What the TPB says
The TPB recognises that cyber security awareness training can assist you to protect your practice. Its guidance statement gives an example of an agent who uses web-based applications and completes a cyber security awareness training package.
Why it is relevant to your services
- Code item 6: you must keep client information confidential, including data in the cloud or with contractors.
- Under the 2024 determination you need a system of quality management that covers confidentiality and records.
- Tax file number records must be protected under the Privacy (Tax File Number) Rule 2015.
- Records must be kept for at least 5 years, so they must also be kept secure.
Facts and sources for this part
- You must not disclose information about a client's (or a former client's) affairs to a third party unless the client gave permission or you have a legal duty to disclose it. This is Code item 6. [S6] [S10]
- A third party includes entities you outsource work to and cloud storage providers. Outsourcing and cloud storage do not change your duty under Code item 6 to keep client information confidential. [S6]
- Under section 40 of the 2024 Code determination you must keep a system of quality management, covering policies and procedures for areas that include proper record keeping and protecting confidentiality of information. [S25]
- Records that include tax file numbers must follow the Privacy (Tax File Number) Rule 2015. Tax practitioners are TFN recipients. [S8] [S23]
- You must keep records of tax agent and BAS services for at least 5 years after the service has been provided. The TPB expects procedures and controls that protect the security and confidentiality of client records. [S8]
What to write in your log
Write the activity, the hours and one line on relevance, for example: how client data is held, who has access, and the scams that target agents. Self-paced activity needs that relevance line, and reading is capped at 25% over the period.
Facts and sources for this part
- For unstructured activity, such as reading or self-paced computer aided instruction, the TPB says the record should show how the activity is relevant to the services you provide. [S4]
- No more than 25% of CPE over the CPE period should come from technical or professional reading. You must also keep a log of the activities. [S2]
- Records of CPE should be kept for 5 years from the end of the CPE period. [S3]
What a good practice course should cover
Use that list to judge any course, ours included. If a course does not cover what your practice actually faces, it is probably not the one for your log.
- Accounts, multi-factor authentication and who has access.
- Checking a client's identity before you act.
- Fake ATO and myGov contact, and payment redirection.
- What to do after a data breach, and who to tell.
Staff count too
The Code determination requires a quality management system that covers recruitment, training and management of employees. Training your staff in data security is one way to show that system working.
Facts and sources for this part
- Under section 40 of the 2024 Code determination you must keep a system of quality management, covering policies and procedures for areas that include proper record keeping and protecting confidentiality of information. [S25]