Protecting Voter and Donor Lists: Campaign Data Security

Updated October 2026

The campaign data risk is usually ordinary

Election campaigns rightly worry about sophisticated attacks, but ordinary problems can also be damaging: a volunteer uses a shared password, a staff member emails an entire donor file to the wrong address, a contractor retains access after the election, or a fraudulent sign-in page steals credentials.

Sensitive campaign information includes donor contact details, contribution records, internal supporter identifications, strategically valuable polling notes and access to campaign communications. Some official voter data has specific statutory access or confidentiality requirements. A campaign should not assume that every record received in a political context may be freely shared.

The Federal Trade Commission’s cybersecurity guidance emphasizes knowing what data the organization holds, restricting access, protecting systems and preparing for phishing and ransomware. These are practical steps a county committee can take without operating like a national corporation.

The basics: Keep fewer copies, give each worker only the access the job needs, turn on multifactor authentication (phishing-resistant where possible), keep backups you have actually restored and write the incident plan before you need it. An exposed spreadsheet can cause real damage even when the data was lawfully obtained.

Inventory the information before protecting it

Make a simple register of data locations: official voter file, working campaign database, donor records, email contacts, shared documents, exported phone lists, volunteer devices and archives. Record the owner, purpose, access group and retention expectation for each location.

Do not create multiple “master” files that diverge. One approved source of truth, with controlled access and documented updates, is better than independent versions on personal laptops. If a temporary export is needed, give it a clear owner and deletion date.

Protected addresses, restricted election records and financial details deserve special handling. State law may limit how official data may be used or retained. Preserve those restrictions when data is merged with other lists.

Control	Best for	Timing	Watch out for
Unique accounts and MFA	Protecting sign-ins	Before access granted	Shared credentials
Least-privilege roles	Limiting unnecessary exposure	At onboarding	Role creep
Managed exports	Field and calling assignments	Every export	Files on personal devices
Encrypted backups	Recovering from loss or attack	Ongoing	Untested restore
Access review	Removing stale privileges	Each staffing change	Former contractors
Incident procedure	Fast containment	Before a problem	No decision owner

Four insider controls worth enforcing

1. Never share one campaign login

Shared credentials remove accountability and make it hard to revoke access. Every authorized worker should have an individual account with a role appropriate to the work. A volunteer assigning yard signs does not need donor payment details or the complete voter universe.

2. Treat a CSV export as a disclosure event

Exporting a list can move information outside central controls. Restrict who can download entire files, record when and why exports happen, and use the smallest audience necessary. Remove local copies when the authorized task ends.

3. Rehearse a lost-device scenario

If a field organizer loses a laptop with a downloaded file, who can disable the account, revoke sessions, identify affected records and decide whether notification is required? Write those responsibilities down before the incident. Do not first debate ownership during a crisis.

4. Backups must actually restore

Having a backup checkbox is not the same as recovery capability. Test restoring a sample to a controlled environment and document the time required. Keep at least one recovery method protected from the same compromised credentials that could affect live systems.

Phishing looks like everyday campaign work

Busy campaigns receive invitations, proofs, donor questions, invoices and urgent scheduling requests. Attackers can imitate this routine. A message asking someone to review a final design, reset a password or open a file may arrive at a believable time and from an apparently familiar sender.

Train staff to verify unexpected links, attachments and payment changes using a known communication channel. A request to redirect a payment or export a full donor list deserves independent confirmation even if it appears to come from a senior campaign official.

Multifactor authentication reduces the risk of a stolen password being enough to enter an account. Use stronger phishing-resistant methods where supported, particularly for administrators and finance personnel. Keep devices updated and avoid unnecessary browser extensions.

A response plan in plain language

Define an incident as something worth reporting, not necessarily proof of a breach. Examples include suspicious login notifications, unexpected downloads, missing equipment, an account lockout or a message accidentally sent with an attachment.

The first step is to notify the designated security owner. Then preserve relevant evidence, contain access when appropriate, determine which systems and people are affected and coordinate with counsel on reporting obligations. Avoid public speculation while facts are incomplete.

The plan should identify who can contact the election authority if restricted official data may be implicated, and who can coordinate financial controls if donor transactions may be affected. The response depends on facts and legal obligations, not a generic announcement template.

Our donor data page covers how list handling fits into a fundraising program.

Plan for election-night turnover

Campaigns often bring in temporary staff and volunteers immediately before Election Day. Access should have an expiration plan at the moment it is granted. Create roles with short durations when possible and schedule a post-election permissions review.

Do not leave contractor access, temporary sharing links or exported lists active because the campaign is exhausted after voting ends. Preserve records that law requires the committee to retain while removing copies no longer necessary.

Tie data access to campaign assignments, not to personalities, so permissions end when the work does.

This is general information, not legal advice. Check current rules with your campaign’s counsel.

Data security checklist

Inventory all voter, donor and campaign-sensitive datasets.
Record source restrictions and approved purposes.
Use unique accounts and multifactor authentication.
Limit each person’s access to legitimate work.
Keep a log and expiration policy for exports.
Protect and periodically test backups.
Train staff on phishing and independent payment verification.
Establish one incident reporting contact and a response plan.
Review contractor and volunteer access regularly.
Revoke unnecessary permissions and copies after Election Day.

Data security questions

Are public voter files safe to share anywhere? No. State access and permitted-use restrictions may apply, and campaign-created notes can be sensitive even when some registration data is public.

Is multifactor authentication enough? No. It is important, but access roles, secure exports, backups and incident response matter too.

Should every volunteer download the full voter file? No. Provide only the records necessary for a legitimate assignment.

What is the first step after a suspected breach? Notify the designated incident owner promptly, preserve evidence and follow the prepared containment and counsel-review process.

Security guidance sources

Campaign data is only an asset while the campaign can control it and get it back.

Putting your protected lists to work?

Securing your voter and donor lists comes first. After that, we can help you build P2P texting, automated calling, live calling and digital ads programs that use those contacts with care. Reach out about your outreach plan