitization method they used and to confirm it in writing.

Three details are easy to miss:

• Some donor CRMs archive or deactivate records instead of deleting them. Confirm whether your platform's delete function actually removes the data.
• Backups keep deleted data until they age out. Know your backup retention period so you can say when a deletion becomes final.
• Vendors hold copies too. Mailing houses, event platforms and former CRM vendors may still have files you sent them. Ask for written confirmation of deletion.

What should a nonprofit do before December 31, 2026?

Assign one owner, usually the operations or development director, and work through a short list:

• Confirm your document retention policy is current and board approved, since Form 990 asks whether you have one. If you do not, put it on the next board agenda.
• Search shared drives, email and Microsoft 365 for spreadsheets and documents containing card numbers, bank details and ID numbers, and delete or redact them.
• Shred paper pledge forms and ACH forms that have been processed.
• Remove or archive mailboxes and file access for former staff and volunteers.
• Clean lapsed and duplicate records in the CRM according to your retention periods.
• Request deletion confirmations from vendors you no longer use.
• Write down what you deleted, when and how. A one-page log is enough.

The free security wins we published for Cybersecurity Awareness Month pair well with this cleanup if you want to tighten access at the same time.

How s90 helps

s90 helps nonprofits find where donor data actually lives, from Microsoft 365 to old file shares to former staff accounts, and remove what no longer needs to be there. We set up retention settings that match your policy and sanitize retired devices to NIST SP 800-88 with records you can show an auditor or funder. If a year-end donor data cleanup is on your list, we are glad to help you scope it.