The AI data-safety playbook: which client data goes where
A five-step playbook that sorts a firm’s client data into five tiers and maps each tier to the kinds of AI tool allowed to hold it. It checks the map against the TPB’s July 2026 AI guidance, the TFN Rule and OAIC guidance, and ends with a one-page rule sheet to copy.
Trent McLaren · Publisher, The Firm
9 November 2026 · 9 min read
Step 2 of a playbook: Use AI safely with client data: a beginner’s playbook
Part of our AI in accounting coverage. See the full AI for accountants guide →
Learning check · before you start
What do you already have in place?
A few quick questions, so you can skip the steps you have already done. Each one has a line explaining what it means. Not sure, or never heard of it? Choose “Not yet / not sure”: that is where most firms start, and the playbook walks you through it.
This playbook is for the owner or practice manager of a small firm who knows the team is already using AI and wants one clear rule for which client data can go where. You finish with your client data in five tiers, a map of which tier may go into which kind of tool, and a one-page rule sheet. Budget two hours across a week.
It follows the Australian rules, with a pointer for UK and US readers near the end. General information as at November 2026, not legal advice.
Most firms know free chatbots are risky and may even have a policy. What they lack is a rule a junior can apply in five seconds with a client email in front of them. That is what this builds.
Two of the most-registered sessions at The Firm’s AI in Practice Summit cover this: securely connecting ATO data to AI, and “Is it safe? AI, client data and a simple plan for your firm” with Billie Mcloughlin, founder of AIccountancy, on the agenda for 11 November. Notes will be at the summit notes page afterwards.
Step 1: Sort your client data into five tiers
Your task list the kinds of information your practice software and document store hold, such as tax file numbers or client emails, and put each kind into exactly one risk tier.
You said you already have this covered. Skim this step, or skip to the next.
List the kinds of information your practice management system and document store hold, and put each into one tier. Sort by data type, not by client, so the rule covers tomorrow’s new client.
- Tier 0, publiclegislation, ATO rulings, your own published content.
- Tier 1, internaltemplates, SOPs, checklists, job ads. Nothing about a client.
- Tier 2, de-identifiedclient facts with the identity stripped out. “A dental practice with $2m revenue and two locations” rather than the practice’s name.
- Tier 3, identified client datanames, ledgers, financial statements, payroll, correspondence, ATO account and lodgment data.
- Tier 4, restrictedtax file numbers, other government identifiers, bank account and card numbers, login credentials, health and other sensitive information, and anything privileged or in dispute.
Tier 4 exists because mishandling it has no ceiling and prompting with it gains nothing. The analysis works without the TFN.
Done when: every data type your firm holds sits in exactly one tier, written down.
Start step 1 with AI
About your firm Fills in every prompt on this page. Stays in this browser; we never see it.
No client names, figures or identifiers here or in the prompts.
I run [an accounting or bookkeeping practice] in [country] with [how many] people. Our practice software is [practice management software]. Help me sort the kinds of information we hold into five tiers, by data type, not by client: - Tier 0, public: legislation, rulings, our own published content - Tier 1, internal: templates, procedures, checklists. Nothing about a client - Tier 2, de-identified: client facts with the identity stripped out - Tier 3, identified client data: names, ledgers, financial statements, payroll, correspondence, tax authority account and lodgment data - Tier 4, restricted: tax file numbers and other government identifiers, bank and card numbers, login credentials, health and other sensitive information, anything privileged or in dispute List the data types a firm like mine usually holds in [practice management software] and our document store, put each in exactly one tier, and ask me about any you cannot place. Do not ask me for any client details.I run {practice} in {country} with {team} people. Our practice software is {pms}. Help me sort the kinds of information we hold into five tiers, by data type, not by client: - Tier 0, public: legislation, rulings, our own published content - Tier 1, internal: templates, procedures, checklists. Nothing about a client - Tier 2, de-identified: client facts with the identity stripped out - Tier 3, identified client data: names, ledgers, financial statements, payroll, correspondence, tax authority account and lodgment data - Tier 4, restricted: tax file numbers and other government identifiers, bank and card numbers, login credentials, health and other sensitive information, anything privileged or in dispute List the data types a firm like mine usually holds in {pms} and our document store, put each in exactly one tier, and ask me about any you cannot place. Do not ask me for any client details.
Works without client data. Don't paste client names, tax file numbers or ledgers into any AI tool your firm hasn't approved for them. Which data can go where
Learning check
What would you do? Pick one; every answer is explained.
Step 2: Sort your tools into four kinds
Your task ask the team which AI tools and accounts they use, including personal ones, and sort each into one of four kinds: consumer chat app, business plan, connected tool or local tool.
You said you already have this covered. Skim this step, or skip to the next.
The terms a tool runs under matter more than its brand. Our guide to whether AI is safe for client data sets out vendor terms tool by tool; the map needs only four kinds.
- Consumer chat appsfree or personal paid accounts of Claude, ChatGPT and the like, including a partner’s own subscription.
- Business plansfirm-managed workspaces such as Claude Team or Enterprise, ChatGPT Business or Enterprise, or Microsoft Copilot under your Microsoft 365 tenant, where the vendor’s terms exclude your data from model training by default and an admin controls the accounts.
- Connected toolsa business plan with a connector or MCP server reaching into Xero, Xero Practice Manager, Ignition, your email or ATO data. It can read client data nobody pasted.
- Local toolsa model running on a machine the firm controls, with nothing sent to an outside service.
Don’t assume that paid means safe.
Done when: every AI tool or account in use, including ones you found by asking, sits under one kind.
Start step 2 with AI
Uses your answers from About your firm.
Our team uses these AI tools and accounts: [AI tools in use]. Sort each one into one of four kinds: - Consumer chat apps: free or personal paid accounts, including a partner's own subscription - Business plans: firm-managed workspaces where the vendor's terms exclude our data from model training by default and an admin controls the accounts - Connected tools: a business plan with a connector or MCP server reaching into our accounting software, email or tax authority data - Local tools: a model running on a machine the firm controls, sending nothing to an outside service For each tool, tell me what to check in its terms or admin settings to confirm which kind it is. Then write a short, no-blame message I can send the team asking which AI tools and accounts they use, including personal ones.Our team uses these AI tools and accounts: {ai}. Sort each one into one of four kinds: - Consumer chat apps: free or personal paid accounts, including a partner's own subscription - Business plans: firm-managed workspaces where the vendor's terms exclude our data from model training by default and an admin controls the accounts - Connected tools: a business plan with a connector or MCP server reaching into our accounting software, email or tax authority data - Local tools: a model running on a machine the firm controls, sending nothing to an outside service For each tool, tell me what to check in its terms or admin settings to confirm which kind it is. Then write a short, no-blame message I can send the team asking which AI tools and accounts they use, including personal ones.
Works without client data. Don't paste client names, tax file numbers or ledgers into any AI tool your firm hasn't approved for them. Which data can go where
Learning check
What would you do? Pick one; every answer is explained.
Step 3: Draw the map
Your task fill in a grid of your data tiers against the four kinds of AI tool, marking each square yes, no or a condition, and have a partner sign it off.
You said you already have this covered. Skim this step, or skip to the next.
Cross the five tiers with the four kinds of tool and decide each square once, so nobody decides it at their desk.
| Data tier | Consumer chat app | Business plan | Connected tool | Local tool |
|---|---|---|---|---|
| 0 Public | Yes | Yes | Yes | Yes |
| 1 Internal | Yes | Yes | Yes | Yes |
| 2 De-identified | No | Yes | Yes | Yes |
| 3 Identified | No | Yes, with client permission | Read-only, after review, with permission | Yes, on a secured firm device |
| 4 Restricted | No | No | Only after advice (see Step 4) | No |
De-identified data is a “no” for consumer apps because hurried de-identification rarely is; the OAIC notes that de-identified information can still be re-identified. The local column is no free pass either: the OAIC says local deployment is likely to be more privacy-preserving, but a laptop of client files still needs securing.
Done when: every square has a yes, a no or a condition, and a partner has signed it.
Start step 3 with AI
Uses your answers from About your firm.
Help me build our firm's AI data map. Cross five data tiers (0 public, 1 internal, 2 de-identified, 3 identified client data, 4 restricted) with four kinds of AI tool (consumer chat app, business plan, connected tool, local tool). Start from this draft: - Tier 0 and Tier 1: yes in every kind of tool - Tier 2: no in consumer apps; yes in business plans, connected and local tools - Tier 3: no in consumer apps; business plan yes with client permission; connected tool read-only, after review, with permission; local tool yes on a secured firm device - Tier 4: no everywhere, except a connected tool only after professional advice We are [an accounting or bookkeeping practice] in [country] with [how many] people, using [AI tools in use]. Ask me questions one at a time to adjust each square for us, then give me the final table with a yes, a no or a condition in every square, ready for a partner to sign.Help me build our firm's AI data map. Cross five data tiers (0 public, 1 internal, 2 de-identified, 3 identified client data, 4 restricted) with four kinds of AI tool (consumer chat app, business plan, connected tool, local tool). Start from this draft: - Tier 0 and Tier 1: yes in every kind of tool - Tier 2: no in consumer apps; yes in business plans, connected and local tools - Tier 3: no in consumer apps; business plan yes with client permission; connected tool read-only, after review, with permission; local tool yes on a secured firm device - Tier 4: no everywhere, except a connected tool only after professional advice We are {practice} in {country} with {team} people, using {ai}. Ask me questions one at a time to adjust each square for us, then give me the final table with a yes, a no or a condition in every square, ready for a partner to sign.
Works without client data. Don't paste client names, tax file numbers or ledgers into any AI tool your firm hasn't approved for them. Which data can go where
Learning check
What would you do? Pick one; every answer is explained.
Step 4: Check the map against the ATO and TPB rules
Your task make sure your engagement letter covers AI use and your privacy policy mentions it, and get professional advice on how tax file numbers and other restricted data are handled.
You said you already have this covered. Skim this step, or skip to the next.
The map has to survive three sets of rules.
The TPB Code. TPB(GS) 55/2026, issued 22 July 2026, says practitioners must get permission from each client before divulging client information to a third party, “which can include entering client information into AI models and tools, depending on how these tools are configured and used.” It recommends telling clients where data will be stored and whether AI may be used, and accepts a signed engagement letter as permission. Hence “with permission” across tier 3. It also asks practitioners to verify AI output and document the checks, feeding the quality management system section 40 of the Determination requires.
TFNs and ATO data. The TPB adds that where client information involves TFNs, obligations under the Privacy (Tax File Number) Rule 2015 apply, and tells practitioners to get their own advice. Any connector that pulls ATO data will almost certainly bring TFNs with it, which is why that square says “after advice”. Our piece on connecting ATO data to AI tools safely goes deeper. One rule we add for every column: no AI tool, browser agent or connector service is ever handed a staff member’s myID or ATO online services login. Ask any ATO data service how it reaches the ATO, in writing.
The Privacy Act. The OAIC’s guidance on commercially available AI products (October 2024, updated January 2025) recommends, as best practice, that organisations “do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.” From 10 December 2026, new APP 1 rules require privacy policies to describe certain automated decisions that significantly affect individuals; most firms’ AI use will not reach that bar. Small businesses with turnover of $3 million or less are generally outside the APPs unless an exception applies, but the TPB Code applies to every registered agent regardless.
Source of truth: the TPB guidance statement and the OAIC guidance. This is journalism, not legal advice; take your firm’s position to your professional body or adviser.
Done when: your engagement letter covers AI use (our AI clause for Australian engagement letters has wording), your privacy policy mentions it, and the restricted row has been through an adviser.
Start step 4 with AI
Uses your answers from About your firm.
I run [an accounting or bookkeeping practice] in [country]. Draft two short pieces for us to review, and mark each clearly as a draft for review by our professional body or adviser, not advice: 1. An engagement letter clause telling clients we may use AI tools to prepare parts of their work, where their data is stored, that a qualified person reviews all AI output and stays responsible for it, and asking for their permission. 2. One paragraph for our privacy policy describing how we use AI tools with client information. Our approved AI tools: [AI tools in use]. Then list the questions I should take to an adviser about tax file numbers and any connector that pulls tax authority data.I run {practice} in {country}. Draft two short pieces for us to review, and mark each clearly as a draft for review by our professional body or adviser, not advice: 1. An engagement letter clause telling clients we may use AI tools to prepare parts of their work, where their data is stored, that a qualified person reviews all AI output and stays responsible for it, and asking for their permission. 2. One paragraph for our privacy policy describing how we use AI tools with client information. Our approved AI tools: {ai}. Then list the questions I should take to an adviser about tax file numbers and any connector that pulls tax authority data.
Works without client data. Don't paste client names, tax file numbers or ledgers into any AI tool your firm hasn't approved for them. Which data can go where
Learning check
What would you do? Pick one; every answer is explained.
Step 5: Put it on one page and run it
Your task fill in the gaps in a one-page client data rule sheet, walk the team through it in one meeting, and book a review in six months.
You said you already have this covered. Skim this step, or skip to the next.
Copy the sheet below, fill the brackets and walk the team through it in one meeting. If you have no full AI policy yet, our one-page AI policy guide covers approvals, review and disclosure; this sheet becomes its data section. For the tools themselves, see our AI for accounting firms hub.
So when there’s a question about data security, my answer is: build your AI policy.
[Firm name]: client data and AI. Version [date]. Owner: [name].
Our tiers. 0 Public. 1 Internal (no client information). 2 De-identified client facts. 3 Identified client data, including ATO data. 4 Restricted: TFNs and other government identifiers, bank and card numbers, credentials, sensitive and privileged information.
Our approved tools. Business plans: [list accounts]. Connected tools: [list connectors, each read-only unless [name] approves write access in writing]. Local tools: [list, or “none”]. Anything not listed is a consumer tool.
- Consumer tools take tier 0 and 1 only. Never client information, even with the name removed.
- Tier 3 goes only into approved business, connected or local tools, and only for clients whose engagement letter covers AI.
- Tier 4 never goes into any AI tool by hand. Connected tools that may carry TFNs are approved by [name] after advice.
- No AI tool or service is given anyone’s myID, ATO online services login or other credentials.
- Every AI output used in client work is checked by a qualified person, who notes the check on the job.
- Pasted something into the wrong place? Tell [name] the same day. No blame for reporting; we check whether it is a notifiable breach.
Reviewed every six months, and whenever a vendor changes its terms or we add a tool.
Done when: every team member has read the sheet and said so in writing, and the six-month review is in the calendar.
Start step 5 with AI
Uses your answers from About your firm.
Help me write our one-page rule sheet on client data and AI, then plan the team meeting. Firm: [firm name]. Owner: [name]. We are [an accounting or bookkeeping practice] in [country] with [how many] people. Approved AI tools: [AI tools in use]. The sheet should cover, in plain language: - Our five data tiers (0 public, 1 internal, 2 de-identified, 3 identified, 4 restricted) - Our approved tools by kind; anything not listed counts as a consumer tool - Consumer tools take tier 0 and 1 only - Tier 3 only in approved tools, and only for clients whose engagement letter covers AI - Tier 4 never goes into any AI tool by hand - No AI tool or service is given anyone's government or tax authority login or other credentials - Every AI output used in client work is checked by a qualified person, who notes the check - Pasted something into the wrong place? Tell [name] the same day, no blame - Reviewed every six months, and when a vendor changes its terms Keep it to one page. Then give me a 30-minute agenda to walk the team through it and a one-line sign-off they can reply with.Help me write our one-page rule sheet on client data and AI, then plan the team meeting. Firm: [firm name]. Owner: [name]. We are {practice} in {country} with {team} people. Approved AI tools: {ai}. The sheet should cover, in plain language: - Our five data tiers (0 public, 1 internal, 2 de-identified, 3 identified, 4 restricted) - Our approved tools by kind; anything not listed counts as a consumer tool - Consumer tools take tier 0 and 1 only - Tier 3 only in approved tools, and only for clients whose engagement letter covers AI - Tier 4 never goes into any AI tool by hand - No AI tool or service is given anyone's government or tax authority login or other credentials - Every AI output used in client work is checked by a qualified person, who notes the check - Pasted something into the wrong place? Tell [name] the same day, no blame - Reviewed every six months, and when a vendor changes its terms Keep it to one page. Then give me a 30-minute agenda to walk the team through it and a one-line sign-off they can reply with.
Works without client data. Don't paste client names, tax file numbers or ledgers into any AI tool your firm hasn't approved for them. Which data can go where
Learning check
What would you do? Pick one; every answer is explained.
For UK and US readers
The map travels; the rules change. In the UK, start with the ICO’s guidance on AI and data protection and your professional body’s confidentiality rules. In the US, IRS Publication 4557 (Safeguarding Taxpayer Data) and Publication 5708 help tax practices write the written information security plan the FTC Safeguards Rule expects, and IRC section 7216 governs disclosure of tax return information.
Free to join
Join The Firm free to read the rest
Members get every playbook in full, plus free templates, downloads and tools across the site. Join more than 35,000 accounting professionals. All it takes is your email.
Where we could be wrong
The assumption most likely to be wrong is that business plans stay safe for tier 3 data. Vendor terms change quietly, and we relied on terms checked as at July 2026 rather than re-reading every contract this month. Check yours before you sign the map.
We could not confirm how the TPB’s permission requirement applies to each configuration; the TPB leaves that to how tools are “configured and used”, so our map takes the cautious reading. And we read the 10 December 2026 privacy policy rules (Privacy and Other Legislation Amendment Act 2024) through OAIC resources and law firm summaries, not against a real firm’s AI use.
Frequently asked questions
Is de-identified client data safe to put in a free chatbot?
Our map says no. Removing a name is quick; removing everything that identifies a client (a niche industry, a town, a director’s surname in an email footer) is slow, and nobody does it carefully at 5pm.
Do I need client permission if the tool does not train on our data?
No-training terms reduce the risk but, on the TPB’s wording, do not settle the question. The fix is an engagement letter clause covering AI use, for new clients at onboarding and existing ones at renewal.
Where do ATO data connectors sit on the map?
Connected tools, at tier 3 at least and tier 4 wherever TFNs come through: read-only access, a check of how the service reaches the ATO, client permission and TFN Rule advice before switch-on.
What if a team member has already pasted client data into a consumer account?
Treat it as a near miss, not a disciplinary matter, or the next one gets hidden. Find out what went in, delete the history where the tool allows, and assess it under the Notifiable Data Breaches scheme, with advice if identifiers were involved.
How often should the map change?
Every six months, and whenever a vendor changes terms, you add a connector or a regulator issues guidance.
Your one-page summary
Your answers, choices and decisions, on one page
Sponsored
AI PolicyClient DataData SecurityPrivacyTax Practitioners BoardPlaybook
Get the editable AI client data rule sheet Download the AI client data rule sheet
The Word document (.docx), ready to fill in. Your profile unlocks every template on The Firm.
Or build it with AI
Open Claude or ChatGPT with the prompt filled in. It writes the finished document for your firm straight away, then asks a few questions to tailor it. No client data needed.
Works without client data. Don't paste client names, tax file numbers or ledgers into an AI tool your firm hasn't approved for them. AI data safety playbook.
