IRS Publication 4557: a checklist for the client PDFs you send

Pub 4557 covers a lot of ground: passwords, Wi-Fi, phishing, backups, and how to report a data theft. This guide covers one slice of it. The client documents that leave your office. A W-2 sent to a partner firm. A return copy sent to a lender. A brokerage statement handed to a seasonal staffer. It is based on the current edition (Rev. 6-2024) and the other sources listed at the bottom.

What Pub 4557 is, and where the duty comes from

• It is IRS guidance. The publication calls itself an outreach educational effort for tax preparers, transmitters and software developers.
• The legal duty is the FTC Safeguards Rule. Pub 4557 explains that the Gramm-Leach-Bliley Act's definition of "financial institutions" includes professional tax preparers. The rule itself is 16 CFR Part 314, and the FTC's own guide lists tax preparation firms as an example.
• The rule asks for a written plan. In the words of Pub 4557, "tax return preparers must create and enact security plans to protect client data." It points to Publication 5708, a sample written information security plan (WISP) for small practices.

What they say about files that leave your office

1. Share only what the recipient needs

• Pub 4557 lists, among its basic steps: limit access to taxpayer data to individuals who need to know.
• The Safeguards Rule (314.4(c)(1)) says to limit each user's access to the customer information they need for their duties.
• The Pub 5708 template has a firm collect only the personal information it needs, and keeps third-party access to "the minimum required to conduct business."

None of these documents uses the word "redact." But a partner firm reviewing a Schedule C rarely needs the client's Social Security number or the refund account. Sending a copy without them is one practical way to act on "need to know."

2. Encrypt what you send

• Pub 4557 says to encrypt all sensitive files and emails, especially those with a taxpayer's personally identifiable information, and to use strong password protection.
• Its phishing section says that if you must share files with clients by email, send only password-protected and encrypted documents, or use Secure File Transfer Protocol instead of email.
• The Pub 5708 template bars personal information in plain email unless encryption or password protection is present, and sends the password a different way, such as a phone call or text message.
• The Safeguards Rule (314.4(c)(3)) requires encrypting customer information in transit over external networks and at rest, or approved compensating controls where that is not feasible.

3. Know every service that touches client data

• Pub 4557 says to inventory the software used to process or send tax data, and it names web sites in that list. It also warns against offers of "free" software and downloads from unknown sites.
• The Safeguards Rule (314.4(f)), as Pub 4557 summarizes it: select service providers that can maintain safeguards, require it in the contract, and oversee how they handle customer information.

Pub 4557 does not name PDF tools. But most online PDF tools upload your file to their server to do the work. That makes the tool a service that handles client data, so it belongs in your inventory and your vendor review. A tool that runs on your own computer changes what you write in that entry. You still write one.

4. Do not keep what you no longer need

• The Safeguards Rule (314.4(c)(6)) requires disposing of customer information no later than two years after it was last used for the customer, unless there is a business need or a legal duty to keep it, and a periodic review to cut unnecessary retention.
• The Pub 5708 template destroys records with personal information at the earliest opportunity consistent with business needs or legal retention rules.

A copy you emailed lives on in someone else's inbox, outside your retention schedule. A copy with fewer identifiers leaves less behind there.

What Pub 4557 does not cover

It says nothing about document metadata. A PDF can carry the author's name, the software that made it, an edit history and earlier saved versions. Clearing them is not a Pub 4557 requirement. It is part of what "minimum necessary" looks like inside a file.

The checklist

1. Write down who gets client files and why. Partner firms, lenders, staff, clients. This belongs in your WISP.
2. Decide what each recipient needs. Take the rest out of their copy: SSNs, ITINs, EINs, bank account and routing numbers, dates of birth, home addresses.
3. Remove the text, do not just cover it. A black box drawn in some editors leaves the number underneath. Test the copy: try to select or search for what you hid.
4. Clear hidden file details. Author, software, edit history and earlier versions.
5. Encrypt before you send. Password-protect the file and give the password by phone or text, or use a secure portal or SFTP.
6. List every tool that touches the file. Online PDF tools included. If it uploads the file, treat it as a service provider under your plan.
7. Delete copies you no longer need on your retention schedule.

Where KeptPDF fits, and where it does not

KeptPDF's Redact, Metadata and Protect tools run in your browser. The file is not uploaded to KeptPDF. Here is what each one does, so you can decide where it fits in your plan.

• Redact (checklist steps 2 to 4). The Tax documents profile flags SSNs, ITINs, EINs, bank account and routing numbers, names and addresses. You review what it found, and add or drop boxes, before you apply. The text under each box is removed, not covered. If the recipient needs to see the last four digits of an SSN or account number, you can keep them. The output's document properties, XMP metadata and photo location data are cleared as well.
• Metadata (step 4). Shows the hidden details a PDF carries, such as author, software, edit history, photo GPS, attachments and earlier saved versions. It removes the ones you pick, then scans the result again.
• Protect (step 5). Adds an open password with 256-bit AES encryption. There is no way to recover a lost password, so keep it somewhere safe.

What it does not do: it does not make your firm compliant with the Safeguards Rule, write your security plan, send the file, or decide what a recipient needs. Detection can miss things, so look over every page before you share. For a short description of KeptPDF to put in your plan, see the accounting page.

Thinking about AI tools too? Our guide to IRC 7216 and AI for tax preparers covers the disclosure and consent rules that apply before client data goes into one.

Sources

The primary sources are IRS publications and the FTC rule. Outside the short quotes above, we summarize in our own words.

• IRS Publication 4557: Safeguarding Taxpayer Data (Rev. 6-2024)
• IRS Publication 5708: Creating a Written Information Security Plan for your Tax and Accounting Practice (Rev. 8-2024)
• 16 CFR Part 314: Standards for Safeguarding Customer Information (eCFR)
• FTC: FTC Safeguards Rule, What Your Business Needs to Know

This is not tax or legal advice. It is a plain-English summary for general information. Talk to your own advisors about what your plan needs.