FREE RESOURCE
Client Data Handling Checklist for Accounting Firms
Use this checklist to help employees follow approved procedures when receiving, accessing, storing, sharing, printing, retaining, or disposing of sensitive client information.
Checklist items: 30 · Estimated time: 4–6 minutes · Cost: Free · Email required: No
Built for accounting, tax, bookkeeping, and payroll teams.
Client Data Should Move Through Approved Business Processes
Accounting and tax employees handle sensitive information throughout the workday. It may move between client portals, tax software, accounting systems, payroll platforms, shared storage, email, printed documents, remote-work devices, and internal staff.
Problems often begin when information leaves the normal process—for example, an unnecessary download, a personal account, an unapproved sharing service, an exposed printout, outdated access, or a message sent to the wrong recipient.
Employees do not need to design the firm’s security architecture. They need to know where client data belongs, who should access it, how it may be shared, and what to do when something goes wrong.
Client Data Handling Checklist for Accounting Firms
Secure Team · secureteamtraining.com/resources/client-data-handling-checklist/
Is This Client Information Being Handled Through an Approved Business Process?
Use the checklist before receiving, accessing, storing, sharing, printing, retaining, or disposing of sensitive client or taxpayer information.
1. Receive & Collect Client Information
Collecting less unnecessary sensitive information can reduce the amount of information the firm must protect.
2. Access Client Information
Access should reflect legitimate business need and employee responsibilities.
3. Store & Work With Client Information
The easiest place to save a file is not always the approved place.
4. Share & Send Client Information
A familiar name or email conversation should not automatically authorize disclosure of client information.
5. Protect Client Information Outside the Main System
Client information remains sensitive when it leaves the screen.
6. Retain, Dispose & Report Problems
Employees should follow the firm's retention and disposal rules rather than making individual legal retention decisions.
Client Data Handling Review
If an important handling question remains unresolved, follow your firm’s approved procedure or ask the responsible manager, security contact, or IT provider before moving or sharing the information.
Not Sure What to Do With Client Information?
Use this when the activity is routine and the approved method is clear.
Use this when you are unsure who should receive the information or whether the request is appropriate.
Use this before storing, copying, downloading, or sharing information somewhere outside the normal process.
Use this when client information may already have been sent incorrectly, exposed, lost, accessed improperly, or handled outside policy.
Before You Move Client Data
Our Approved Client-Data Process
Complete these fields before distributing the printed checklist internally.
What Client Information Deserves Extra Care?
Examples of information accounting and tax firms may treat as sensitive include Social Security numbers, taxpayer identification numbers, tax returns, W-2s, 1099s, payroll information, bank-related information, financial statements, identity documents, dates of birth, client-portal documents, tax-software information, employee information processed for clients, authorization documents, and supporting tax records. The firm’s policies should define how different information is handled.
Do You Need to Collect or Keep This Information?
The firm should understand what it collects, why it collects it, where it lives, who needs access, and how long it should be retained. Employees should avoid creating unnecessary copies simply because copying or storage is convenient.
Employees Should Know Where Client Data Belongs
Employees should not have to guess whether sensitive information belongs in tax software, a client portal, approved shared storage, payroll or accounting software, a temporary download, email, or another system. If employees do not know where a sensitive file belongs, that is a process problem worth fixing.
Personal Convenience Should Not Override Firm Data Rules
Sensitive client data should not be moved to personal email, personal cloud storage, unapproved personal devices, personal messaging services, or personal removable media simply because doing so is easier.
IRS Publication 5708 provides sample WISP guidance recommending a policy that keeps client PII off personal employee devices—such as personal memory devices, home computers, and phones—that are not under the firm’s direct control. Firms should define the devices and storage methods that are actually approved for their environment.
Verify the Recipient Before You Share
Before sending sensitive information, employees should consider whether the recipient is correct and authorized, whether the request is expected, whether the information is actually needed, and whether the sharing method is approved.
Unexpected Request?
If a request for client information is unusual or difficult to verify, use the Suspicious Email Verification Checklist before disclosing information.
Payment or Banking Change?
If the request changes where money is sent, use the Payment & Direct-Deposit Change Verification Checklist.
Client Portals Help Only When Employees Use the Approved Process
A portal can provide a controlled way to exchange documents, but employees still need to use the correct client account, follow access rules, verify unusual requests, avoid unnecessary exports, and report unusual activity. A portal is not automatically secure simply because it is called a portal.
Paper Still Contains Client Data
Sensitive information can be exposed through printers, desks, meeting rooms, recycling bins, home offices, vehicles, or unattended physical files. Employees should follow the firm’s physical-document storage and disposal process.
Client Data Rules Still Apply Outside the Office
Remote work does not change the sensitivity of client information. Employees should follow firm rules for approved devices, screens, physical documents, storage, downloads, conversations, and protection from household or public visibility.
Access Is Not Permanent
Employees should have access appropriate to their responsibilities. When someone changes roles, leaves the firm, finishes a seasonal assignment, or no longer needs a system, access should be reviewed through the firm’s established process.
IRS Publication 5708 limits access in its sample WISP to employees with a legitimate job-related need and recommends a systematic process for closing user rights as well as granting them.
Seasonal Access Needs the Same Discipline
Use the Seasonal Tax Employee Security Onboarding Checklist to reinforce approved systems, access, taxpayer-data handling, phishing, and reporting expectations.
Retention and Disposal Should Follow Firm Policy
Employees should not independently choose how long client information is retained. Retention can depend on the type of record, applicable law, professional requirements, contracts, insurance, client agreements, firm policy, and other obligations.
FTC Safeguards Rule guidance for covered financial institutions includes a secure-disposal requirement for customer information, with exceptions where there is a legitimate business need or legal requirement to retain it or targeted disposal is not feasible. That rule does not create one universal employee retention period for every accounting record.
Employee rule: follow the firm’s retention and disposal process rather than making an individual legal-retention decision.
What If Client Information Was Sent to the Wrong Place?
If client or taxpayer information may have been sent to the wrong recipient, shared incorrectly, exposed, lost, or accessed by someone who should not have received it, follow your firm’s incident-reporting process promptly.
Employees should not decide on their own whether a legal breach occurred, contact affected clients or regulators outside the firm’s process, perform forensic investigation, or try to hide the mistake.
A Request for Client Data Should Make Sense
Before sending sensitive information, verify that the request is expected, the requester is appropriate, the information is needed, the recipient is authorized, and the sharing method is approved. If the request is unusual, pause before acting.
OFFICIAL GUIDANCE
Official Guidance on Protecting Client & Taxpayer Information
IRS — Written Information Security Plans
Current IRS guidance says tax professionals should maintain a WISP tailored to the firm’s size, scope, complexity, and sensitivity of customer data. IRS materials emphasize employee management and training, information systems, and detection/management of system failures. Read current IRS WISP guidance →
IRS Publication 5708 — Client PII and Access
Publication 5708 provides sample WISP material covering legitimate job-related access to PII, where PII is stored, device inventories, personal-device policies, access removal, record retention, physical records, and employee rules of behavior. Review Publication 5708 →
IRS — Protect Your Clients; Protect Yourself
The IRS maintains current Security Summit resources and publications for safeguarding taxpayer data, including Publications 4557 and 5293. Open IRS tax-professional security resources →
FTC Safeguards Rule
FTC guidance for covered financial institutions addresses access controls, inventorying where customer information is collected/stored/transmitted, MFA, encryption, secure disposal, service-provider oversight, and staff security awareness. Review FTC Safeguards Rule guidance →
Important: These sources support broader data-security responsibilities. They do not make this exact Secure Team 30-item checklist a government-required form or a complete compliance assessment.
Continue With the Right Secure Team Resource
Did Someone Request Client Information by Email?
Use the Suspicious Email Verification Checklist to review an unexpected message before sharing information, opening a document, signing in, or acting.
Think Client Information May Have Been Mishandled?
Use the Incident Reporting Quick Guide to help employees understand what should be reported and what basic information to provide.
Does the Request Involve Payment or Banking Information?
Use the Payment & Direct-Deposit Change Verification Checklist before changing payment, payroll, bank-account, vendor, or direct-deposit instructions.
Want a Broader Security Review?
Use the Accounting Firm Security Readiness Scorecard to evaluate sensitive-data handling alongside phishing, MFA, payments, access, incident reporting, and training.
Need to Reinforce Client-Data Handling Through Training?
Use the WISP Employee Training Checklist to review onboarding, recurring awareness, training tracking, and documentation.
SECURE TEAM
Turn Client-Data Rules Into Repeatable Employee Habits
Secure Team is being designed to help accounting and tax firms train employees on sensitive information, phishing, account security, payment verification, incident reporting, and other everyday cybersecurity decisions.
Employees should know where client information belongs before they need to decide in the middle of a busy workday.
Client Data Handling Checklist FAQ
What is a client data handling checklist?
It is an employee-facing guide for reviewing how sensitive client or taxpayer information is received, accessed, stored, shared, printed, retained, disposed of, and reported when something goes wrong.
What client information should accounting firms protect?
Examples can include taxpayer identification information, tax returns, W-2s, 1099s, payroll data, identity documents, bank-related information, financial statements, client-portal documents, and other information the firm treats as sensitive.
How should tax preparers protect taxpayer information?
Employees should follow the firm’s WISP and approved procedures for access, storage, sharing, devices, physical documents, remote work, retention, disposal, and incident reporting.
Where should accounting firms store client documents?
Use the systems and locations approved by the firm. The appropriate systems depend on the firm’s WISP, technology, workflows, and applicable obligations.
Should employees save client files to personal computers?
Employees should follow the firm’s device and storage policy. IRS Publication 5708 sample guidance recommends preventing client PII from being stored on personal employee devices that are not under the firm’s direct control.
Should accounting employees use personal email for client documents?
Sensitive client information should not be moved to personal email or other unapproved personal accounts merely for convenience. Follow the firm’s approved communication process.
How should client information be shared?
Confirm that the recipient is authorized, the information is needed, the request is appropriate, and the method is approved by the firm.
Should accounting firms use client portals?
A client portal may be part of a firm’s approved process, but employees still need to use the correct account, follow access rules, verify unusual requests, and avoid unnecessary exports.
How should employees handle printed taxpayer information?
Follow the firm’s physical-document rules for printers, desks, storage, remote work, transport, and disposal.
How should employees protect client information while working remotely?
Follow firm rules for approved devices, screens, physical documents, approved access methods, storage, downloads, and protection from unauthorized household or public visibility.
Who should have access to client information?
Access should follow legitimate business need, role responsibilities, and the firm’s access procedures.
What should happen when an employee no longer needs access?
The firm should review or remove access through its established process when responsibilities change, employment ends, or temporary access is no longer needed.
How long should accounting firms keep client data?
Retention requirements can depend on the type of record, applicable law, professional requirements, contracts, firm policies, and other obligations. Employees should follow the firm’s established retention policy.
How should accounting firms dispose of client information?
Use the firm’s approved secure-disposal process and applicable retention requirements. Employees should not independently decide when business records may be destroyed.
What should an employee do if client data is sent to the wrong person?
Follow the firm’s incident-reporting process promptly and notify the appropriate internal contact.
Does this checklist determine WISP compliance?
No. It is an educational employee data-handling resource and does not certify a complete WISP or regulatory compliance.
Is this checklist required by the IRS?
No. IRS guidance addresses broader taxpayer-data and WISP responsibilities, but this Secure Team checklist is not an IRS-required form.
Does the FTC require this exact client-data checklist?
No. FTC Safeguards Rule guidance addresses broader safeguards for covered financial institutions. This checklist is an educational implementation aid, not an FTC form.
Does Secure Team receive the client information reviewed with this checklist?
No. The checklist does not ask users to enter or upload client or taxpayer information. Only checklist state is stored locally in the browser.
Educational Use Only
This checklist is an educational employee data-handling resource. It does not create or certify a complete WISP, determine regulatory compliance, replace a technical security assessment, prescribe a universal retention period, or replace your firm’s data-handling, privacy, IT, legal, or record-retention procedures.