Secure Data Destruction Requirements for Tax Preparers

Tax preparers must securely destroy taxpayer data once it's no longer needed for the purpose it was collected, using methods that make the information unreadable and unrecoverable. This obligation comes from three overlapping sources: the Federal Trade Commission (FTC) Safeguards Rule, the FACTA Disposal Rule, and Internal Revenue Service (IRS) Publication 4557 requirements 2026 guidance on safeguarding taxpayer data. For paper records, that generally means cross-cut shredding, not the trash or recycling bin. For digital records, client files, hard drives, old backups, USB drives, decommissioned copiers with internal storage, it means sanitizing the media to a recognized standard, not just deleting files or reformatting a drive.

Getting this wrong isn't a minor paperwork gap. Improperly disposed records are one of the more common ways sensitive taxpayer data ends up exposed after a firm closes, moves offices, or replaces equipment, and it's the kind of failure regulators and state breach-notification laws treat seriously.

The regulatory framework behind destruction requirements

Most paid tax preparers meet the FTC's definition of a "financial institution" under the Gramm-Leach-Bliley Act, which means they fall under the FTC Safeguards Rule. The Safeguards Rule requires firms to develop, implement, and maintain a written information security program, and one specific element of that program is disposing of customer information within a reasonable time after it's no longer needed for business or legal purposes.

A separate but related requirement, the FTC Disposal Rule under the Fair and Accurate Credit Transactions Act (FACTA), applies to any business that uses consumer report information, which covers most tax firms, and requires reasonable measures to prevent unauthorized access to or use of that information when it's discarded. The rule doesn't mandate one specific technology, but it does expect the destruction method to actually work: burning, pulverizing, or shredding paper, and destroying or erasing electronic media so the information can't practicably be read or reconstructed.

IRS Publication 4557Safeguarding Taxpayer Data, ties these obligations back to preparer-specific practice, and IRS Publication 5708 walks preparers through building a compliant WISP template that includes a data retention and destruction policy. None of these sources are optional guidance for firms handling Social Security numbers, Employer Identification Numbers, bank account details, or prior-year returns.

What counts as "secure" destruction

Deleting a file or emptying the recycle bin does not destroy data, it removes the pointer to the file while the underlying data typically remains recoverable with basic forensic tools. Secure destruction needs to make the data unrecoverable, and the right method depends on the media.

Paper records

• Use a cross-cut or micro-cut shredder rather than a strip-cut model, which is easier to reconstruct.
• For high volume, use a destruction vendor certified under the National Association for Information Destruction (NAID) AAA standard and get a certificate of destruction for your files.
• Never place client tax documents in general office recycling or trash, even temporarily.

Digital media

• Follow NIST Special Publication 800-88Guidelines for Media Sanitization, which defines three sanitization levels, clear, purge, and destroy, based on how sensitive the data is and whether the media will be reused.
• For drives being retired or resold, use software that performs a verified multi-pass overwrite or cryptographic erase, not a standard format.
• For drives that held highly sensitive data and won't be reused, physical destruction (degaussing or shredding the drive itself) removes any recovery risk entirely.
• Don't forget office copiers and scanners with internal hard drives, old backup tapes, and decommissioned point-of-sale or accounting workstations, these are commonly overlooked sources of residual taxpayer data.

Retention comes before destruction

Destruction only applies once your legitimate retention period has ended. Circular 230 and Internal Revenue Code Section 6107 generally require paid preparers to keep copies of returns, or a list of taxpayers and the types of returns prepared, for at least three years. Many firms retain records longer, often five to seven years, to align with IRS audit windows, state statutes of limitations, and professional liability considerations. This is a business and risk decision that should be documented in your written information security plan; a qualified tax or legal advisor can help you set a retention schedule appropriate for your practice, since the right period varies by state and engagement type.

Once a document or file passes its retention date, it should move into your destruction workflow rather than sitting indefinitely in a filing cabinet or on an old server, which only expands the amount of data exposed if a breach occurs.

Document it in your WISP, and vet your vendor

A destruction policy that exists only in someone's head doesn't satisfy the Safeguards Rule's written program requirement, and it won't hold up if a regulator, cyber insurer, or client asks how your firm handles disposal. Your written information security plan should spell out what gets retained, for how long, how it's destroyed, and who's responsible for verifying it happened. Firms that skip this step are exposed to the same gaps outlined in our breakdown of WISP penalties for missing or incomplete plans.

If you use a third-party shredding or e-waste destruction vendor, ask for NAID AAA certification, a signed certificate of destruction for every job, and confirmation of how they handle chain of custody between pickup and destruction. If you're clearing your own drives in-house, use tools that produce a verifiable log rather than trusting a one-click "format" option. Building or updating a WISP that covers destruction alongside access control, incident response, and vendor management doesn't have to start from scratch, see our IRS WISP template walkthrough or the Bellator WISP, custom-built for practices with up to 5 users starting at $749, with larger firms quoted separately.