Tax

Tax agents and client information: what it means in practice.

Being listed as a tax agent with Inland Revenue gives a practice access to its clients' tax affairs and, with that, a large amount of sensitive information: income, bank details, family circumstances, business finances. Looking after that information well is part of the job.

This article sets out the main sources of a tax agent's obligations around client information in New Zealand, and the practical controls that help meet them. It is a guide, not advice; your professional body and your own adviser are the place to go for your specific obligations.

What being a tax agent involves

Inland Revenue's guidance on becoming an intermediary says that to be a tax agent you need to prepare the annual income tax returns for 10 or more other clients, not counting non-active entities. It also says you need a signed authority to act from each client before you register.

That authority is the starting point. It defines the relationship under which you hold and use the client's information, and it is worth reading your template with privacy in mind: what you are authorised to do, and what the client has been told.

The Privacy Act applies to every practice

A tax practice is an agency under the Privacy Act, and client tax information is often personal information. The information privacy principles apply to how you collect, hold, use and disclose it. Three are especially relevant to everyday practice.

Principle 5: security

Principle 5 requires reasonable security safeguards against loss, unauthorised access, use, modification or disclosure, and other misuse. It also says that when information has to be given to someone in connection with providing a service to you, you must do everything reasonably within your power to prevent its unauthorised use or disclosure. That covers the software you use, the reviewers you send work to and any outsourced staff.

Principle 9: retention

Principle 9 says not to keep personal information longer than is required for the purposes for which it may lawfully be used. Inland Revenue's seven-year rule for business records is a reason to keep many records; it is not a reason to keep everything forever.

Principle 11: disclosure

Principle 11 limits when you may disclose personal information. Sending a client's documents to a third party, such as a lender or a buyer's accountant, should rest on the client's instruction or another ground the principle allows.

Professional duties

If you belong to a professional accounting body, its code of ethics will include confidentiality obligations of its own, and they may go further than the Privacy Act, covering business information that is not personal information at all. Read your body's current code alongside this article; it is the authoritative source for your professional duties.

Where client information is most at risk

Email attachments, which leave copies in inboxes and backups you cannot see.
Phishing aimed at staff mailboxes, often disguised as Inland Revenue messages or client documents.
Access that outlives its purpose: former staff, seasonal help and old shared links.
Documents sent to the wrong client, often through email autocomplete.
Personal devices and personal cloud accounts used for work.

Inland Revenue's guidance on scams says it will never ask for your password and does not put links or refund amounts in emails or texts. Making sure the whole team knows this is one of the cheapest protections a practice has.

Practical controls

The obligations above are about outcomes. These controls are ways to reach them.

Collect documents through a request link into a controlled space, rather than by email. ShareAndGo scans every upload for viruses before anyone opens it.
Share documents with third parties as access rather than copies, and only the folders they need.
Use view-only access and personal watermarks where a recipient only needs to read.
Put end dates on access for reviewers, seasonal staff and other advisers.
Use two-step verification on every account, including the sign-in to your data room. ShareAndGo team sign-in runs through MyAndGo with two-step verification.
Keep a record. ShareAndGo's audit log records every view, upload, download, invitation and change, chained so alterations can be detected.

These controls make good practice easier; they do not discharge anyone's obligations on their own. How your practice meets its duties is a matter for you and your professional body.

Answering the client's question

A useful test for any practice is whether it could answer a client who asks: who has seen my information, and where has it gone? With documents scattered across email, that is hard to answer honestly. With a room per client and a complete activity record, it becomes a simple report. Clients notice the difference, and so does anyone reviewing how the practice handles information after something goes wrong.

Questions people ask

How many clients does a tax agent need?

Inland Revenue's guidance says a tax agent needs to prepare the annual income tax returns for 10 or more other clients, excluding non-active entities.

Does the Privacy Act apply to a small tax practice?

Yes. The Privacy Act applies to agencies of any size that hold personal information, which includes tax practices.

Where do I find my professional confidentiality duties?

In the current code of ethics of your professional body, if you belong to one. It is the authoritative source for those duties.