The FTC Safeguards Rule for tax preparers: knowing where client data lives

Ask a tax preparer where client Social Security numbers are stored and you will usually hear about the tax software. Ask again and the list grows: a scanned prior-year return on the desktop, a client's W-2 saved from an email, an organizer spreadsheet in a synced cloud folder, a USB drive from last season. The Safeguards Rule is, at its core, a request to stop guessing about that list.

This article is general education, not legal advice. The rule has specific text and details, so check the current text at ftc.gov and talk with an attorney or advisor about how it applies to your firm.

Who the rule covers

The FTC Safeguards Rule (16 CFR Part 314) applies to non-bank financial institutions. That category includes tax preparers and many accounting firms, even small ones. If you collect client financial information to prepare returns, it is worth assuming the rule is relevant to you and confirming that with a professional.

What the rule asks for, at a high level

In broad terms, the rule expects a firm to have:

• A written information security program.
• A designated qualified individual who is responsible for that program. In a small office this is often the owner or an outside IT provider's contact.
• A risk assessment.
• Safeguards such as access controls, encryption of customer information, multi-factor authentication, and an incident response plan.

Firms holding information on fewer than 5,000 consumers are exempt from a few of the written requirements, such as the written risk assessment and incident response plan. Since May 2024, a breach involving the information of 500 or more consumers must also be reported to the FTC within 30 days. Confirm the details with your advisor.

The rule also asks you to identify and manage the data, personnel, devices, systems and facilities your business relies on. That last item is where many small offices get stuck, because every other safeguard depends on it. You cannot control access to, or encrypt, information you did not know you had.

Why "where does it live" comes first

Picture a four-person tax practice. The written program says client files live in the tax software and on an encrypted file server. That is the plan. But over several seasons, a preparer saved a few returns to a laptop desktop so they could work from home. An assistant exported a client list to a spreadsheet in a synced cloud folder. Someone copied a folder to a USB disk "just in case." None of this is unusual, and none of it appears in the written program.

A risk assessment built on the plan will miss all of it. A risk assessment built on what is actually on the machines has a fighting chance of being accurate. That difference is why an inventory of where client data really sits is a sensible first step, before drafting policies.

A practical way to build the inventory

1. List the devices. Every office computer, laptop, and external disk that could hold client files. Include the home machine someone uses in busy season.
2. List the places data syncs to. Local drives, OneDrive or Google Drive folders, and removable media.
3. Look for the data itself. Search for Social Security numbers, ITINs, bank and card numbers, dates of birth and driver's license numbers in the file types people actually use: Word, Excel, PDF, text, CSV and email messages. (MyVaultMate does not detect US bank account numbers; check those files by hand.)
4. Write down what you found and who can reach it. This becomes an input to your risk assessment and your access-control decisions.
5. Decide, then act. Move, encrypt or delete. Those are decisions for you or your IT provider.
6. Repeat on a schedule. New files appear every week.

Where MyVaultMate fits, and where it does not

MyVaultMate runs a small program on each computer (one file; nothing is installed). It scans the drives, synced OneDrive and Google Drive folders and external disks you choose, looks for patterns such as Social Security numbers and payment card numbers, and reports the file path, the kind of data, a severity, and a short redacted sample such as ***-**-1234 to a dashboard. The files and full values never leave the machine. That gives you a documented, dated list to feed into your risk assessment.

It has limits you should know about. Detection is rule-based, so occasional false alarms happen. It does not yet read RTF and PowerPoint files, Outlook .pst data files, or zip archives. It does not read pictures, videos or recordings, or PDFs that are only scanned images, such as a scanned return or ID: they're listed as “Not scanned” with a risk score of 70, and you choose what to do with them. And it does not fix anything: it moves or deletes nothing on its own, and it does not write your security program, serve as your qualified individual, or replace your IT provider or attorney. It helps you find and document; the safeguards are still yours to put in place.

A first step you can take this week

Pick one workstation and spend twenty minutes looking at the desktop, Downloads and Documents folders for client returns and scanned IDs. Write down what you find and where it should have been. Then ask whoever handles your IT whether that matches the written program. If you want to see what a report looks like, there is a sample at /sample.