Client information: your confidentiality and record duties.

What does the confidentiality duty say?

You must not disclose information about a client's (or a former client's) affairs to a third party unless the client gave permission or you have a legal duty to disclose it. This is Code item 6.

If you break it, the TPB may find a breach of the Code and impose sanctions.

Who is a third party?

Anyone other than you and your client. The TPB gives examples: entities you outsource work to, and providers of offsite data storage including cloud storage.

The TPB says outsourcing and cloud arrangements do not change the duty. You must ensure confidentiality and tell your clients about such arrangements.

How do you get permission?

Before you disclose, tell the client what will be disclosed, to whom and where, and get their permission. A signed letter of engagement can do this.

A practice that sends client files to a cloud processor in another country, or to a contractor, should say so in plain words in the engagement letter, not in small print.

Accidental disclosure is still disclosure

You need arrangements to prevent inadvertent disclosure. The TPB's examples include disposing of IT equipment that holds client data, and the cleaners and IT consultants who work in your office.

Think of a screen left on a client's file, an old laptop sold with its drive intact, or a printout in a recycling bin. The duty applies to each.

Quality management and records under the 2024 rules

The Code determination of 2024 requires a system of quality management. Its policies and procedures cover areas that include proper keeping of records and protecting confidentiality of information.

You must keep records of services for at least 5 years after the service has been provided, and the TPB expects procedures and controls that protect their security and confidentiality. The duty applies from 1 July 2025 for practitioners with 100 or less employees, and from 1 January 2025 for others.

Tax file numbers need extra care

Tax practitioners are TFN recipients. Records that include TFNs must follow the Privacy (Tax File Number) Rule 2015.

In practice: limit access to the people who need it, destroy or de-identify TFN information you no longer need, and make sure every staff member knows to protect it. Email is not considered a secure form of communication, so do not collect TFNs or identity documents by plain email.

Only authorised TFN recipients may ask for a TFN at all, so a request for a client's TFN from anyone who is not one is a warning sign in itself.

Scenario: a new overseas bookkeeping helper

Your practice wants a contractor overseas to do data entry on client files. Before any file moves, you list what they will see, where it is stored and what they may do with it.

You add the arrangement to the letter of engagement and get each client's signed permission. You keep the signed letters with the client records.

Scenario: the retired partner's laptop

A partner retires and the old laptop is offered to a staff member's child. Its drive still holds client returns and tax file numbers.

The right step was to wipe or destroy the drive and record that it was done before the laptop left the office. Disposal is part of keeping information confidential.

Checklist: what your written confidentiality procedure should cover

Who may open which records. How client permission is recorded. How third parties are listed and told to clients. How paper and devices are disposed of. How tax file numbers are restricted, kept and destroyed.

One page is enough if it names who is responsible and when it is reviewed.