If your firm prepares tax returns, you are a financial institution under the FTC Safeguards Rule, and that rule has a breach-reporting duty that many small firms have never read. Since May 13, 2024, a qualifying data breach must be reported to the Federal Trade Commission within 30 days of discovery. This article explains what triggers the duty, how the 500-person threshold is counted, and what the notice must contain. It is general information, not legal advice.

When the Duty Applies

The rule calls the trigger a “notification event”: acquisition of unencrypted customer information without the authorization of the individual it belongs to. Two details matter in practice:

• Access is presumed to be acquisition. If someone who should not have it gets into a system where unencrypted client information sits, the rule presumes the data was acquired, unless you have reliable evidence that it was not and could not reasonably have been.
• Encryption helps only if the key stays safe. Information that was properly encrypted does not trigger the duty, but if the encryption key was accessed by an unauthorized person, the data counts as unencrypted.

The 500-Person Threshold

You must notify the FTC when a notification event involves the information of at least 500 consumers. The count is of individuals, not client files. A single joint return can include a spouse and dependents, so a firm with a few hundred client households can reach 500 faster than the client count suggests. Before an incident happens, it is worth knowing roughly how many individuals’ information sits in each system.

The 30-Day Clock

Notice is due as soon as possible and no later than 30 days after you discover the event. The clock runs from discovery, not from the end of your investigation, so a firm that is still working out what happened can already be counting days.

What the Notice Must Contain

The notice is filed electronically on a form on the FTC’s website. It asks for:

• Your firm’s name and contact details.
• The kinds of information involved.
• The date, or date range, of the event, if it can be determined.
• The number of consumers affected or potentially affected.
• A general description of what happened.
• Whether a law enforcement official has determined in writing that telling the public would impede a criminal investigation or harm national security, and how the FTC can reach that official.

Small Firms Are Not Exempt From This Part

The Safeguards Rule excuses firms that keep information on fewer than 5,000 consumers from certain written requirements, including a written incident response plan. That exemption does not list the notification duty. A small firm that suffers a qualifying breach still has to report it.

Other Rules May Apply

The FTC notice is separate from other obligations. Many states have their own breach-notification laws with their own deadlines and thresholds, and your clients may need to be told. If an incident happens, speak to your attorney early rather than after the 30 days have passed.

What You Can Do Before an Incident

• Know where client data lives. You cannot count affected people or judge whether data was encrypted if you do not know which systems hold it.
• Encrypt, and protect the keys. Encryption can take a breach outside the notification duty, but only if the keys are controlled separately from the data.
• Write down who decides. Name the person who will assess an event, keep the log, and file the notice, and make sure they know the 30-day rule.
• Keep records of access. Logs of who can reach client data, and when, are what let you show that data was or was not acquired.

Where Hosting Fits

Moving your tax software to a hosted environment does not transfer the reporting duty. Your firm is still the one responsible to the FTC and to your clients. What hosting changes is how much you can show: data held in an encrypted, access-controlled environment with logged access gives you something concrete to point to when you assess an event. For how we protect client data, see Our Security Measures and Is QuickBooks Hosting Secure?

Sources: the FTC’s notification-requirement guidance (effective May 13, 2024) and 16 CFR 314.2, 314.4(j) and 314.6. Check the current text of the rule or ask your attorney before relying on this summary.