Do tax preparers have to tell the FTC about a data breach?

Leer en español

The short answer

Sometimes. Section 314.4(j) of the FTC Safeguards Rule says to notify the FTC about notification events. If a notification event involves the information of at least 500 consumers, you must notify the FTC as soon as possible, and no later than 30 days after discovery. The rule defines a notification event as acquisition of unencrypted customer information without the authorization of the individual it pertains to. Telling the IRS is a separate step, covered in tax preparer data theft: what to do and who to tell.

What the rule says

Paragraph (j)(1) reads:

"Upon discovery of a notification event as described in paragraph (j)(2) of this section, if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event."

The notice "shall be made electronically on a form to be located on the FTC's website, https://www.ftc.gov."

The 500 counts consumers whose information the event involves. It does not measure the size of your office. "Consumer" is a defined term in section 314.2.

What counts as a notification event

Section 314.2 says: "Notification event means acquisition of unencrypted customer information without the authorization of the individual to which the information pertains."

The definition goes on: "Unauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information."

The rule uses a separate term, "security event", for "an event resulting in unauthorized access to, or disruption or misuse of, an information system, information stored on such information system, or customer information held in physical form." Paragraph (j) is written about notification events.

Unencrypted and encrypted

The definition covers unencrypted customer information. It adds: "Customer information is considered unencrypted for this purpose if the encryption key was accessed by an unauthorized person."

The rule defines encryption as "the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material."

Paragraph (c)(3) separately says to "Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest." Where you determine encryption is infeasible, it says you "may instead secure such customer information using effective alternative compensating controls reviewed and approved by your Qualified Individual". The notification event definition above is written in terms of unencrypted customer information. Whether a particular event is a notification event depends on the facts, and this guide cannot decide that for you.

What the notice contains

The notice shall include:

• "The name and contact information of the reporting financial institution;"
• "A description of the types of information that were involved in the notification event;"
• "If the information is possible to determine, the date or date range of the notification event;"
• "The number of consumers affected or potentially affected by the notification event;"
• "A general description of the notification event; and"
• "Whether any law enforcement official has provided you with a written determination that notifying the public of the breach would impede a criminal investigation or cause damage to national security, and a means for the Federal Trade Commission to contact the law enforcement official."

When the clock starts

Paragraph (j)(2) says: "A notification event shall be treated as discovered as of the first day on which such event is known to you." It adds that "You shall be deemed to have knowledge of a notification event if such event is known to any person, other than the person committing the breach, who is your employee, officer, or other agent."

Section 314.5 says: "Section 314.4(j) is effective as of May 13, 2024."

Does the small-office exemption change it?

Section 314.6 lists four paragraphs that do not apply to institutions that maintain customer information concerning fewer than five thousand consumers: 314.4(b)(1), (d)(2), (h) and (i). Paragraph (j) is not among them.

How it differs from telling the IRS

Publication 4557 says: "Tax practitioners should report data losses or thefts immediately to the IRS". Its steps include reporting client data theft to your local stakeholder liaison. The FTC notice is a different channel with its own trigger, the 500-consumer test and the 30-day limit.

Publication 5708 puts the FTC on its sample notification list, next to the IRS Stakeholder Liaison and others. Its sample reads: "Report security events affecting 500 or more people within 30 days of discovery". The rule's own trigger is the notification event defined above, so read the rule text when you decide. The IRS side, state notices and the rest of the list are in the data theft guide.

The free WISP generator makes a draft plan. It does not decide whether you owe a notice.

Sources

• 16 CFR 314.2, 314.4, 314.5, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf
• FTC: ftc.gov (the rule says the form is on the FTC website)

This is general information, not legal advice.