The FTC Safeguards Rule for Tax Preparers: A Plain-English Checklist

    Last verified: November 1, 2026

    If you prepare returns for a fee, you handle some of the most sensitive data a person owns: Social Security numbers, bank accounts, income. Federal rules say you must protect it with a written plan, and the IRS expects tax professionals to have one. Here is what that means without the legal jargon.

    Why it applies to you

    The FTC Safeguards Rule, issued under the Gramm-Leach-Bliley Act, applies to "financial institutions," and the IRS treats professional tax preparers as covered. The legal duty comes from that rule; IRS Publication 4557 (Safeguarding Taxpayer Data) explains how tax professionals can meet it, and IRS Publication 5708 provides a Written Information Security Plan (WISP) template you can fill in.

    What the rule asks for

    In plain terms, the FTC's own summary lists these elements:

    • A Qualified Individual who runs and oversees your security program. For a solo preparer, that is you.
    • A written risk assessment of how client data could be exposed, reviewed periodically.
    • Encryption of client information on your systems and while it travels. If that is not feasible, an alternative control approved by your Qualified Individual.
    • Multi-factor authentication (at least two of: something you know, something you have, something you are) for anyone accessing your systems.
    • A written incident response plan: who does what, who is told, how you recover and what you document.
    • Testing: continuous monitoring, or an annual penetration test plus vulnerability scans every six months, and testing after material changes.
    • Training for you and any staff, with regular refreshers.
    • Oversight of service providers that touch client data: pick capable ones, set security expectations in the contract and review them periodically.
    • A written report at least once a year from the Qualified Individual to the owner or board.

    The rule also requires notifying the FTC as soon as possible, and no later than 30 days after discovery, of a breach in which unencrypted information of at least 500 consumers was acquired without authorization. Smaller firms (the rule uses fewer than 5,000 consumers) are exempt from some of the written-documentation items, but the core controls still apply. Read the rule text or ask your advisor which parts apply to you.

    A checklist to start with

    • Name your Qualified Individual and write the name in your plan.
    • List every place client data lives: your tax software, email, laptops, phones, cloud storage, paper files, your client portal.
    • Turn on multi-factor login everywhere it is offered, starting with email and your tax software.
    • Stop collecting SSNs and tax documents as plain email attachments. Use an encrypted portal instead.
    • Encrypt laptops and phones, and keep them updated.
    • Write down what you will do if a device is lost or an account is compromised.
    • Fill in the IRS WISP template (Publication 5708) and review it every year.
    • Check the security terms of each vendor you use for client data.

    Where a client portal helps

    Moving document collection and signatures out of email and into an encrypted portal covers several items above at once. VYAX encrypts sensitive fields, shows only the last four digits of an SSN day to day and turns two-factor login on by default for new preparer accounts; the posts how VYAX protects client SSNs and two-factor authentication for preparers explain how. A portal helps with some controls, but it does not replace your own written plan, risk assessment and training.

    This article is general information, not tax or legal advice. Rules and IRS guidance change; check the FTC rule and current IRS publications.