The FTC Safeguards Rule for tax preparers, in plain words

Leer en español

The FTC Safeguards Rule is 16 CFR Part 314. It applies to tax preparers. Here is what it says, using the text on eCFR as of October 1, 2026.

Does it apply to a tax office?

Yes. The rule names "an accountant or other tax preparation service that is in the business of completing income tax returns" as an example of a financial institution. Section 314.1(b) also lists "tax preparation firms" by name among the businesses the rule covers. Publication 5708 says the same, regardless of size.

What it requires

You must develop, implement and maintain an information security program that is written in one or more readily accessible parts. Its safeguards must fit your size and complexity, the nature of your activities and the sensitivity of the customer information.

Section 314.4 lists the elements. Among them:

• Designate a qualified individual to oversee the program.
• Base it on a risk assessment (written, for offices with 5,000 or more consumers).
• Limit access to customer information to those who need it for their duties.
• Encrypt customer information in transit over external networks and at rest. If you decide encryption is infeasible, your qualified individual must review and approve effective alternative controls.
• Use multi-factor authentication for anyone accessing an information system, unless your qualified individual approves in writing an equivalent or more secure control.
• Have secure disposal procedures, within two years after the information was last used for the customer, unless a law requires you to keep it longer or another listed exception applies.
• Regularly test or otherwise monitor how well your key safeguards work, and log what authorized users do.
• Train your people, and oversee your service providers, including a contract that requires safeguards.
• Keep a written incident response plan (for offices with 5,000 or more consumers).

The small office exception

Section 314.6 says four parts of 314.4 do not apply to a firm that holds customer information on fewer than five thousand consumers. Those are the written risk assessment requirements in (b)(1), the testing requirements in (d)(2), the written incident response plan in (h), and the written report to a board or senior officer in (i). The rest of 314.4 is not on that list. Publication 5708 still includes breach procedures as a sample attachment.

Telling the FTC about a breach

If a notification event involves the information of at least 500 consumers, you must tell the FTC as soon as possible and no later than 30 days after discovery. The notice is filed electronically on the FTC's website. This part took effect May 13, 2024. It applies to small offices too; 314.6 does not exempt it.

A notification event means unauthorized acquisition of unencrypted customer information. Unauthorized access counts unless you have reliable evidence that nothing was acquired, and data counts as unencrypted if the key was taken.

One piece you can check today

We ran a passive scan of 13,771 tax preparation and accounting websites; 13,481 answered. Read the report. For a template, see the WISP template guide.

Sources

• 16 CFR 314.2, 314.3, 314.4, 314.5, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.