<!– META TITLE: DSGVO & Zuwendungsbestätigung: A Compliance Checklist for German NGOs META DESCRIPTION: A practical checklist covering the two obligations German NGOs can’t skip: donation receipts (Zuwendungsbestätigung, §50 EStDV) and data protection (DSGVO) — plus what changed in DACH payments. URL SLUG: /dsgvo-zuwendungsbestaetigung-compliance-checklist-german-ngos PRIMARY KEYWORD: German NGO compliance SECONDARY KEYWORDS: Zuwendungsbestätigung requirements, DSGVO nonprofit, donation receipt Germany, DACH fundraising compliance, §50 EStDV LANGUAGE NOTE: English by default (DACH B2B audience), German fiscal/legal terms retained and explained. Per standing decision on this thread. –>  

DSGVO & Zuwendungsbestätigung: The Compliance Checklist for German NGOs 

A German NGO carries two compliance obligations that a general fundraising setup often treats as afterthoughts: issuing donation receipts that satisfy German tax law (the Zuwendungsbestätigung), and handling donor data to the standard of the DSGVO (the German implementation of the GDPR). Get either wrong and the cost isn’t abstract. A defective receipt can cost a donor their deduction and expose the organisation to liability; a data-protection lapse can mean complaints, fines, and lost trust. This is a working checklist for both, written for the person who actually has to run them. 

A note before the details: this is general information, not tax or legal advice. German fiscal and data-protection rules have edge cases, and the right move before you rely on any of this is a conversation with your Steuerberater and, where relevant, your Datenschutzbeauftragter. 

The two obligations, and why they collide 

Most compliance guidance treats receipting and data protection as separate departments. In a small NGO, they’re the same three people, and the two rules actively pull against each other in one place: retention. Tax law requires you to keep donation records for years. The DSGVO requires you to delete personal data you no longer need. Knowing which one wins, and when, is half the job. The checklist below covers each obligation on its own, then the point where they meet. 

Zuwendungsbestätigung: the donation-receipt checklist 

The Zuwendungsbestätigung is the official confirmation a donor needs to deduct a gift under §10b EStG. It is governed by §50 EStDV, and the rules are specific. 

The €300 line is the one to internalise. For a single donation up to and including €300, German law accepts a vereinfachter Zuwendungsnachweis — a simplified proof, meaning the donor’s bank record or booking confirmation together with a short note from the organisation stating the tax-privileged purpose and its charitable status. Above €300, that no longer suffices: the organisation must issue a formal Zuwendungsbestätigung nach amtlich vorgeschriebenem Muster, the prescribed official template. (§50 Abs. 4 Nr. 2 EStDV. The threshold was raised from €200 to €300 effective 1 January 2021.) 

Work through the rest of it: 

• Eligibility to issue. Only an organisation recognised as gemeinnützig — with a valid Freistellungsbescheid or a §60a AO determination — may issue receipts at all. The recognition also has a shelf life: a receipt isn’t accepted if the Freistellungsbescheid is more than five years old, or the §60a determination more than three years old, at the time of issue. 
• The prescribed template. The formal receipt must follow the official Muster and carry all mandatory content, including the liability note (Haftungshinweis) and whether the amount is a donation (Spende) or a membership fee (Mitgliedsbeitrag). You don’t get to design your own layout. 
• The register and e-filing. A newer layer: the Zuwendungsempfängerregister under § 60b AO, maintained by the Bundeszentralamt für Steuern, centrally lists eligible recipients. The law also allows electronic transmission of the receipt directly to the donor’s tax office using the donor’s Identifikationsnummer (§50 Abs. 2 EStDV, §93c AO). If you go the digital route, your donor records need to be structured cleanly enough to support it. 
• Liability is real. Issuing an incorrect receipt, or allowing donations to be used for something other than the stated privileged purpose, triggers liability for the lost tax under §10b Abs. 4 EStG. This is why “close enough” isn’t a receipting strategy. 
• Retention. The donor keeps the receipt until roughly a year after their assessment is final; the organisation keeps its records under the general bookkeeping-retention rules (GoBD, and the multi-year retention periods in §147 AO / §257 HGB). 

DSGVO: the donor-data checklist 

The DSGVO applies the moment you hold a name and an amount. The obligations that matter most to a fundraising operation: 

• Lawful basis (Art. 6). Processing a donation has a clear basis (contract, legal obligation, legitimate interest). Marketing emails are different — those generally require consent (Einwilligung), and German competition law (UWG) reinforces that. Don’t assume the donation basis covers the newsletter. 
• Data minimisation (Art. 5). Collect what you need for the gift and the receipt, not everything a form could ask. 
• Records of processing (Art. 30). The Verzeichnis von Verarbeitungstätigkeiten is not optional for an organisation that regularly processes donor data. It’s the document a supervisory authority asks for first. 
• Data-subject rights (Art. 15–20). Access, rectification, deletion, portability — you need a way to fulfil these within the deadlines, not a promise that you would if asked. 
• Processors and hosting (Art. 28). Every external tool that touches donor data — your CRM, your payment provider, your email sender — needs an Auftragsverarbeitungsvertrag (AVV/DPA), and where the data physically sits (EU hosting) is a question worth asking before you sign, not after. 
• A data protection officer (Datenschutzbeauftragter) is mandatory under the German BDSG once at least 20 people are regularly engaged in processing personal data, and in some other cases regardless of headcount. 
• Special-category data (Art. 9). This one is easy to overlook and important for faith-based and beneficiary-heavy organisations. Information that reveals religious affiliation is special-category data, and so is anything relating to a sponsored child — the beneficiary-data problem generic CRMs create sits right on top of this. Both call for a stricter basis and tighter access than ordinary donor data. 

Where the two rules meet: retention vs. deletion 

Here’s the collision, resolved. When a donor asks you to delete their data, you do not delete the tax-relevant records you’re legally required to retain. The DSGVO’s own deletion right (Art. 17) carves out data kept to meet a legal obligation. So the donation record and receipt stay for the statutory retention period; the marketing consent, the engagement history, the things you keep only because they’re useful, are what you delete. The practical requirement is that your system can separate the two, retaining the fiscal record while honouring the deletion request for everything else. A tool that can only delete a donor wholesale, or can’t delete them at all, fails one rule or the other. For DACH organisations weighing which system actually handles this split — and, for Islamic relief work, the added program structure on top of it — we compare two options: DonorFit vs FundraisingBox

What actually changed in DACH payments 

A quick, current note, because a lot of “accepted payment methods” lists are now out of date. Two familiar German bank-transfer methods were retired at the end of 2024: Sofort was folded into Klarna’s “Pay Now,” and Giropay was shut down without a successor when Paydirekt GmbH was wound down (no transactions processed since 1 January 2025). If your donation forms or your donor comms still name either as an option, that’s a correction to make now. 

What your DACH donors actually use today: SEPA Lastschrift remains the backbone for recurring gifts across the eurozone and is the method that matters most for a sustained donor base. Alongside it sit PayPal, credit cards, and the mobile wallets (Apple Pay, Google Pay). Wero, the European Payments Initiative’s account-to-account service, launched in 2024 and is expanding from P2P into e-commerce, so it’s the one to watch rather than the one to depend on yet. And for the Swiss part of DACH, TWINT is the dominant domestic method, which matters if you fundraise across the DE-AT-CH border. 

Quick-reference checklist 

FAQ 

When is a Zuwendungsbestätigung required in Germany? For a single donation above €300, you must issue a formal receipt on the prescribed official template. At or below €300, a simplified proof — the donor’s bank record plus a short note from the organisation — is enough under §50 Abs. 4 Nr. 2 EStDV. 

Does the DSGVO force us to delete a donor’s records if they ask? Not the tax-relevant ones. The right to erasure (Art. 17) doesn’t override a legal retention obligation, so donation records and receipts stay for the statutory period. You delete what you’re not required to keep, such as marketing consents and engagement history. 

Is donor religious affiliation really special-category data? Yes. Data revealing religious belief falls under Art. 9, which is directly relevant to faith-based fundraising and to any Zakat-designated giving. It needs a stricter lawful basis and tighter access than ordinary donor data. 

Can we still offer Sofort or Giropay on our donation form? No. Both were discontinued at the end of 2024. SEPA direct debit remains the recurring backbone; PayPal, cards, and mobile wallets cover the rest, with Wero emerging and TWINT relevant for Swiss donors. 

Do we need a Datenschutzbeauftragter? Under the German BDSG, a data protection officer is mandatory once at least 20 people are regularly involved in processing personal data, and in certain other cases regardless of size. Confirm your specific situation with a qualified adviser.