You’ll be handling Social Security numbers, income data, bank account information, and dates of birth. The IRS requires you to protect it. Here’s what that means in practice.
The Legal Requirements
The IRS requires all paid preparers to create and implement a written data security plan. This isn’t optional. The FTC Safeguards Rule under the Gramm-Leach-Bliley Act also applies to tax preparers as financial service providers.
Under IRC Section 7216, a tax return preparer who knowingly or recklessly discloses taxpayer information can face criminal penalties, including fines and imprisonment. IRC Section 6713 imposes civil penalties for the same conduct.
What Your Security Plan Should Include
Strong, unique passwords on all devices and software platforms. Multi-factor authentication on every account that offers it. Encrypted storage for all client documents (both on your computer and in the cloud). A secure client portal for document exchange (not email attachments). Regular software updates and antivirus protection. A plan for responding to a data breach, including client notification procedures.
Practical Steps
Use your tax software’s built-in client portal for document exchange. Don’t accept tax documents as email attachments; email is not secure. Encrypt your hard drive. Use a password manager. Enable multi-factor authentication on your IRS e-Services account, your tax software, your email, and your cloud storage.
If you have a home office, secure physical documents in a locked filing cabinet. Shred anything you no longer need in paper form.
Back up your data regularly. Use encrypted cloud storage. If your computer is stolen or crashes, you need to be able to recover client files without starting from zero.
IRS Publication 4557
“Safeguarding Taxpayer Data” is a free IRS publication that walks through these requirements in detail. Read it before your first client sends you a document. It’s available at irs.gov.
Don’t Use Consumer AI Tools with Client Data
Do not upload client tax information to general-purpose AI tools like ChatGPT or similar platforms. These tools may store inputs, and using them with taxpayer data creates potential violations of IRC Section 7216. Use only the AI tools embedded in your professional tax software, which are designed to comply with data security requirements.
For training that covers data security, legal compliance, and practice management, visit musespring.com.