Sending tax documents securely

Tax returns, payslips and accounts contain exactly the financial and identity data that fraudsters want, and UK GDPR requires appropriate security whenever they are sent. ICAEW’s guidance is that an unprotected email attachment is hard to justify even when the client asks for it, and that a secure file sharing portal is generally the most secure option, with encrypted attachments a reasonable alternative.

Is ordinary email secure enough for client tax documents?

Usually not. Article 5(1)(f) of the UK GDPR requires personal data to be processed with appropriate security, and Article 32 requires measures appropriate to the risk, including encryption where appropriate. The law does not name a technology, so each practice has to decide what is appropriate, document that decision and be able to defend it.

The ICO describes unencrypted emails as being “like postcards” that can be read at any server they pass through. Its email security guidance also says that financial information, or information that might be used to commit identity fraud, counts as sensitive when deciding how to send it. A tax return carries a name, address, National Insurance number, UTR, income figures and often bank details: very close to a complete identity fraud kit.

ICAEW’s helpsheet on communicating safely with clients goes further. It says sending personal data in an unprotected email or attachment is ill advised and that, even if the client requests or agrees to it, the firm keeps its security obligations, so client agreement “would not generally be considered a defendable position”. The underlying duty sits with the firm as controller; see data protection for accountancy practices.

What are the options, from weakest to strongest?

Method	What ICAEW says	Main weakness
Unprotected attachment	Ill advised and difficult to justify	Readable by anyone who gets into either mailbox or receives it by mistake
Password protected file only	May not always be appropriate; password removal tools are widely available	Weak protection, and the password is often sent in the same channel
Encrypted and password protected attachment	May be a good option for many firms	Depends on strong passwords sent by a different medium
Secure file sharing portal	Generally the most secure option	Cost, client take up, and checking where the servers are

Where a password is used, ICAEW says it should never be in the same email as the attachment and ideally not sent to the same email account at all. A phone call or text message is better. Encryption of the file itself protects the document both in transit and when it is sitting on the client’s computer or mail server.

Does encryption in transit on email solve the problem?

Only partly. The ICO notes that most online services now encrypt data in transit by default, and that Transport Layer Security (TLS) protects content against interception while it is travelling. But the ICO also points out that, without other encryption, the data is stored in plain form on the recipient’s system exactly as it was on the sender’s. So anyone who gets into the client’s mailbox can read everything that was ever sent to it.

The ICO says organisations must not use any version of SSL, that TLS 1.0 and 1.1 are no longer recommended, and that TLS 1.2 and 1.3 give strong protection when configured correctly. A practice should check this with its email provider and on any portal it uses, but treat transport encryption as a baseline, not the whole answer.

What should a portal policy cover?

A portal only works if staff use it every time. ICAEW notes that tools can be built into email programs such as Outlook to force attachments through the portal, which prevents unprotected attachments being sent in error, and that many accounting software providers now include file sharing. A workable policy covers:

• which documents must always go by portal (returns, accounts, payslips, P60s, identity documents);
• multi factor sign in for clients and staff;
• how long documents stay on the portal before deletion;
• where the provider stores data, because ICAEW flags that portal servers abroad bring in the international transfer rules;
• a written processor agreement with the portal provider, as explained in data processing agreements with software providers.

Approval and signature workflows are covered separately in client portals and e signatures.

What about newsletters and emails to many clients?

Bulk emails create a different risk: revealing who the firm’s clients are. The ICO says it has seen hundreds of breach reports where senders misused the BCC field, and that BCC is not enough on its own where sensitive information is involved. It has fined an NHS trust that put patient email addresses in the “To” field, and a charity that copied 105 members of an HIV advisory board into the CC field. Its guidance suggests using bulk email or mail merge services, warning rules when the CC field is used, a short sending delay to catch mistakes, and turning off address autocomplete. Where an agency or platform sends emails for the firm, it must meet the same security requirements.

What should staff do when a client emails documents unprotected?

Clients often send passports, bank statements and payslips as plain attachments. ICAEW suggests reminding them of the firm’s procedures, being careful not to hit reply in a way that sends the original attachments back out unprotected, and moving the documents into secure storage. Mobile devices also need attention: ICAEW recommends policies requiring strong passwords, encryption and remote wiping, because phones and laptops with work email are lost or stolen much more often than office computers.

Free webmail accounts are a particular weakness for sole practitioners. ICAEW points out that server locations can be hard to establish and that deleted emails may remain on the provider’s servers, and that paid business accounts generally offer better security and backup.

How should documents be exchanged with HMRC?

HMRC’s factsheet CC/FS72 says email is not secure and that HMRC will not email a taxpayer unless they agree in writing and confirm they understand and accept the risks, including being content for financial information and attachments to be sent by email. An authorised agent can give that confirmation for the client. HMRC itself reduces risk by quoting only part of reference numbers and sometimes using encryption.

For compliance checks, HMRC’s online service lets a taxpayer or authorised agent upload documents using the case reference on HMRC’s letter. Files must be 15MB or less in formats including PDF, JPEG, XLSX and DOCX, up to 10 at a time, and a confirmation email gives a submission reference. That is generally a better route than email attachments. Separately, HMRC’s Standard for Agents expects agents to maintain the security of client information they hold.

What if a document goes to the wrong person?

A misdirected return is a personal data breach. The firm must assess the risk and decide within 72 hours whether to report it to the ICO; the process is set out in personal data breach reporting. Encryption can change the outcome. Article 34(3)(a) says individuals need not be told of a high risk breach if the data was protected by measures that make it unintelligible to anyone not authorised to access it, such as encryption. The ICO adds that the firm must still consider whether to tell the regulator.

How does this play out in practice?

Illustration only. A sole practitioner sends 300 personal tax returns a year as PDF attachments. One is sent to a former client with a similar name. If the PDF was unprotected, the recipient can read the full return, the client probably needs to be told and the ICO may need to be informed. If the same return had been sent through a portal requiring the intended client’s own login, the mistake would most likely have exposed nothing more than a notification email.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

• Staff using personal devices for client work
• Cyber security for accountancy practices
• Preventing payment diversion fraud in practices
• Putting client data into AI tools: data protection risks
• Outsourcing accounting work offshore
• Sending accounts to shareholders: the section 423 duty

Sources

• ICAEW: Gdpr communicating safely with clients
• ICO: Email and security
• ICO: Encryption and data transfer
• ICO: Encryption and data protection
• legislation.gov.uk: 34
• legislation.gov.uk: 32
• GOV.UK: Corresponding with hmrc by email
• GOV.UK: Send documents or information to hmrc for a compliance check
• GOV.UK: The hmrc standard for agents
• legislation.gov.uk: 33

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.