Accountants must not disclose or use confidential information about a client unless the client (or someone with authority) has agreed and the law does not forbid it, or there is a legal or professional duty or right to disclose. Legal duties include court orders, statutory information powers and money laundering reporting; professional rights include responding to your professional body and defending yourself in proceedings. The duty continues after the client relationship ends.

What does the duty of confidentiality cover?

Confidentiality is one of the five fundamental principles. Subsection 114 of the ICAEW Code of Ethics advises that the safe approach is to assume all unpublished information about a client’s affairs, however you came by it, is confidential, and notes that some clients regard the mere fact that you act for them as confidential (114.0 A1).

R114.1 requires you to:

  • be alert to accidental disclosure, including socially and particularly to close business associates and family;
  • keep information confidential within your own firm;
  • keep confidential what a prospective client tells you, even if you never act;
  • take reasonable steps to make sure staff and anyone you take advice from respect the duty.

The duty covers the whole life of the information: collection, use, transfer, storage, dissemination and lawful destruction (114.1 A1). R114.2 prohibits both disclosure and use of confidential information for your own or anyone else’s advantage, and the ICAEW version continues the duty even where the information has since become public, properly or improperly. Professional Conduct in Relation to Taxation (PCRT) adds that confidentiality is also a legally enforceable contractual obligation, which a court would in most cases treat as an implied term even if the engagement letter is silent (PCRT 2.15). Your obligations as a data controller sit alongside this; see data protection for accountancy practices.

When can you disclose with the client’s permission?

R114.3(b) permits disclosure or use where the client, or any person with authority to permit it, has authorised it and it is not prohibited by law or regulation. Even with authority, 114.3 A2 asks you to consider whether third parties could be harmed, whether the information is substantiated and complete, how it will be communicated and whether the recipients are appropriate.

The Code now specifically addresses using client information for training, technology development, research or benchmarking (114.3 A3). Authorisation can be general, for example for internal training, but for specific uses you should explain, preferably in writing, what information is involved, the purpose, who will use it and whether the client will be identifiable from the output. This is directly relevant to feeding client data into software or AI tools.

Which legal duties override confidentiality?

Paragraph 114.3 A1 gives two examples of disclosure required by law: producing documents or giving evidence in legal proceedings, and disclosing infringements of the law to the appropriate public authorities. In UK practice the main examples are:

  • Money laundering reporting. PCRT describes the anti money laundering regime as a statutory code that decides when a disclosure must be made to the National Crime Agency. What you may then say to the client is restricted; see suspicious activity reports, tipping off and the privilege reporting exemption.
  • HMRC information notices. Under Schedule 36 to the Finance Act 2008, HMRC can issue information notices. Paragraph 25 protects a tax adviser’s “relevant communications”, meaning communications with the client or the client’s other tax advisers for the purpose of giving or obtaining tax advice. Paragraph 26 removes that protection for information explaining any document you helped the client prepare for, or deliver to, HMRC so explanations of figures in a return you prepared are generally not protected.
  • Legal proceedings, where you are required to produce documents or give evidence.

HMRC’s Standard for Agents notes that confidentiality is not a principle it specifically covers, but it expects agents to report suspicions of tax fraud or evasion to HMRC where client confidentiality does not apply.

What professional duties or rights allow disclosure?

Where not prohibited by law, 114.3 A1(b) recognises a professional duty or right to disclose or use information:

  1. to comply with a quality review by a professional body;
  2. to respond to an inquiry or investigation by a professional or regulatory body;
  3. to protect your professional interests in legal proceedings;
  4. to comply with technical and professional standards, including ethics requirements.

PCRT 2.17 explains the limits on disclosing in your own interest. Disclosure must be adequate, relevant and reasonably necessary for the administration of justice, and only the minimum information needed may be disclosed. Its examples are defending a criminal charge or clearing yourself of suspicion, defending disciplinary proceedings, resisting penalty proceedings or proceedings for a tax offence, resisting a legal action by a client or third party, suing for unpaid fees and suing for defamation. Where there is doubt, or a risk of challenge, PCRT strongly recommends taking legal advice (2.18).

How does confidentiality work inside the firm and after a client leaves?

Information is confidential within the firm as well as outside it, which is why conflict situations rely on information barriers (see conflicts of interest). R114.4 continues the duty after the relationship ends. You can use the experience you gained, but not confidential information, and ICAEW’s additional guidance says you should not use, or appear to use, special knowledge that could only have come from access to confidential information. Where that line falls is a judgement.

When a client changes accountant, passing information to the new adviser still needs the client’s authority; the process is covered in professional clearance.

How would this work in practice?

Illustration only. A mortgage broker phones asking you to confirm a self employed client’s income for the last two years.

  • Without the client’s authority you cannot confirm anything, including whether the person is your client.
  • With written authority, you consider the 114.3 A2 factors: you confirm only figures that come from submitted returns or finalised accounts, you do not estimate current year profits you have not verified, and you send the confirmation by a secure route to the named lender.
  • If HMRC later issues an information notice about the same client, you check whether the documents requested fall within the paragraph 25 protection or the paragraph 26 exception, and discuss the notice with the client before responding.

What mistakes lead to breaches?

  • Discussing a recognisable client’s affairs socially or on social media; PCRT expects members’ internal and external communications, including social media, to respect confidentiality.
  • Answering third party enquiries (lenders, landlords, family members) without written authority.
  • Copying client data into tools or services without considering authorisation, recipients and security.
  • Disclosing more than necessary when defending a fee claim or complaint.
  • Assuming that because something is in the public domain it can be discussed freely; the ICAEW Code says otherwise.

For tax work these rules sit alongside PCRT, which also reminds members that obtaining a second opinion externally must respect client confidentiality.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.