How to Send W-2s Securely to Clients

The IRS allows electronic delivery of W-2s under specific conditions (IRS Notice 2004-10). Employees must affirmatively consent to electronic delivery, and the document must be accessible through a secure website. The employer must notify the employee when the W-2 is available and provide instructions for accessing it. If an employee doesn't consent, you're still required to provide a paper copy. For third-party delivery to accountants or tax preparers, the W-2 is being shared as part of tax preparation, standard data protection practices (encryption in transit and at rest) apply under IRS Publication 4557.

There's no single mandated encryption standard specifically for W-2s, but IRS Publication 4557 (Safeguarding Taxpayer Data) recommends encryption for all taxpayer data in transit and at rest. AES-256 is the most widely accepted standard: it's what banks, government agencies, and healthcare systems use. For practical purposes, any delivery method that uses AES-128 or AES-256 encryption meets or exceeds what regulators expect. Plain email, password-protected PDFs (which use weaker encryption), and unencrypted cloud links do not meet this bar.

This depends on the tool you're using. With DeadVault specifically, you can extend the deadline once, the extension grants half the original duration (e.g., a 14-day deadline gets a 7-day extension), with a hard cap of 45 days from creation. If the client still doesn't download it, you'd need to create a new drop and re-upload. For other tools like ShareFile or SmartVault, documents persist indefinitely so this isn't an issue, though that persistence is itself a security tradeoff.

For firms delivering dozens or hundreds of W-2s, the workflow depends on your volume. Most secure portals (ShareFile, SmartVault) support batch uploads with per-client folders. With an ephemeral tool like DeadVault, you'd create a drop per client and upload each W-2 individually. This is more work upfront but ensures each client only sees their own document, and each W-2 has its own encryption key and destruction timeline. For very high volume (500+ employees), payroll platforms like ADP, Gusto, or Paychex have built-in electronic W-2 distribution that handles consent and delivery at scale.

It's better than nothing, but it has real limitations. Standard PDF password protection (the kind most tools create) uses weak encryption that can be cracked with freely available tools. Even "strong" PDF encryption (AES-256) only protects the file itself: not the email it's attached to, not the copies on mail servers, and not the version sitting in the client's downloads folder forever. The biggest practical problem is password management: you need a unique, strong password per client, communicated through a separate channel. At scale, most people end up using weak passwords or the same password for everyone, which defeats the purpose.

Yes. Tax preparers and payroll providers have legal obligations to protect taxpayer data under IRS regulations, state data breach notification laws, and in many cases GLBA (Gramm-Leach-Bliley Act). If a W-2 is exposed due to negligent handling, such as emailing it unencrypted. You could face IRS penalties, state regulatory action, and civil liability. The specifics vary by state and the nature of the breach, but the trend is clear: regulators expect reasonable security measures, and "I emailed it" is not considered reasonable for documents containing SSNs.