Yes, if the firm is covered by the FTC Safeguards Rule as accountant or other tax preparation service that is in the business of completing income tax returns, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(viii).
Primary source: 16 CFR 314.2(h)(2)(viii)
Does a tax preparer need a WISP?
Details
prepares income tax returns, holds tax-return source documents, or operates as an IRS e-file provider for consumers. Client information moves through organizers, tax software, portals, email, e-signature tools, e-file records, and retained workpapers. The WISP must match where taxpayer data actually lives, not just the tax software named on the invoice. Many solo and seasonal tax practices maintain information concerning fewer than 5,000 consumers. Section 314.6 removes 314.4(b)(1), (d)(2), (h), and (i), but not the core written program, access-control, MFA, encryption, training, vendor, disposal, or breach-notification duties.
Primary source: 16 CFR 314.2(h)(2)(viii).
FAQ
Does a tax preparer need a WISP?
Yes, if the firm is covered by the FTC Safeguards Rule as accountant or other tax preparation service that is in the business of completing income tax returns, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(viii).
What is the data-flow issue for a tax preparer?
Client information moves through organizers, tax software, portals, email, e-signature tools, e-file records, and retained workpapers. The WISP must match where taxpayer data actually lives, not just the tax software named on the invoice.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.