Congress set the policy that each financial institution “has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information” (15 U.S.C. 6801(a)). Two rules turn that into concrete duties for firms like yours.
Is your firm covered?
The FTC’s guide to the Safeguards Rule lists “tax preparation firms” among the financial institutions it covers (FTC, FTC Safeguards Rule: What Your Business Needs to Know). Whether every service your firm offers counts as a financial activity is a question for your attorney; if you prepare returns, plan for GLBA to apply.
Part 1: Protect client information (the FTC Safeguards Rule)
The Safeguards Rule (16 CFR Part 314) requires a written information security program. Its core elements (16 CFR 314.4) include a named Qualified Individual, a written risk assessment, safeguards such as multi-factor authentication and encryption, staff training, oversight of service providers, a written incident response plan, and notice to the FTC of certain breaches. Our guides cover the parts firms ask about most:
- The Qualified Individual
- The 5,000-consumer exception and what it does not exempt
- Using an MSP: what the rule still requires of your firm
- IRS Publication 4557 and your WISP
Part 2: Tell clients how you share information (Regulation P)
For privacy notices, tax and accounting firms follow the Consumer Financial Protection Bureau’s Regulation P (12 CFR Part 1016). The FTC’s own privacy rule now applies only to certain motor vehicle dealers (16 CFR 313.1), so it is the CFPB’s rule that matters for your firm.
Regulation P requires:
- An initial notice: “a clear and conspicuous notice that accurately reflects your privacy policies and practices” to an individual client “not later than when you establish a customer relationship” (12 CFR 1016.4).
- An annual notice to clients “not less than annually during the continuation of the customer relationship” (12 CFR 1016.5), unless an exception applies. The statute exempts a firm from the annual notice if it shares client information only in the ways the law allows without an opt-out and hasn’t changed its practices since its last notice (15 U.S.C. 6803(f)).
- An opt-out before sharing client information with unaffiliated third parties outside the law’s exceptions: the client must be told and given “the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed” (15 U.S.C. 6802(b)).
These privacy rules apply to individuals who use your services “primarily for personal, family, or household purposes”, not to business clients (12 CFR 1016.1(b)).
What about the IRS?
The IRS points tax professionals to the same obligation: IRS Publication 4557 explains how to safeguard taxpayer data, Publication 5708 provides a sample written information security plan, and Form W-12, the PTIN application and renewal, asks you to acknowledge the requirement.
A short GLBA checklist for your firm
| Do you have... | Rule |
|---|---|
| A written information security program (WISP) built on a written risk assessment? | 16 CFR 314.4(b) |
| A named Qualified Individual, and a senior person overseeing them if they work for a provider? | 16 CFR 314.4(a) |
| Multi-factor authentication for anyone accessing systems with client information? | 16 CFR 314.4(c)(5) |
| Contracts that require your service providers to protect client data? | 16 CFR 314.4(f) |
| A written incident response plan, and a way to notify the FTC within 30 days of a breach involving 500 or more consumers? | 16 CFR 314.4(h), (j) |
| A privacy notice that matches what you actually do, given when a client relationship starts? | 12 CFR 1016.4 |
| Either an annual privacy notice, or confirmation that the annual-notice exception applies to you? | 12 CFR 1016.5; 15 U.S.C. 6803(f) |
How CPA Security helps
CPA Security builds your WISP around how your office works, keeps dated staff training records, and helps you document the Safeguards Rule elements above. Your privacy notice content is a legal document; have your attorney review it.
General information only, not legal or tax advice. Whether and how GLBA applies to your firm is a question for your attorney.