Tax preparers and the WISP: what the PTIN renewal asks, and what the law requires

Every paid tax return preparer renews a PTIN each year, and the renewal carries one line about data security. Many preparers read it as a certification that they have a written information security plan, or WISP. The form's actual words are narrower than that, and the legal duty behind them is wider.

This article sets out what the current Form W-12 says, where the WISP requirement actually comes from, and what changed and when, as of September 25, 2026.

What does the PTIN renewal ask you to confirm?

It asks you to confirm that you know the law requires a written plan. Line 11 of Form W-12, headed "Data Security Responsibilities", reads: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." It points to Publications 5708 and 4557, and the preparer must check Yes or No.

The instructions for the form say the box is checked "to acknowledge awareness" of that requirement. They list the FTC rule at 16 CFR Part 314 and Publications 5708, 5709, 4557 and 5417 as resources.

The form as a whole is signed "under penalties of perjury", and it warns that false or misleading information may lead to criminal penalties or "the denial or termination of a PTIN".

The wording has tightened over time. We compared the revisions the IRS keeps on file.

So since the October 2024 revision the form says "written" and "required by law" in terms. What it does not do is ask you to attach, describe or date your plan.

When does renewal for the 2027 filing season open?

The IRS has not announced a date yet. Its PTIN frequently asked questions say renewal "open season begins mid-October each year for the following year", and that all PTINs expire on December 31. Last year the IRS announced the 2026 renewal period on October 27, 2025.

On September 25, 2026 the IRS page for Form W-12 still listed the October 2025 revision as current and showed "None at this time" under recent developments. A new revision may appear when renewal opens, so the line 11 wording for the 2027 season is not confirmed yet. The fee for 2026 was $18.75: $10 to the IRS and $8.75 to the third-party contractor.

Why does a tax preparer need a WISP at all?

Because the FTC treats tax preparers as financial institutions. The Safeguards Rule lists "tax preparation firms" among the businesses it covers (16 CFR 314.1(b)), and its definitions say an accountant or other tax preparation service "that is in the business of completing income tax returns is a financial institution".

The core duty is in 16 CFR 314.3(a): a covered business must "develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts", with administrative, technical and physical safeguards suited to its size, its activities and the sensitivity of the information. The IRS calls this a WISP.

Publication 4557 (revised June 2024) and Publication 5708 (revised August 2024) both describe it as a legal requirement, and Publication 5708 adds that tax professionals are covered "regardless of size".

What changed, and when?

The rule has been amended twice in five years, and the IRS form followed.

The sections tied to June 9, 2023 are the ones most small practices notice: a designated Qualified Individual, a written risk assessment, access controls, encryption of customer information in transit over external networks and at rest, multi-factor authentication "for any individual accessing any information system", secure disposal, change management, activity logging, staff training, periodic assessment of service providers, a written incident response plan, and a written report from the Qualified Individual at least once a year.

What does the FTC breach notice require?

A report to the FTC within 30 days when at least 500 consumers are involved. Under 16 CFR 314.4(j), after discovering a notification event that "involves the information of at least 500 consumers", a covered business "must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery", using the electronic form on the FTC website.

A notification event is the "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains". Information counts as unencrypted if an unauthorized person accessed the encryption key, and unauthorized access is presumed to be acquisition unless there is "reliable evidence" to the contrary.

The event counts as discovered on the first day any employee, officer or other agent, other than the person committing the breach, knows of it.

The report covers who you are, what types of information were involved, the dates if known, the number of consumers affected and a general description. The FTC's guide warns that "your report may be made public". In its August 2026 paperwork notice the FTC said it received about 163 breach notifications in 2025.

This is separate from what the IRS asks. IRS news release IR-2026-92 recommends a data theft response plan that includes contacting your IRS Stakeholder Liaison, and state breach laws may apply as well.

Does a small practice get any relief?

Some, but not from the written plan itself. Under 16 CFR 314.6, a business that maintains customer information on fewer than 5,000 consumers does not have to meet four provisions: the written risk assessment in 314.4(b)(1), continuous monitoring or annual penetration testing and six-monthly vulnerability scans in 314.4(d)(2), the written incident response plan in 314.4(h), and the Qualified Individual's annual written report in 314.4(i).

Everything else still applies at any size, including the written program under 314.3, the Qualified Individual, multi-factor authentication, encryption, training and service provider oversight. The 30-day FTC notice applies too, although a practice below 500 affected consumers would not reach its threshold.

One point that is often stated as law is not in the rule text. Publication 5708's template tells the firm to review and update its WISP "at least annually". That is IRS guidance.

The rule itself asks for periodic risk assessments and for the program to be adjusted when circumstances change.

What happened in 2025 and 2026?

Nothing that changes the rule. The eCFR amendment history for Part 314 shows no change since May 13, 2024, and eCFR Title 16 was up to date as of September 23, 2026. We found no proposed rule on the Safeguards Rule in the Federal Register in 2025 or 2026.

On June 16, 2025 the FTC published frequently asked questions on the rule, written for motor vehicle dealers. On August 25, 2026 it asked for comment on extending the paperwork clearance for breach reports, which expires on December 31, 2026. Comments are due by October 26, 2026.

The notice changes no obligation.

On the IRS side, the "Protect Your Clients; Protect Yourself" summer series returned. IR-2026-92 of August 18, 2026 restated that tax professionals "are legally required to have a written, accessible plan". IR-2026-106 of September 4 noted that the Safeguards Rule requires multi-factor authentication for tax preparation firms.

The current revisions of Publications 4557 and 5708 remain the 2024 editions.

What are others saying?

These are the pieces we found best argued. Each takes a position of its own, and none of them is the basis for a fact in this article; every fact rests on the sources listed below.

What we could not verify

The line 11 wording for the 2027 filing season. The IRS had not posted an October 2026 revision of Form W-12 by September 25, 2026, and the renewal date and contractor fee for 2027 were not announced.

Whether the online PTIN system asks the question in the same words as the paper form. The online system requires a login, and we did not see it.

What a No answer on line 11 leads to. Neither the form nor its instructions say.

What changed between the 2022 and August 2024 editions of Publication 5708. The IRS did not publish a list of changes that we could find.

Whether the FTC has brought a Safeguards Rule case against a tax preparer in 2025 or 2026. We saw claims of such cases on vendor sites but found none on the FTC's own Safeguards Rule page, and we have not searched its full case list.