When HMRC can share your tax information

Q: How does this work in practice?

Illustration only. A self employed decorator applies for a mortgage and the lender phones HMRC to confirm his income. Confirmation would be a disclosure, so HMRC cannot give it on the lender's request alone; the decorator supplies his own documents or consents. His new accountant calls before the authorisation is in place, and HMRC declines to discuss his affairs. If HMRC found that his previous adviser had committed misconduct connected with his tax affairs, it could report this to the adviser's professional body under section 20(3), and that body could not pass the information on without HMRC's consent.

HMRC officials must not disclose information that HMRC holds in connection with its functions. That rule is in section 18(1) of the Commissioners for Revenue and Customs Act 2005 (CRCA). The exceptions are narrow: disclosure for HMRC’s own functions, with your consent, through a specific legal gateway, under a court order, for civil or criminal proceedings about HMRC’s work, or for listed public interest purposes under section 20. Disclosing outside those routes can be a criminal offence under section 19.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

What does HMRC’s duty of confidentiality cover?

Section 18(1) CRCA says Revenue and Customs officials may not disclose information held by HMRC in connection with any of its functions. “Officials” is wide. Section 18(4) covers anyone who is or was a Commissioner, an officer of Revenue and Customs, a person acting on behalf of the Commissioners or an officer, or a member of a committee set up by the Commissioners.

HMRC’s Information Disclosure Guide (IDG10200) says the duty is owed equally to all customers: individuals, employers, sole traders, partnerships, companies and trusts. It is also owed to deceased customers, and to people HMRC thinks are acting illegally as well as those it thinks are compliant.

Confirming something is also a disclosure. IDG40440 says that if someone asks HMRC to verify information they already hold, HMRC is still disclosing protected information and needs lawful authority to do so. Two routine exceptions are described there: HMRC may confirm that a VAT registration number is valid, and may confirm an employee’s National Insurance number to a registered employer or pension provider, where there is a legitimate business need and no sign of fraudulent use.

What exceptions does section 18 allow?

Section 18(2) lists the circumstances in which the bar in section 18(1) does not apply. In summary, a disclosure is allowed where it is:

made for the purposes of an HMRC function and does not breach any restriction imposed by the Commissioners (IDG40410 says no such restriction has been imposed at present);
made under section 20 (public interest) or section 21 (to a prosecuting authority);
made for civil proceedings, or for a criminal investigation or criminal proceedings, relating to a matter in which HMRC has functions, whether in the UK or abroad;
made under an order of a court;
made to the police inspectorates, the Independent Office for Police Conduct or the Police Ombudsman for Northern Ireland for their oversight functions;
made with the consent of each person to whom the information relates;
made to Revenue Scotland or the Welsh Revenue Authority in connection with devolved taxes.

Section 18(3) adds that the duty is subject to any other enactment permitting disclosure. Those other enactments are the “legal gateways” described below.

Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.

From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.

See my price in 2 questions or call 01795 841 310.

★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews

When can HMRC disclose to carry out its own work?

Much routine sharing relies on section 18(2)(a). IDG40120 gives the example of telling a bailiff a taxpayer’s name and address so that overdue tax can be collected. IDG40410 says officers must identify the specific HMRC function served, weigh the benefit against any harm, ignore benefits to other departments, and disclose only the minimum needed. Activities ancillary to HMRC’s functions, such as running its IT systems and estate, also count. Data protection law and Article 8 privacy rights also apply.

Even asking a third party for information can reveal that someone is under review, so IDG10200 reminds officers to watch what they give away when gathering information, for example under Schedule 36 information notices.

How does consent work, including for your accountant?

Section 18(2)(h) allows disclosure with the consent of each person the information relates to. IDG30210 says valid consent needs a positive indication such as a signature, an oral confirmation or an online tick box; it cannot be assumed from silence. It must be freely given and fully informed, and the customer must be able to withdraw it as easily as it was given.

IDG30410 says HMRC may pass information to a representative only with the customer’s explicit consent. The consent can be limited to a period or an issue, can run until the customer cancels it, and can exclude information the customer does not want shared. Where a customer cannot give consent, for example through illness, the representative needs a power of attorney. So HMRC will not discuss a client with an unauthorised accountant, or give a spouse the other person’s figures.

Your accountant has a separate duty of confidentiality to you, explained in confidentiality and when accountants can disclose.

What is a legal gateway?

A legal gateway is a provision in another Act that permits HMRC to share information with a named body. IDG40320 says the requesting body should state which gateway it relies on, and that memoranda of understanding and protocols set the procedure but do not themselves give lawful authority. HMRC lists its gateways with other public bodies in IDG50000. They include the Department for Work and Pensions, local authorities, the Financial Conduct Authority, the Pensions Regulator, the Charity Commission, the National Crime Agency, the Serious Fraud Office, the Office for National Statistics and the Student Loans Company.

IDG51200 explains that section 127 of the Welfare Reform Act 2012 allows reciprocal sharing for each department’s functions, and that DWP’s administration of Universal Credit depends heavily on HMRC’s Real Time Information about pay. HMRC describes it as a permissive gateway, not a mandatory one, so each disclosure must still be necessary and proportionate.

Data protection law is not itself a gateway. IDG40160 says that if a third party requests confidential information citing only data protection legislation, HMRC must explain that it can disclose only what the CRCA allows.

When can HMRC disclose in the public interest?

Section 20 is narrower than its title suggests. A disclosure is allowed only if it is made on the instructions of the Commissioners, is of a kind listed in section 20(2) to (7) or in Treasury regulations, and the Commissioners are satisfied it is in the public interest. The listed kinds include disclosure:

to a body regulating a profession, about misconduct by a member that relates to an HMRC function (section 20(3));
to a constable for the prevention or detection of crime, or in connection with the movement of people or goods across the border (section 20(4));
to a person with public functions on public safety or public health (section 20(6));
to the Secretary of State for entry on a computerised database about suspects, arrests, investigation results or seized items (section 20(7)).

Treasury regulations can add kinds of disclosure only where they relate to national security, public safety, public health or the prevention or detection of crime. Under section 20(9), anyone who receives information this way may not pass it on without the Commissioners’ consent. IDG60100 says public interest disclosures are made almost entirely in former Customs work, and that such disclosures in former Inland Revenue work will be rare.

Section 21 separately allows disclosure to a prosecuting authority so that it can decide whether to bring criminal proceedings arising from an HMRC investigation, or give advice on an investigation or proceedings.

What other protections apply to your information?

Can someone get your tax details through a freedom of information request?

No. Section 23 CRCA makes information protected by section 18(1) exempt under section 44(1)(a) of the Freedom of Information Act 2000 if disclosure would identify the person or allow their identity to be deduced. IDG40150 says HMRC’s response to such a request will always neither confirm nor deny that it holds the information. A living individual who wants their own data uses a subject access request instead.

What happens if information is disclosed wrongly?

Under section 19, a person commits an offence by breaching section 18(1) or section 20(9) through disclosing information about a person whose identity is stated in, or can be deduced from, the disclosure. It is a defence to prove a reasonable belief that the disclosure was lawful or that the information was already lawfully public. On conviction on indictment the maximum is two years’ imprisonment, a fine or both. In England and Wales a prosecution needs the consent of the Director of Public Prosecutions. IDG10200 adds that for HMRC staff an unlawful disclosure is also a disciplinary offence that can lead to dismissal.

How does this work in practice?

Illustration only. A self employed decorator applies for a mortgage and the lender phones HMRC to confirm his income. Confirmation would be a disclosure, so HMRC cannot give it on the lender’s request alone; the decorator supplies his own documents or consents. His new accountant calls before the authorisation is in place, and HMRC declines to discuss his affairs. If HMRC found that his previous adviser had committed misconduct connected with his tax affairs, it could report this to the adviser’s professional body under section 20(3), and that body could not pass the information on without HMRC’s consent.

What do people commonly get wrong?

Assuming HMRC can “just confirm” figures to a lender, landlord or former partner. Verification is a disclosure.
Thinking a data protection request by a third party obliges HMRC to hand over someone else’s tax data.
Treating section 20 as a general public interest power. It covers only listed kinds of disclosure and needs the Commissioners’ instructions.
Overlooking that HMRC shares information widely for its own functions. Data from other bodies feeds HMRC’s risk tools, described in our guide to the Connect data system, and your rights in dealing with HMRC are summarised in our guide to the HMRC Charter.

If HMRC opens a check into your return, tax investigation insurance pays your accountant’s fees. Solar Protect cover pays up to £100,000 with no excess; it never pays tax, interest or penalties. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 24 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.