Yes. The FTC names tax preparation firms among the businesses the Safeguards Rule covers, and there is no minimum size. A solo preparer is covered. What changes with size is how much the rule asks for: the program has to fit your office, and firms holding information on fewer than 5,000 people are excused from four specific requirements.
Why a tax office counts as a “financial institution”
The Safeguards Rule (16 CFR Part 314) comes from the Gramm-Leach-Bliley Act. It applies to businesses that are significantly engaged in financial activities, and it goes by what a business does, not what it calls itself. Preparing tax returns is on the list. The FTC's own guidance names tax preparation firms as an example.
What the rule requires
The rule asks for a written information security program that is appropriate to the size and complexity of your business and the sensitivity of the information you hold. It has nine parts:
| The rule says | In a small tax office, that means |
|---|---|
| Designate a Qualified Individual | One named person is responsible for security. In a small office it is usually the owner. |
| Assess your risks | Know where client information lives and what could go wrong with it. |
| Put safeguards in place | Individual logins, multi-factor authentication, encryption, secure disposal, limits on who can see what. |
| Monitor and test | Check regularly that the safeguards are still working. |
| Train your staff | Security awareness for everyone, including seasonal help. |
| Oversee service providers | Know which vendors touch client data and how they protect it. |
| Keep the program current | Update it when your software, staff or office changes. |
| Have an incident response plan | Written steps for what to do if data is stolen. |
| Report to the board | A yearly written report on the program to whoever governs the firm. |
The under-5,000 exemption
If your firm holds customer information on fewer than 5,000 consumers, section 314.6 of the rule excuses you from four requirements:
- putting the risk assessment in writing;
- continuous monitoring, or the annual penetration test and twice-yearly vulnerability scans that stand in for it;
- a written incident response plan;
- the annual written report to the board.
Two cautions. First, count everyone whose information you hold, including past clients whose records you still keep. Second, the exemption is narrower than it sounds. You still need a named person, safeguards such as multi-factor authentication and encryption, staff training, vendor oversight and a written program. You still have to think through your risks; you just aren't required to document the assessment in a formal report.
Even where the rule doesn't require written breach steps, IRS guidance expects your plan to say what you'd do after a data theft. Writing them down costs a page.
The breach notification rule
Since May 2024, a covered business must notify the FTC when unencrypted information on 500 or more consumers is acquired without authorization. The notice is due as soon as possible and no later than 30 days after discovery. This applies to small firms too. The under-5,000 exemption doesn't remove it.
How this connects to your WISP
The Written Information Security Plan the IRS talks about is the written program the Safeguards Rule requires. Form W-12, Line 11 asks you to confirm you know about it each time you renew your PTIN. See what Line 11 means.
What to do
- Count the people whose information you hold, so you know which side of 5,000 you are on.
- Name your Qualified Individual.
- Write the plan, or check the one you have against the nine parts above. IRS Publication 5708 has a sample.
- Fix the highest-risk gaps first. Email without a second login step is the most common one.
Sources
- FTC Safeguards Rule: What Your Business Needs to Know
- 16 CFR Part 314, Standards for Safeguarding Customer Information, including the exemption in section 314.6
- FTC: Safeguards Rule notification requirement now in effect
This page is general information, not legal advice.