Secure data destruction requirements for tax preparers mean disposing of taxpayer information so it cannot practicably be read or reconstructed after the firm no longer needs it. For paper, that usually means secure shredding. For electronic media, deleting files or reformatting a drive is not enough, the method must match the media and follow a documented process.
The FTC Safeguards Rule requires covered financial institutions to dispose of customer information no later than two years after it was last used in connection with providing a product or service, unless retention is required for a legitimate business purpose or by law. Tax preparers should set retention periods first, then document how paper files, devices, backups, and other storage media move through destruction.
Quick Answer
Tax preparers should securely destroy taxpayer data when its approved retention period ends. The FTC Safeguards Rule requires covered firms to dispose of customer information within two years of its last use unless a legal or legitimate business retention need applies, while IRS Publication 4557 provides tax-practice guidance for safeguarding taxpayer data. Use secure shredding for paper and a media-sanitization method appropriate to the device for electronic records, then retain evidence that the destruction occurred.
Key Takeaway
Set a written retention schedule, inventory every place taxpayer data resides, use destruction methods suited to each medium, and record who verified the work. A WISP should connect those steps so old returns, backup media, retired computers, and copier storage do not fall outside the process.
What the FTC and IRS guidance requires
The FTC Safeguards Rule, 16 CFR Part 314 applies to financial institutions covered by the Gramm-Leach-Bliley Act, a category that generally includes professional tax return preparers. Its disposal provision requires covered firms to securely dispose of customer information within the stated timeframe, subject to the rule's retention exception.
The FTC Disposal Rule applies when a business disposes of consumer report information. If your firm uses that type of information, the rule calls for reasonable measures that prevent unauthorized access to or use of it during disposal. The rule gives examples such as shredding, burning, pulverizing, and destroying or erasing electronic files or media so the information cannot practicably be read or reconstructed.
IRS Publication 4557, Safeguarding Taxpayer Data, is IRS guidance for tax professionals on protecting taxpayer information. It points firms toward a written security program and practical controls, while an IRS WISP explanation can help connect disposal procedures to the rest of that program.
Retention must be decided before destruction
Do not destroy records solely because a return is old. Internal Revenue Code Section 6107 generally requires a paid preparer to retain a copy of a return or a list of taxpayers and return types for three years. State rules, engagement terms, audit considerations, and other obligations may require a longer schedule, so confirm the period with qualified tax or legal counsel.
Use a destruction method that fits the record
Paper taxpayer records should never be placed in ordinary trash or recycling while still readable. Use a cross-cut or micro-cut shredder for routine in-office destruction, or use a qualified destruction provider when volume, storage, or chain-of-custody needs make that more practical.
Electronic records need a different approach. NIST Special Publication 800-88 Rev. 1Guidelines for Media Sanitization, describes Clear, Purge, and Destroy sanitization methods. The appropriate method depends on the device, the sensitivity of the data, and whether the media will be reused, transferred, or retired.
Simple deletion and standard formatting generally do not provide the documented sanitization a firm needs for retired media. Storage devices in laptops, desktops, external drives, backup media, copiers, scanners, and multifunction printers should all be included in the inventory. Cryptographic erase may be suitable for properly encrypted supported devices, while physical destruction may be appropriate for media that will not be reused.
Secure destruction action checklist
- Set a documented retention schedule for returns, workpapers, and taxpayer information after confirming applicable requirements with tax or legal counsel.
- Identify paper files, servers, workstations, external drives, backup media, copiers, scanners, and other devices that can store taxpayer data.
- Use secure shredding for paper records rather than ordinary trash or recycling.
- Select a NIST SP 800-88 sanitization method that fits the device and whether it will be reused or retired.
- Keep destruction logs, vendor records, and any certificate of destruction with your security documentation.
- Assign a person responsible for verifying that scheduled destruction was completed.
Document the process in your WISP
A data destruction policy should name the record categories your firm retains, the approved retention periods, the destruction methods for paper and electronic media, the people responsible, and the evidence you keep. It should also explain how employees handle a device replacement, office move, vendor pickup, or a closed client file.
If a third party collects shredding or electronic media, review its process before handing over taxpayer records. Ask how pickup is documented, how custody is tracked, what destruction method is used, and what records the vendor provides after completion. A certificate of destruction is useful evidence, but it does not replace vendor review or your own policy.
A custom WISP can put the retention and destruction process alongside access controls, incident response, training, and vendor management. Bellator Cyber Guard offers a custom WISP starting at $749 for up to 5 users, with larger practices quoted separately. It is a fit for tax firms that need a written plan tailored to their operations rather than a generic template. If you are comparing options, ask whether the provider will address your actual data locations, retention decisions, assigned responsibilities, and documented review process.
Improper disposal can create a security incident that needs review under applicable state notification rules. The facts and legal triggers vary by state and situation, so legal questions should go to counsel. Firms can also review the operational consequences of an incomplete tax-firm security program when prioritizing the work.
Book a Free Tax Cybersecurity Assessment
Review the retention and destruction controls your tax practice should document in its WISP.
Frequently Asked Questions
Usually not by itself. Deleting a file or emptying a recycle bin removes normal access to it, but it does not necessarily sanitize the underlying storage media. Use a method appropriate to the device and document the result.
Internal Revenue Code Section 6107 generally requires paid preparers to keep a copy of a return or a list of taxpayers and return types for three years. Your actual schedule may be longer because of other rules, state requirements, or business needs, so confirm it with qualified tax or legal counsel.
Yes, if they contain internal storage or have processed taxpayer documents. Include them in the same device inventory and sanitization workflow used for retired computers, drives, and backup media.
Include retention periods by record category, approved paper and media destruction methods, an inventory process, vendor review requirements, responsible roles, and records showing that destruction was completed.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
