Encryption requirements for tax preparers: what the rule says

The short answer

There is an encryption requirement, and it is in the FTC Safeguards Rule, 16 CFR Part 314. Section 314.4(c)(3) says to protect customer information by encryption "both in transit over external networks and at rest." If you decide encryption is infeasible for one of those, the rule lets you use effective alternative compensating controls instead, if your Qualified Individual has reviewed and approved them. Section 314.2 lists "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution, so the rule covers tax preparers. IRS Publications 4557 and 5708 give advice and sample policy text, not rules. Publication 1345 adds one "must" on encryption, and it applies only to Online Providers.

What 16 CFR 314.4(c)(3) says

Section 314.4(c) tells you to design and implement safeguards to control the risks you identify. Paragraph (c)(3) reads:

"Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest. To the extent you determine that encryption of customer information, either in transit over external networks or at rest, is infeasible, you may instead secure such customer information using effective alternative compensating controls reviewed and approved by your Qualified Individual;"

Three things to take from it:

• It covers "all customer information held or transmitted by you." In plain words, held means stored and transmitted means sent.
• It names two places: "in transit over external networks" and "at rest."
• The alternative is a decision you make for a specific case, "in transit over external networks or at rest", when you determine encryption is infeasible. The controls must be "effective", and they must be "reviewed and approved by your Qualified Individual." Who the Qualified Individual is has its own guide.

Section 314.2(f) defines the word: "Encryption means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material."

Does the small-office exemption change it?

No. Section 314.6 says:

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."

Paragraph (c)(3) is not on that list. The threshold counts consumers, not staff or offices. The Safeguards Rule guide covers the four parts that do drop out.

What IRS Publication 4557 says

Publication 4557 (Rev. 6-2024) is the IRS guide to safeguarding taxpayer data. Here is what it says about encryption:

• In its list of internal controls: "Encrypt all sensitive files/emails, especially those with the taxpayer's personally identifiable information, and use strong password protections."
• On security software: "Drive Encryption – protects information from being read on computers, tablets, laptops and smart phones if they are lost, stolen or improperly discarded."
• On client data stored on your systems: "Use drive encryption to lock files and all devices; encrypted files require a password to open."
• On backups: "Backup encrypted copies of client data to external hard drives (USBs, CDs, DVDs) or use cloud storage; keep external drives in a secure location; encrypt data before uploading to the cloud."
• On sharing files with clients: "Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email."

Its FTC checklist, which it introduces with "firms should consider implementing the following practices", includes "If you must transmit sensitive data by email over the Internet, be sure to encrypt the data." Next to its SSL item it adds: "IRS Suggestion: Transport Layer Security 1.1 or 1.2 is newer and more secure." Publication 1345, below, sets "TLS 1.2 or later" for Online Providers.

What IRS Publication 5708 says

Publication 5708 (Rev. 8-2024) is the IRS sample WISP. Its policies are sample text to adapt, not rules. Examples:

• "Any computer file stored on the company network containing PII will be password-protected and/or encrypted."
• "It is Firm policy that PII will not be in any unprotected format, such as e-mailed in plain text, rich text, html, or other e-mail formats unless encryption or password protection is present."
• "MS BitLocker or similar encryption will be used on interface drives, such as a USB drive, for files containing PII."
• "Remote access using tools that encrypt both the traffic and the authentication requests (ID and Password) used will be the standard."

Notice that the sample accepts "password-protected" as an alternative in two places. The rule text in (c)(3) does not mention password protection. If your plan uses the sample's wording, check it against the rule.

Pub 1345: standards for Online Providers only

Publication 1345 (Rev. 12-2025) has security standards for IRS e-file. It says the IRS mandated six standards, and that "the first five standards continue to apply to Online Providers." One objective is "Setting minimum encryption standards for transmission of taxpayer information over the internet" and authentication of the website owner's identity. The standard itself says Online Providers of individual income tax returns "must have a valid and current Extended Validation Secure Socket Layer (SSL) certificate using TLS 1.2 or later and minimum 2048-bit RSA/128-bit AES."

That applies to Online Providers. Publication 1345 sends you to Publication 3112 for the definition. Publication 3112 says an Online Provider "allows taxpayers to self-prepare returns" and that an ERO "is not an Online Provider." If you are not an Online Provider, this standard is not a duty of yours. The EFIN guide covers e-file Provider status.

In a small office: in transit and at rest

This section is explanation from us, not a quote from the sources. Each point ties back to the wording above.

• In transit over external networks means data leaving your office network. Email attachments to a client are one example. Publication 4557 says to send "password-protected and encrypted documents" or use SFTP.
• At rest means data sitting on a device or a disk. Examples are laptops, desktops, phones and USB drives. Publication 4557 names drive encryption, and Publication 5708's sample names BitLocker for USB drives.
• Backups hold the same client data as the originals. Publication 4557 says to encrypt backed up files and to encrypt data before uploading to the cloud.

If you determine that encrypting one of these is infeasible, the rule lets you use "effective alternative compensating controls reviewed and approved by your Qualified Individual" instead.

Put it in your plan

The free WISP generator makes a draft. The MFA guide covers (c)(5), in the same section of the rule.

Sources

• 16 CFR 314.2, 314.4, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf
• IRS Publication 1345 (Rev. 12-2025): irs.gov/pub/irs-pdf/p1345.pdf

This is general information, not legal advice.