TPB Code confidentiality vs the Privacy Act: what tax agents must know
Item 6 of the TPB Code of Professional Conduct is a confidentiality duty: absent a legal duty, a registered tax agent must not disclose a client's information to a third party without the client's permission. It is enforced by the Tax Practitioners Board and is separate from the Privacy Act. You comply with both, because the TFN Rule and the Notifiable Data Breaches scheme sit under the Privacy Act, administered by the OAIC.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
Two duties, two regulators
Registered tax agents carry two confidentiality-and-privacy obligations that are easy to blur together but are legally distinct:
- The TPB Code of Professional Conduct is a professional-conduct duty. It is administered and enforced by the Tax Practitioners Board (TPB) under the Tax Agent Services regime.
- The Privacy Act 1988 (Cth), including the Privacy (Tax File Number) Rule 2015 and the Notifiable Data Breaches (NDB) scheme, is administered by the Office of the Australian Information Commissioner (OAIC).
They cover related ground, but they are different obligations, with different tests, different remedies and different regulators. Meeting one does not automatically satisfy the other. The TPB does not administer the Privacy Act or the data-breach scheme, and the OAIC does not enforce the Code of Professional Conduct.
What item 6 of the TPB Code requires
Under item 6 of the Code of Professional Conduct, unless you have a legal duty to disclose, you must not disclose any information relating to a client's affairs to a third party without the client's permission. It is a confidentiality obligation you owe as a registered tax agent, and a breach is a matter for the TPB, which can investigate and impose sanctions ranging from a caution through to conditions on, suspension of, or termination of your registration.
The Code addresses your professional conduct: keeping client affairs confidential, acting honestly and with integrity, and managing conflicts. It is not framed as a data-security or data-breach regime. That is where the Privacy Act does separate work.
*The Code of Professional Conduct sits in the Tax Agent Services Act 2009; the exact statutory location of item 6 is not pinned in our locked sources, so we refer to "item 6 of the Code" and do not print a section pinpoint.
The 2024 Determination adds further conduct obligations
The Tax Agent Services (Code of Professional Conduct) Determination 2024 (registered 2 July 2024) adds further obligations on top of the existing Code. Its obligations commenced on 1 January 2025 for firms with more than 100 employees and on 1 July 2025 for firms with 100 or fewer employees. The Determination expands the conduct expectations the TPB enforces; it does not change who administers the Privacy Act. Confirm how the Determination applies to your firm through the TPB.
What the Privacy Act requires of you separately
The Privacy Act reaches your practice through the Privacy (Tax File Number) Rule 2015, a legally binding instrument made under s 17 of the Privacy Act. The TFN Rule binds every "TFN recipient", which covers a practice holding clients' TFN information, with no turnover threshold and no small-business exemption. It sets obligations for collecting, using, disclosing, storing, securing and destroying individuals' tax file number information, and for training staff.
A breach of the TFN Rule is an "interference with the privacy of an individual", so an affected person can complain to the OAIC, not the TPB. Separately, under the NDB scheme (s 26WE(1)(d)), an eligible data breach involving TFN information must be assessed and, where the threshold is met, notified to affected individuals and the OAIC, even for a practice under A$3 million turnover. Read: your data-breach obligations under the NDB scheme.
At a glance: how the two regimes differ
| TPB Code of Professional Conduct | Privacy Act (TFN Rule + NDB) | |
|---|---|---|
| Regulator | Tax Practitioners Board (TPB) | Office of the Australian Information Commissioner (OAIC) |
| Nature of duty | Professional conduct and confidentiality | Data handling, security and breach notification |
| Core obligation | Item 6: do not disclose client information to a third party without permission, absent a legal duty | Secure, use and destroy individuals' TFN information lawfully; assess and notify eligible TFN breaches |
| Turnover threshold | Applies to registered tax agents regardless of size | TFN Rule binds TFN recipients with no small-business exemption |
| If breached | TPB investigation; sanctions up to termination of registration | OAIC complaint; NDB notification duty for eligible TFN breaches |
Meeting one does not meet the other
This is the practical point. You can keep client affairs confidential and still fall short of the TFN Rule's security and destruction obligations. You can hold a privacy policy and still breach the Code by disclosing a client's affairs without permission. The regimes overlap in spirit, but they are enforced separately and tested differently.
Email is a good example of the two duties meeting on the same act. TPB guidance on tax file numbers in email (TPB(PN) 4/2021) speaks to your professional handling of TFNs, while the TFN Rule governs the same disclosure as a privacy obligation. Treating an unencrypted email of a client's TFN as a risk to control, rather than a routine default, helps you meet both at once. Read: can an accountant email a client's TFN?.
Privaproof is a privacy tool, so what it helps you build sits on the Privacy Act side: a privacy policy, collection notices, a TFN-handling policy and a data-breach plan for the TFN and financial data you hold. Privaproof does not make your firm "TPB compliant", and it does not assess your obligations under the Code. The TPB is the authority on the Code, and we point you to it rather than standing in for it.
Common questions
Is the TPB Code the same as the Privacy Act?
No. The TPB Code of Professional Conduct is a professional-conduct duty enforced by the Tax Practitioners Board. The Privacy Act, including the TFN Rule 2015 and the NDB scheme, is enforced by the OAIC. They cover related ground but are separate obligations with different regulators, and complying with one does not automatically satisfy the other.
If I keep client information confidential under the Code, am I covered for the Privacy Act too?
Not necessarily. Confidentiality under item 6 is about not disclosing a client's affairs without permission. The TFN Rule adds separate obligations to secure, limit the use of, and destroy individuals' TFN information, and the NDB scheme adds a duty to assess and notify eligible breaches. You can meet the Code and still fall short on these.
Which regulator handles a data breach involving TFNs?
The OAIC. A breach of the TFN Rule is an interference with privacy under the Privacy Act, and an eligible data breach involving TFN information triggers the NDB scheme, which the OAIC administers. The TPB administers the Code of Professional Conduct, not the data-breach scheme.
Does the 2024 Determination change my Privacy Act obligations?
No. The Tax Agent Services (Code of Professional Conduct) Determination 2024 adds further conduct obligations enforced by the TPB, phased in from 1 January 2025 for larger firms and 1 July 2025 for firms with 100 or fewer employees. It does not change who administers the Privacy Act or the substance of the TFN Rule and NDB scheme.
Keep reading
- Does the Privacy Act apply to accountants under $3 million?
- The Privacy (Tax File Number) Rule 2015: what accountants must do
- Can an accountant email a client's TFN?
- Data-breach obligations for accountants handling TFNs
- Back to: Privacy Act compliance for accountants and bookkeepers
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. This page does not assess your obligations under the TPB Code of Professional Conduct, which are administered by the Tax Practitioners Board, and it does not make your firm "TPB compliant". Privaproof's accountant documents are self-authored and are not independently reviewed by a solicitor. The Privacy Act 1988 (Cth), the TFN Rule 2015, the TPB Code and the 2024 Determination change over time, so check you are working from a current version.