Client data security procedure

Purpose

To keep client information confidential and secure, and to respond quickly and correctly if it is lost, stolen or sent to the wrong person.

Scope

All client information the firm holds, on paper or electronically, and every staff member, contractor and device that can reach it.

Responsibilities

Procedure

1. Give access only as needed

   Staff can reach only the clients and systems their role needs. Remove access the day someone leaves.

2. Secure every login

   Use a password manager and multi-factor login on email, the practice software and the tax portal.

3. Send files securely

   Send tax returns and financial files through the client portal, never as plain email attachments.

4. Verify unusual requests

   Confirm any request to change bank details, send a refund elsewhere or release documents by calling the client on a number already on file.

   Caution: Email and phone scams that impersonate clients are common. Never act on a new number or address given in the request itself.

5. Secure devices and paper

   Lock screens when away, encrypt laptops and phones, keep paper files locked away, and shred them when no longer needed.

6. Respond to a breach

   Report it to the privacy officer at once. Contain it, work out what was exposed and who is affected, and notify clients and the regulator if your local privacy law requires it.

Records

• The access list for each system, reviewed every quarter.
• The breach register, with each incident and what was done.

Related documents

• Client onboarding checklist
• Staff onboarding checklist

Revision history