One of the most common misconceptions among solo practitioners and small accounting firms is the belief that having fewer than 5,000 clients exempts a practice from the Federal Trade Commission (FTC) Safeguards Rule. A quick look at the regulation itself shows why that assumption leaves firms exposed during PTIN renewal, cyber insurance underwriting, or after a data incident.
Primary Statutory & Regulatory Sources
• GLBA Title V Statute: 15 U.S.C. §§ 6801–6809
• FTC Safeguards Rule: 16 CFR Part 314
• Small-Volume Exception: 16 CFR § 314.6
• IRS Guidance: IRS Publication 4557 & IRS Publication 5708
What 16 CFR § 314.6 Actually Says
The entire text of 16 CFR § 314.6 is a single sentence:
"§ 314.6 Exceptions. Sections 314.4(b)(1), 314.4(d)(2), 314.4(h), and 314.4(i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."
When the FTC updated the Safeguards Rule in December 2021 (86 FR 70272), small-business commenters noted that solo practitioners do not have a corporate board of directors to receive formal annual reports and could face high costs hiring outside penetration testers. Rather than exempting small practices from data security, the FTC carved out only those four specific sub-clauses while keeping the rest of 16 CFR Part 314 binding on every covered tax preparer and accounting firm.
Line-by-Line Comparison: Required vs. Carved Out Under § 314.6
| CFR Clause | Safeguards Requirement | 5,000+ Consumers | Under 5,000 (§ 314.6) |
|---|---|---|---|
| 16 CFR § 314.3(a) | Written Information Security Plan (WISP) | Required | Required |
| 16 CFR § 314.4(a) | Designate a Qualified Individual | Required | Required |
| 16 CFR § 314.4(b) | Base program on a risk assessment (§ 314.4(b)(1) written criteria carved out under § 314.6, though expected in IRS Pub 5708) | Required | § 314.4(b) Required (§ 314.4(b)(1) carved out) |
| 16 CFR § 314.4(c)(1)–(2) | Access controls & data/system inventory | Required | Required |
| 16 CFR § 314.4(c)(3) | Encryption of customer data at rest and in transit | Required | Required |
| 16 CFR § 314.4(c)(5) | Multi-Factor Authentication (MFA) for anyone accessing customer data | Required | Required |
| 16 CFR § 314.4(c)(6) | Secure disposal of customer data within 2 years (unless required for business/legal reasons) | Required | Required |
| 16 CFR § 314.4(d)(1)–(2) | Regularly test/monitor key controls (§ 314.4(d)(2) continuous monitoring or annual pen test + biannual scans) | Required | § 314.4(d)(1) Required (§ 314.4(d)(2) carved out) |
| 16 CFR § 314.4(e) | Security awareness training for staff | Required | Required |
| 16 CFR § 314.4(f) | Service provider oversight & contract clauses | Required | Required |
| 16 CFR § 314.4(h) & (i) | FTC formal written incident response plan (§ 314.4(h)) & annual board report (§ 314.4(i)) | Required | Carved out by FTC § 314.6 (IRS Pub 5708 still includes an incident response plan) |
| 16 CFR § 314.4(j) | Notify the FTC within 30 days of a breach affecting 500+ consumers | Required | Required |
Why "5,000 Consumers" Is Reached Much Faster Than "5,000 Clients"
Notice that 16 CFR § 314.6 counts consumers whose nonpublic personal information you maintain—not active annual invoices. In a tax and accounting practice, individual consumer records accumulate across three sources:
- Household Members on Form 1040: A joint return with two dependents contains names, dates of birth, and Social Security Numbers for four individuals.
- Business Clients' Employees & Contractors: If you prepare payroll, W-2s, or 1099-NECs for business clients, or receive K-1 schedules with partner SSNs, each individual whose SSN is stored in your files is a consumer record.
- Prior-Year Archives & Backups: Unless your firm actively disposes of older client records once IRS retention periods (such as IRC § 6107(b)) expire, seven or more years of prior returns, email attachments, and tax-software backups remain on your systems.
As a result, a practice billing 350 to 500 active tax clients each season can easily hold nonpublic personal information on more than 5,000 individuals across its active software and historical backups.
Practical Steps for Small & Mid-Sized Tax Practices
- Document Your WISP Before Renewing Your PTIN: Even if your firm is well under 5,000 consumers, a written security plan (16 CFR § 314.3(a)), a named Qualified Individual (§ 314.4(a)), MFA (§ 314.4(c)(5)), encryption (§ 314.4(c)(3)), and staff security training (§ 314.4(e)) are mandatory.
- Include an Incident Response Plan Anyway: While § 314.6 carves out § 314.4(h), both IRS Publication 4557 and the IRS sample WISP in Publication 5708 expect every tax practice to maintain a written incident response plan covering IRS Stakeholder Liaison and state breach notifications.
- Follow a Written Data Retention & Disposal Schedule: Under 16 CFR § 314.4(c)(6), dispose of nonpublic customer information within two years after the last time it is used, unless you are required to keep it longer for tax, legal, or regulatory purposes.
Informational Notice: This article is provided by CPA Security for general educational purposes only and does not constitute legal, tax, or compliance advice. Consult qualified legal counsel regarding how federal and state regulations apply to your practice.