The 30-Day Breach Notification Rule: What Accounting Firms Must Report to the FTC

The FTC breach notification rule gives accounting firms, tax preparers, and other non-bank financial institutions a hard deadline. If unencrypted customer information involving 500 or more people is acquired without authorization, the firm must report it to the Federal Trade Commission as soon as possible, and no later than 30 days after discovering it. The requirement was added to the FTC Safeguards Rule and has applied since May 2024. Thirty days sounds like plenty of time until you are inside one, trying to work out what happened, how many clients are affected, and who needs to know. The firms that meet the deadline calmly are the ones that decided how they would handle it before anything went wrong.

Not every security incident triggers an FTC report. The rule applies to a “notification event,” defined in 16 CFR 314.2(m), and three questions decide whether you have one. Two details in that definition matter more than they first appear: access can count as acquisition, and encrypted data can count as unencrypted.

Be careful with a “no,” especially on the first question. The presumption puts the burden on the firm: if someone reached unencrypted client data, the rule assumes it was acquired unless you can show otherwise with reliable evidence, such as logs showing what was and was not accessed. Without that evidence, the safer assumption is that the event counts and the clock is running. A real “no” also does not end your obligations, because state breach laws have their own triggers and your written security plan still calls for a response.

The clock starts on discovery, and the rule defines that broadly: the first day the event is known to anyone at the firm, an employee, officer, or agent, other than the person who caused it. It does not wait until the partners hear about it or the investigation is finished. If a staff member notices something on a Monday and mentions it the following week, the clock may already have been running for a week. That is the main reason to make reporting suspicious activity internally a fast, simple habit.

The timing and contents are set out in 16 CFR 314.4(j), and the report is filed through an online form on the FTC’s website. It asks for the firm’s name and contact information, the types of information involved, the date or date range of the event if it can be determined, the number of people affected, and a general description of what happened. Two details catch firms off guard. First, the FTC says reports may be made public, unless law enforcement has asked for publication to be delayed. Second, a third party such as an attorney or a service provider may file on the firm’s behalf, which is worth deciding in advance rather than in the middle of an incident.

The rule also does not require you to notify the affected clients themselves. That surprises people, but it rarely changes the outcome, because most state breach laws do require individual notice, often on their own timelines. Plan for both.

The work that makes the deadline manageable happens before an incident. Add the FTC reporting step to your incident response plan, with a named person responsible for deciding whether an event counts and for filing the report. Keep a current inventory of where client data lives, because “how many people were affected” is impossible to answer quickly if nobody knows which systems hold what. Keep access logs that would let you show what an intruder did and did not reach, since reliable evidence is what rebuts the presumption of acquisition. Encrypt the data you can, and protect the keys separately, since encryption only helps when the key was not exposed. And agree with your IT provider or host, in writing, how quickly they will tell you about an incident that affects your data, since your clock can be running while they investigate. We cover the broader program in our guide to the FTC Safeguards Rule for accounting firms.

This article is general information, not legal advice. Breach obligations depend on the facts and on state law; confirm your obligations with qualified counsel. The FTC’s announcement of the requirement is available on its website.