What does the FTC Safeguards Rule require a tax preparer to keep?

A written information security program under 16 CFR Part 314, suited to the firm's size, activities, and the sensitivity of the customer information, and including the elements in section 314.4.

Does the 5,000-consumer line remove the written plan?

No. Section 314.6 sets aside four items in section 314.4 for a firm that maintains customer information on fewer than 5,000 consumers. The written program in section 314.3 still applies, and the FTC notice in section 314.4(j) is not one of the four.

When did the FTC notice requirement take effect?

Section 314.5 states that section 314.4(j) is effective as of May 13, 2024. A notification event involving the unencrypted customer information of at least 500 consumers is reported to the FTC no later than 30 days after discovery.

What the FTC Safeguards Rule Asks Every Tax Preparer to Do: A Plain-English List

Published November 3, 2026.

What does the FTC Safeguards Rule require all tax preparers to do?

It requires a tax preparation firm under the Federal Trade Commission's jurisdiction to develop, implement, and maintain a written information security program that protects customer information. 16 CFR 314.3(a) says that program is written in readily accessible parts and fitted to the firm's size, complexity, activities, and the sensitivity of the customer information. It includes the elements in section 314.4. Section 314.3(b) sets three objectives: confidentiality, protection against anticipated threats, and protection against unauthorized access that could substantially harm or inconvenience a customer.

The rule is 16 CFR Part 314. The FTC's guide is FTC Safeguards Rule: What Your Business Needs to Know. Amendments published December 9, 2021 (86 FR 70272) took effect January 10, 2022. The Qualified Individual, the written risk assessment, the section 314.4(c) safeguards, the penetration-test schedule, training, periodic service-provider assessments, the written incident plan, and the annual report were delayed to June 9, 2023 (87 FR 71509). The FTC notice in section 314.4(j) took effect May 13, 2024 (88 FR 77499). Section 314.5 states that date. This describes those texts. It is not legal advice.

Why does the rule reach tax preparers?

Section 314.1(b) lists tax preparation firms as financial institutions under FTC jurisdiction. Section 314.2(h)(2)(viii) includes an accountant or tax preparation service in the business of completing income tax returns, because that work is a financial activity under 12 CFR 225.28(b)(6)(vi). A person who becomes your client for tax preparation has a customer relationship, section 314.2(e)(2)(i)(H). Customer information, section 314.2(d), is any paper or electronic record of nonpublic personal information about a customer, handled by you or for you.

Publication 5708 (Rev. 8-2024) says these professionals are covered regardless of size. Is a WISP required for tax preparers? covers the Form W-12 acknowledgment. The form does not ask you to attach the plan. Fewer than 5,000 consumers does not remove the written program. Section 314.6 sets aside only four items, named below.

What must the written plan include?

Section 314.4 is the list. Under 5,000 consumers it still includes:

A Qualified Individual. Paragraph (a).
A risk assessment of reasonably foreseeable internal and external risks, repeated periodically. Paragraphs (b) and (b)(2). The written assessment in (b)(1), with criteria for rating risks, for judging confidentiality, integrity, and availability, and for mitigating or accepting each risk, is one item section 314.6 sets aside.
Eight safeguards in paragraph (c). Review access controls and limit each authorized user to what that person needs. Record the data, people, devices, systems, and facilities you rely on. Encrypt customer information in transit over external networks and at rest, or get the Qualified Individual's approval for an alternative if encryption is infeasible. Use secure practices for in-house and outside applications that handle customer information. Require multi-factor authentication, at least two of something you know, have, or are, for anyone accessing an information system, unless the Qualified Individual approves an equivalent in writing. Dispose of customer information no later than two years after last use for that service, unless you still need it, law or regulation requires you to keep it, or targeted disposal is not reasonably feasible, and review retention periodically. Manage changes. Log authorized users so you can detect unauthorized access or tampering.
Testing or monitoring of key controls, including detection of attacks. Paragraph (d)(1). Paragraph (d)(2), continuous monitoring or else annual penetration testing and vulnerability assessments at least every six months, is the second item section 314.6 sets aside.
Training, and security staff who stay current. Paragraph (e).
Service providers you select, bind by contract, and assess periodically. Paragraph (f). A service provider handles customer information for you.
An update when testing, a material change, or a new assessment gives a reason. Paragraph (g).
Notice to the FTC of a notification event involving at least 500 consumers. Paragraph (j). Section 314.6 does not remove it.

A notification event, section 314.2(m), is unauthorized acquisition of unencrypted customer information. If an unauthorized person accessed the encryption key, the information counts as unencrypted. Unauthorized access counts as acquisition unless you have reliable evidence it did not happen and could not reasonably have happened.

At 5,000 consumers or more, those four items come back: the written (b)(1) assessment, the (d)(2) monitoring or test schedule, the incident plan in (h), and a written report from the Qualified Individual at least annually under (i), to the board or a senior officer. The (h) plan covers goals, the response, roles, communications, fixes, records, and a revision after an event.

Who is the Qualified Individual?

The Qualified Individual is the person who oversees, implements, and enforces the program. Section 314.4(a) uses that title. The person may work for the firm, an affiliate, or a service provider. If the person is outside the firm, you still own compliance, you name a senior member of your own personnel to oversee them, and you require their program to protect your firm. The paragraph sets no staff minimum. In the PlainWISP questions, that person can be you, an employee, an affiliate, or an outside provider. The role approves an encryption alternative, and any written substitute for multi-factor authentication.

What ongoing tasks does it list?

Repeat the work, including under 5,000 consumers: reassess risk, section 314.4(b)(2); review access, (c)(1); review retention, (c)(6); test or monitor, (d)(1); refresh training, (e); reassess service providers, (f)(3); and update the program when the results or the business change, (g). At 5,000 or more, add the (d)(2) schedule and the annual report in (i).

The 500-consumer notice is not part of that size line. Discover a notification event involving at least 500 consumers, and section 314.4(j) requires notice to the FTC as soon as possible and within 30 days, on the FTC's form. Include who you are, the information involved, the dates if known, how many consumers are affected or might be, what happened, and any written request from law enforcement to delay public notice. You have discovered it when you, an employee, an officer, or an agent knows, other than the person who committed the breach. Publication 5708 says 500 or more people. The rule's trigger is section 314.2(m).

Where do Pub 4557 and Pub 5708 fit?

They explain the duty for a tax office. Part 314 does not name them, and it does not approve a template.

Publication 4557 (Rev. 6-2024) says preparers must create and enact security plans, points to Publication 5708 for the written plan, and says failure to do so may result in an FTC investigation. Its checklist is a summary. It says multi-factor authentication applies regardless of size, which matches section 314.4(c)(5): that paragraph is outside the section 314.6 exception.

Publication 5708 (Rev. 8-2024) is the Security Summit sample for smaller practices. It says the sample is not a substitute for a plan based on your firm, that a sole practitioner can use a shorter plan, and that you should read Publication 4557, Publication 1345, and the FTC Data Breach Response Guide first. The header still reads "[Your Firm Name Here]."

Home drafts a plan in the browser from questions about your office. No account is required to draft or preview. Your answers stay on your device. We never receive or store them. The export follows Publication 5708. You're responsible for implementing your plan. PlainWISP does not file it or set up the controls. Solo is $149 when you are the only person who handles client files. Firm is $299 for one physical office with up to 10 staff. Multi-office is $599 for more than one physical office, or more than 10 staff. One-time payment. Includes 12 months of updates. No subscription, no automatic charges. See Plans and pricing. PlainWISP is a document template tool. It is not legal advice, and it is not affiliated with or endorsed by the IRS or the FTC. A written plan does not by itself meet a legal requirement. Ask a qualified attorney about your own obligations.