Are US tax preparers legally required to protect my data?

Yes. IRS Publication 4557 explains that the Gramm-Leach-Bliley Act treats professional tax preparers as financial institutions and that the FTC Safeguards Rule requires a written information security plan. The plan must include a designated qualified individual, risk assessment, monitoring and testing, oversight of service providers, staff training and multi-factor authentication for anyone accessing customer information.

Can a preparer share my US tax return information with anyone else?

Not without your consent, unless a specific exception applies. Internal Revenue Code section 7216 prohibits preparers from knowingly or recklessly disclosing or using tax return information for purposes other than preparing the return. IRS guidance says consent must be written, signed, dated and given knowingly and voluntarily, and that special consent rules apply before return information is disclosed to a preparer outside the United States.

Does UK GDPR apply to a UK firm preparing my US tax returns?

Yes. A UK-based practice is a controller of the personal data in your file. The ICO expects appropriate technical and organisational measures protecting confidentiality, integrity and availability, recommends encryption for data stored or sent over the internet, and requires written contracts with any processors. The practice must also justify how long it keeps your data and cover any transfer outside the UK with a valid mechanism.

Is it safe to email bank statements and my passport to a tax preparer?

It is poor practice. IRS Publication 4557 tells preparers to caution customers against sending sensitive data by email, to encrypt data if email must be used, and suggests secure file transfer instead. Email leaves copies in mailboxes and backups on both sides for years. Use an encrypted document exchange with multi-factor authentication, and confirm any unusual request by telephone.

What is an IRS IP PIN and should I give it to my preparer?

An IP PIN is a six-digit number issued by the IRS that prevents someone else from filing a tax return using your Social Security number. It is valid for one calendar year. The IRS says to share it only with your tax professional when you are ready to sign and submit your return, and that the IRS itself will never ask you for it.

How long should records from a streamlined submission be kept?

It depends on the document. The IRS says FBAR account records must generally be kept for five years from the FBAR due date, and that tax records should be kept for 3 years in general and longer in specified cases. UK GDPR sets no fixed period, so a UK practice must set and justify its own retention schedule. Ask for it in writing and keep your own complete copy.

IRS Streamlined Filing Experts: Keeping Your Data Secure

IRS Streamlined Filing Experts are expected to protect the documents you hand over under two sets of rules at once: in the United States, the FTC Safeguards Rule with its written information security plan and the Internal Revenue Code restrictions on disclosing or using return information; in the United Kingdom, the security, storage limitation and international transfer rules of UK GDPR as supervised by the Information Commissioner's Office. In practice that means encrypted document exchange instead of email, multi-factor authentication on every system holding your file, a stated retention period, and a clear account of what leaves the UK. If a preparer cannot explain those four things before you send the first statement, do not send it.

For a high-net-worth client this is not abstract. A streamlined file is one of the most concentrated records of identity and wealth that exists outside a private bank: a Social Security number, a passport, a home address, and a multi-year map of every account and source of income on both sides of the Atlantic. In the returns we prepare, the exposure is rarely in the tax work. It is in how the file travels, where it sits, who can open it, and what happens to it afterwards.

What data does a streamlined engagement actually collect?

The Streamlined Foreign Offshore Procedures are the IRS route for US taxpayers living abroad whose failure to file was non-willful. The IRS page at https://www.irs.gov/individuals/international-taxpayers/u-s-taxpayers-residing-outside-the-united-states sets the scope: tax returns, with all required information returns, for each of the most recent 3 years for which the due date has passed, FBARs for each of the most recent 6 years for which the FBAR due date has passed, and a signed Form 14653 certification. Eligible taxpayers who follow the instructions are not subject to failure-to-file, failure-to-pay, accuracy-related, information return or FBAR penalties. That scope drives the volume of data.

A typical file for an investor or business owner with UK and US exposure contains the following.

Identity documents: a passport copy, proof of address, and the Social Security number or ITIN that must appear on every return.
Six calendar years of statements for every non-US account, because each FBAR needs the maximum value of each account during the year.
Three years of income records: UK payslips, UK self assessment returns, brokerage and dividend statements, rental accounts and company records where a business is owned.
Residence evidence for the non-residency test: travel dates, property records and employment history.
The narrative of facts behind the non-willful certification on Form 14653, often the most personal document in the file.
Banking details for any tax payment or refund.

What should IRS Streamlined Filing Experts do to keep your data secure under US rules?

The IRS reference document is Publication 4557, Safeguarding Taxpayer Data, at https://www.irs.gov/pub/irs-pdf/p4557.pdf (revised June 2024). It explains that the Gramm-Leach-Bliley Act treats professional tax preparers as financial institutions, and that the Federal Trade Commission's Safeguards Rule requires them to develop a written information security plan. A written information security plan is a documented programme, proportionate to the size of the practice and the sensitivity of the data, that identifies the risks to client information and the safeguards that control them.

According to Publication 4557, the plan must be appropriate to the firm's size and complexity, the nature and scope of its activities and the sensitivity of the customer information it handles. As part of that plan the publication says each firm must:

Designate a qualified individual responsible for overseeing, implementing and enforcing the information security programme.
Implement multi-factor authentication for anyone accessing customer information, using at least two of a knowledge factor, a possession factor and an inherence factor. The publication states this is required for all companies regardless of size.
Identify and assess the risks to customer information in each relevant area of the operation and evaluate whether current safeguards control them.
Design and implement a safeguards programme, and regularly monitor and test it.
Select service providers that can maintain appropriate safeguards, require those safeguards by contract, and oversee how the providers handle customer information.
Evaluate and adjust the programme as the business changes or as testing reveals weaknesses.
Provide security awareness training with regular refreshers.

How far the Safeguards Rule reaches a practice located wholly in the UK is a jurisdictional question. Our view as practitioners is that it should not matter to the client. A practice preparing US returns holds exactly the data the rule was written to protect, so the plan, the named responsible person and multi-factor authentication are the benchmark wherever the desk sits.

What does section 7216 stop a preparer doing with your return information?

Internal Revenue Code section 7216 is a criminal provision that prohibits tax return preparers from knowingly or recklessly disclosing or using tax return information for any purpose other than preparing the return, unless an exception applies or the taxpayer has consented. The IRS frequently asked questions at https://www.irs.gov/tax-professionals/section-7216-frequently-asked-questions describe a fine of up to $1,000, imprisonment of up to one year, or both, for each violation, and a separate civil penalty under section 6713 of $250 for a disclosure or use that need not be knowing or reckless. The IRS now marks that page as historical content, so treat those figures as its published description of the base penalties rather than a complete statement of current law.

Three features matter to a streamlined client. First, tax return information is defined very widely: the IRS describes it as all the information a preparer obtains from the taxpayer or other sources in connection with a return, including computations, worksheets and IRS correspondence. Your bank statements and your Form 14653 narrative are inside that definition. Second, the definition of preparer extends to people who perform auxiliary services, so the restriction follows your data to support staff. Third, consent has to be written, signed and dated, given knowingly and voluntarily, and obtained before the disclosure or use.

There is also a cross-border rule. The IRS guidance says that disclosing return information to a preparer located outside the United States generally requires the taxpayer's signed consent in a prescribed form, and that a Social Security number in the disclosed documents must generally be redacted or masked unless the taxpayer consents and both preparers maintain adequate data protection safeguards as defined in Revenue Procedure 2013-14. In plain terms, if a US-based preparer passes your file to an overseas team, you should have been asked first, in writing.

What does UK GDPR require of a UK-based practice?

A UK practice is a data controller for the personal data in your file, and the security principle of UK GDPR applies in full. The ICO's guidance at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ explains that processing must be secured by appropriate technical and organisational measures protecting the confidentiality, integrity and availability of systems and data, that access must be restorable in a timely manner after an incident, and that measures must be tested. The law prescribes no fixed list of controls. What is appropriate depends on how sensitive the data is and the harm a compromise could cause. For a file containing a passport, an SSN and six years of balances, that assessment only points one way.

Two points are worth putting to a prospective preparer. The ICO recommends encryption wherever personal data is stored or transmitted over the internet. And where the practice uses a processor, such as a hosted document store or an outsourced preparation team, it must choose one that gives sufficient guarantees about security and bind it with a written contract imposing the same obligations.

UK GDPR also sets the clock if something goes wrong. The ICO's breach guidance states that a notifiable breach must be reported to the ICO without undue delay and not later than 72 hours after the organisation becomes aware of it. On the US side, Publication 4557 tells preparers to report client data theft to their local IRS Stakeholder Liaison. Ask whether the practice has a written incident procedure, because the speed of that call determines how quickly you can protect your accounts.

Why is email the wrong way to send six years of bank statements?

Ordinary email is the weakest link in most engagements. Messages and attachments sit indefinitely in sent folders, inboxes, phone caches and backups on both sides, and a single compromised mailbox exposes the whole history. Publication 4557 is direct about this. It tells preparers to caution customers against transmitting sensitive data by email, to encrypt the data if email must be used, and it suggests secure file transfer rather than email. It also warns that criminals hijack email accounts to send messages in a preparer's name.

Secure document exchange is a method of transferring files through an encrypted, access-controlled channel where each party authenticates with more than a password. Files are encrypted in transit and at rest, access is limited to the people working on your returns, and access can be withdrawn and files deleted at the end. The failure mode we see most often is not a sophisticated attack. It is a client who emails a passport scan from a phone because it is quicker, or a preparer who emails a draft return with a full SSN on page one.

How should passports, SSNs and the IRS IP PIN be handled?

A preparer needs to verify who you are, and a UK practice has anti-money laundering obligations that require customer due diligence. That is a legitimate reason to hold a passport copy. It is not a reason to hold it everywhere. Sound practice is to keep identity documents in a restricted area of the file, separate from working papers, and to show only the last four digits of an SSN wherever the form itself does not require the full number.

The Identity Protection PIN is the IRS's own defence against someone filing a return in your name. The IRS describes it at https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin as a six-digit number that prevents someone else from filing a tax return using your Social Security number. It is valid for one calendar year. Anyone with an SSN or ITIN who can verify their identity may request one. The IRS states that it will never ask for your IP PIN, and that you should share it only with your tax professional when you are ready to sign and submit your return.

For a client re-entering the US system, an IP PIN is worth considering once regular annual filing resumes, because your SSN is about to become active on IRS systems again. Treat the PIN like a banking credential: give it to the preparer at the point of filing, through the secure channel, never in an email thread.

What leaves the UK during a streamlined submission?

Three flows are built into the procedure itself. The tax returns and the original signed Form 14653 go to the IRS in paper form: the IRS states that electronic submissions will not be accepted for the streamlined package and gives a dedicated address in Austin, Texas. So a physical bundle carrying your SSN and income details crosses the Atlantic, and it should travel by tracked courier with proof of delivery kept on file. The delinquent FBARs must be filed electronically through FinCEN's BSA E-Filing System, selecting Other as the reason for late filing and entering Streamlined Filing Compliance Procedures in the explanation box. Those reports carry account numbers, bank names and maximum balances for six years. The third flow is any tax payment.

Where a preparer files the FBARs for you, the IRS page at https://www.irs.gov/businesses/small-businesses-self-employed/report-of-foreign-bank-and-financial-accounts-fbar explains that you authorise this on FinCEN Report 114a, which is not submitted with the FBAR. You keep it and make it available to FinCEN or the IRS on request.

The less visible flows are the ones to ask about. If the practice stores your file with a US-hosted provider or uses reviewers overseas, that is a restricted transfer under UK GDPR. The ICO's guide at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/ defines a restricted transfer as a transfer of personal information to a separate organisation located outside the UK, and making data accessible counts as well as sending it. Every restricted transfer must be covered by adequacy regulations, by appropriate safeguards such as the International Data Transfer Agreement supported by a transfer risk assessment, or by a specific exception. If none applies, the transfer must not be made.

For the United States, the relevant adequacy route is the UK-US data bridge. The GOV.UK explainer at https://www.gov.uk/government/publications/uk-us-data-bridge-supporting-documents/uk-us-data-bridge-explainer confirms it has been available since 12 October 2023 and covers transfers to US organisations certified under the opt-in framework. It is not a blanket permission to send data to any US recipient, and it does not remove a UK organisation's obligations under UK data protection law. A filing delivered to a US government agency on your instructions is a different kind of flow from a preparer storing your documents with a US vendor, and a preparer should be able to explain how it has analysed each.

Worked scenario: an investment banker's streamlined file

The following is an illustration only, with invented facts and figures. A US citizen working in investment banking in London has never filed a US return. She holds nine UK accounts, including current, savings, share dealing and two joint accounts with her spouse. Six years of statements for nine accounts comes to roughly 650 pages. Her file also contains three years of UK payslips, three UK self assessment calculations, her passport, her SSN and a two-page narrative for Form 14653.

Handled well, the sequence looks like this. Her engagement letter and privacy notice state the retention period and the categories of third party involved, and she signs any consent needed for work done in another country. She uploads everything through an encrypted exchange protected by multi-factor authentication; nothing is emailed. Identity documents sit in a restricted folder and working papers show only the last four digits of her SSN. Six FBARs are e-filed under a signed Report 114a, and she receives each confirmation. The three returns and the original Form 14653 are couriered to the IRS with tracking. Her spouse, who is not a US person, appears only as a joint account holder, with his details limited to what the FBAR requires.

Handled badly, the same engagement produces around forty email threads with statement attachments, a passport scan in two mailboxes and a phone gallery, an unencrypted draft return on a laptop, and no record of who holds what. The tax result is identical. The residual risk is not, and it lasts for as long as those copies exist.

How long will a preparer keep your records, and how long should you?

There is no single retention period. UK GDPR sets no fixed limit: the ICO's guidance at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/ says an organisation must not keep personal data for longer than it needs it and needs a policy setting standard retention periods wherever possible. These are the official reference points a preparer's policy should be built around.

FBAR records: the IRS states that you must generally keep records of each reportable account for five years from the due date of the FBAR.
Your own US tax records: the IRS guidance at https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records gives a general period of 3 years, 6 years where income that should have been reported exceeds 25% of the gross income shown on the return, and indefinitely where no return was filed.
The preparer's copy of the return: the Internal Revenue Manual at https://www.irs.gov/irm/part20/irm_20-001-006 describes Internal Revenue Code section 6107(b), under which a preparer must retain a completed copy of the return or a record of the taxpayer and return, and make it available to the IRS for three years following the close of the return period.
UK identity verification records: regulation 40 of the Money Laundering Regulations 2017 at https://www.legislation.gov.uk/uksi/2017/692/regulation/40 requires customer due diligence records to be kept for five years from the end of the business relationship, after which personal data obtained for that purpose must be deleted unless an exception applies.
Everything else: working papers, correspondence and the narrative behind your certification are held for whatever period the practice's own policy justifies, which is why you should ask for the figure in writing.

For your own copy, keep the complete submission, the courier proof of delivery, the FBAR confirmations and the signed Form 14653 for at least the longest of those periods that applies to you. Do not rely on a preparer still holding it years later.

What happens to your records after the submission?

This is the question almost nobody asks. Once the package has been sent, the file should move from active working status to a controlled archive. Access should narrow to the people who would handle follow-up correspondence. Duplicate copies created during preparation, on local drives, in scanning folders and in email, should be removed. The archive should carry a destruction date, and when it arrives the data should be erased or anonymised; the ICO notes that moving data to offline storage is not the same as deleting it. Publication 4557 tells preparers to destroy paper so it cannot be read or reconstructed and to erase data from devices and media before disposal, which matters in streamlined work because the submission itself is a paper package.

Your rights continue after the engagement ends. Under UK GDPR you can ask what the practice holds about you, and the ICO confirms that individuals have a right to erasure of personal data the organisation no longer needs for its specified purposes. That does not override records the practice is legally required to keep, but it does bite on everything beyond them. Publication 4557 also tells preparers to withdraw from outstanding authorisations for taxpayers who are no longer clients, so if you change preparer, ask the old one to confirm that any power of attorney has been withdrawn and all access closed.

What questions should you ask a preparer before sending anything?

Ask these before the engagement letter is signed, and expect specific answers rather than reassurance.

Do you have a written information security plan, and who is the named individual responsible for it?
How will I send documents to you, and is multi-factor authentication required for me and for every member of staff who can open my file?
Is my data encrypted both in transit and where it is stored?
Who will see my file, including outsourced preparers, reviewers or hosting providers, and in which countries are they?
If my data is stored or accessed outside the UK, which transfer mechanism covers it, and will you ask for my written consent before return information goes to a preparer in another country?
Will my full Social Security number appear on drafts and correspondence, or only the last four digits?
How long do you keep each category of document, and will you confirm in writing when my data has been deleted?
What is your procedure if there is a breach, and how quickly would I be told?
Will you use my information for anything other than preparing my returns, such as marketing or referral to other providers?

The last question is the section 7216 question in everyday language. The correct answer is no, not without your separate signed consent.

How do we approach data handling in the streamlined submissions we prepare?

We describe our approach as a standard of sound practice, because that is what you should hold any preparer to. In the streamlined submissions we prepare, we collect only what the forms require: six years of statements for the FBARs, three years of income records for the returns, and the facts needed for the certification. We ask clients not to email identity documents or statements, we keep identity evidence apart from working papers, we mask the SSN wherever a form does not need it in full, and we set the retention period at the start. We treat the paper package to the IRS as the most sensitive item in the engagement, and we send it tracked.

None of this is exotic. It is tax preparation and compliance carried out with the care the data deserves. A client who has used the streamlined procedures to come back into compliance without penalty should not be left with a second problem, a detailed financial file scattered across inboxes, as the price of fixing the first.