The FTC Safeguards Rule protects nonpublic personal information held by non-bank financial institutions.
A tax or accounting firm's daily work sits squarely inside that definition: collecting client financial documents, preparing returns, and handling refunds and payments. The rule names tax preparation firms as a covered financial institution.
Tax and accounting firms hold high-value financial data.
Every return contains Social Security numbers and EINs, income, bank account details for refunds and payments, and dependents' information. That is precisely the customer financial information the Safeguards Rule is written to protect.
Account takeover and business email compromise target this data directly, especially during filing season. The rule requires MFA, access controls, and encryption; out-of-band verification of payment instructions is a best practice we add on top.
These are the same controls that defend against the most common attacks on tax practices.
A written program is the baseline, not the ceiling.
The rule requires a written information security program, a Qualified Individual, a documented risk assessment, and an incident response plan. These exist whether or not you have ever had an incident.
Federal law (the FTC Safeguards Rule) requires paid preparers to maintain a written information security plan, as IRS Publications 4557 and 5708 explain. A Safeguards-aligned WISP meets that requirement and the IRS guidance from a single program.
We produce these documents to reflect what is actually running in your environment. The program then survives an FTC inquiry rather than reading as boilerplate.
Vendor oversight is part of compliance.
Tax and accounting practices rely on tax-prep software, e-file providers, document portals, and cloud accounting platforms. The rule requires you to oversee the service providers that handle your customer information.
We inventory those vendors, document the security expectations, and fold vendor oversight into your written program so the requirement is met and evidenced.
IRS e-file rules and EFIN monitoring add duties of their own.
Preparers who e-file client returns do so as Authorized IRS e-file Providers, and IRS Publication 3112 states that providers must safeguard taxpayer information from unauthorized disclosure, use, and destruction.
It names the Gramm-Leach-Bliley Act and the FTC's implementing rules as applicable to providers and points to Publication 4557 for guidance.
It also requires you to register with the IRS every website that collects taxpayer information for federally e-filed returns before that site goes live, and to protect your EFIN from unauthorized use and never share it.
A stolen EFIN or PTIN is a common sign of a compromised practice. Publication 4557 lists more returns filed under your EFIN or PTIN than you actually filed as a warning sign of data theft.
It describes weekly checks through EFIN Status in your e-Services e-file application and, for eligible preparers, View Returns Filed Per PTIN in your online PTIN account.
If client data is stolen, Publication 3112 says to report it immediately to the appropriate IRS Stakeholder Liaison, and Publication 4557 adds the states where you prepare state returns.
Clients should complete IRS Form 14039, the Identity Theft Affidavit, only if they receive an IRS notice or letter or their e-filed return is rejected because of a duplicate Social Security number.
We build those checks and reporting steps into your incident response plan.
Texas and Tennessee breach-notification law sits alongside the rule.
Texas law applies alongside the FTC Safeguards Rule.
Under Texas Business and Commerce Code §521.053, anyone who conducts business in Texas and owns or licenses computerized data that includes sensitive personal information must notify each affected individual of a breach without unreasonable delay and not later than the 60th day after determining that the breach occurred.
If the breach involves at least 250 Texas residents, the Texas Attorney General must also be notified, through the electronic form on the Attorney General's website, as soon as practicable and not later than the 30th day after that determination.
Those deadlines run separately from the FTC notice due within 30 days of discovering a notification event, so your incident response plan should track each one.
Tennessee Code Annotated §47-18-2107 requires notice to affected Tennessee residents no later than 45 days from discovery or notification of a breach, but subsection (i) states that the section does not apply to an information holder subject to Title V of the Gramm-Leach-Bliley Act, and the Safeguards Rule implements sections of that title (16 CFR 314.1).
Confirm with counsel how the Tennessee exclusion applies to your business.
