TPB Code confidentiality vs the Privacy Act: what tax agents must know
Item 6 of the TPB Code of Professional Conduct, s 30-10(6) of the Tax Agent Services Act 2009 (Cth), is a confidentiality duty: unless you have a legal duty to do so, a registered tax agent or BAS agent must not disclose any information relating to a client's affairs to a third party without the client's permission. It is enforced by the Tax Practitioners Board and is separate from the Privacy Act. You comply with both, because the TFN Rule and the Notifiable Data Breaches scheme sit under the Privacy Act, administered by the OAIC.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
Two duties, two regulators
Registered tax agents carry two confidentiality-and-privacy obligations that are easy to blur together but are legally distinct:
- The TPB Code of Professional Conduct, set out in s 30-10 of the Tax Agent Services Act 2009 (Cth), is a professional-conduct duty. It applies to you if you are a registered tax agent or BAS agent (s 30-5), and it is administered and enforced by the Tax Practitioners Board (TPB).
- The Privacy Act 1988 (Cth), including the Privacy (Tax File Number) Rule 2015 and the Notifiable Data Breaches (NDB) scheme, is administered by the Office of the Australian Information Commissioner (OAIC).
They cover related ground, but they are different obligations, with different tests, different remedies and different regulators. Meeting one does not automatically satisfy the other. The TPB does not administer the Privacy Act or the data-breach scheme, and the OAIC does not enforce the Code of Professional Conduct.
What item 6 of the TPB Code requires
Under item 6 of the Code of Professional Conduct, which is s 30-10(6) of the Tax Agent Services Act 2009 (Cth), unless you have a legal duty to do so you must not disclose any information relating to a client's affairs to a third party without your client's permission. It is a confidentiality obligation you owe as a registered tax agent or BAS agent (s 30-5), and a breach is a matter for the TPB. After an investigation, s 30-15(2) lets the Board give a written caution, make an order under s 30-20 (which can require further education or supervision, or limit the services you provide), suspend your registration under s 30-25, or terminate it under s 30-30.
The Code addresses your professional conduct: keeping client affairs confidential, acting honestly and with integrity, and managing conflicts. It is not framed as a data-security or data-breach regime, and neither the Code nor the 2024 Determination contains a data-breach notification scheme. The Act does carry a reporting duty of its own, but it points at Code breaches and at the Board, not at data breaches: under s 30-35(1)(ba) you must notify the TPB in writing if you have reasonable grounds to believe you have committed a significant breach of the Code, within 30 days (s 30-35(4)(b)), and s 30-40 requires the same notification about another agent. Notifying a data breach is separate work, and it sits in the Privacy Act.
Item 6 sits at s 30-10(6) of the Tax Agent Services Act 2009 (Cth), under the "Confidentiality" heading in the Code of Professional Conduct, which runs from s 30-10(1) to s 30-10(17). The Code applies to registered tax agents and BAS agents (s 30-5), and the Minister may determine further obligations for the purposes of s 30-10(17) under s 30-12.
The 2024 Determination adds further conduct obligations
The Tax Agent Services (Code of Professional Conduct) Determination 2024 (registered 2 July 2024, commenced 1 August 2024) adds eight further obligations on top of the existing Code. It is made under s 30-12 of the Tax Agent Services Act 2009 (Cth) for the purposes of Code item 17. Under s 100(1) of the Determination, those obligations apply from 1 July 2025 for an agent with 100 employees or fewer as at 31 July 2024, and from 1 January 2025 for any other agent, with the employee count taken at practice or firm level (s 100(2)). Both dates have now passed. The Determination expands the conduct expectations the TPB enforces; it does not change who administers the Privacy Act. Confirm how the Determination applies to your firm through the TPB.
What the Privacy Act requires of you separately
The Privacy Act reaches your practice through the Privacy (Tax File Number) Rule 2015, a legally binding instrument made under s 17 of the Privacy Act. The TFN Rule binds every "TFN recipient", which covers a practice holding individual clients' TFN information, with no turnover threshold and no small-business exemption. It sets obligations for collecting, using, disclosing, storing, securing and destroying individuals' tax file number information, and for training staff.
A breach of the TFN Rule is an "interference with the privacy of an individual", so an affected person can complain to the OAIC, not the TPB. Separately, s 26WE(1)(d) brings a file number recipient into the NDB scheme in relation to tax file number information about individuals. Where you have reasonable grounds to suspect there may have been an eligible data breach you must assess it, and take all reasonable steps to complete that assessment within 30 days (s 26WH), and where the eligible data breach threshold is met you must notify the affected individuals and the OAIC. That applies even to a practice under A$3 million turnover. Read: your data-breach obligations under the NDB scheme.
At a glance: how the two regimes differ
| TPB Code of Professional Conduct | Privacy Act (TFN Rule + NDB) | |
|---|---|---|
| Regulator | Tax Practitioners Board (TPB) | Office of the Australian Information Commissioner (OAIC) |
| Nature of duty | Professional conduct and confidentiality | Data handling, security and breach notification |
| Core obligation | Item 6, s 30-10(6): absent a legal duty, do not disclose information relating to a client's affairs to a third party without the client's permission | Secure, use and destroy individuals' TFN information lawfully; assess and notify eligible TFN breaches |
| Turnover threshold | Applies to registered tax agents and BAS agents regardless of size (s 30-5) | TFN Rule binds TFN recipients with no small-business exemption |
| If breached | TPB investigation; s 30-15(2) caution, order, suspension or termination of registration | OAIC complaint; NDB notification duty for eligible TFN breaches |
Meeting one does not meet the other
This is the practical point. You can keep client affairs confidential and still fall short of the TFN Rule's security and destruction obligations. You can hold a privacy policy and still breach the Code by disclosing a client's affairs without permission. The regimes overlap in spirit, but they are enforced separately and tested differently.
Email is a good example of the two duties meeting on the same act. Your Code obligation under s 30-10(6) speaks to your professional handling of a client's information, while the TFN Rule governs the same disclosure as a privacy obligation. The Board also publishes guidance on confidentiality; check the current version on tpb.gov.au, because the Board renumbered its guidance series in 2026. Treating an unencrypted email of a client's TFN as a risk to control, rather than a routine default, helps you meet both at once. Read: can an accountant email a client's TFN?.
Privaproof is a privacy tool, so what it helps you build sits on the Privacy Act side: a privacy policy, collection notices, a TFN-handling policy and a data-breach plan for the TFN and financial data you hold. Privaproof does not make your firm "TPB compliant", and it does not assess your obligations under the Code. The TPB is the authority on the Code, and we point you to it rather than standing in for it.
Common questions
Is the TPB Code the same as the Privacy Act?
No. The TPB Code of Professional Conduct is a professional-conduct duty enforced by the Tax Practitioners Board. The Privacy Act, including the TFN Rule 2015 and the NDB scheme, is enforced by the OAIC. They cover related ground but are separate obligations with different regulators, and complying with one does not automatically satisfy the other.
If I keep client information confidential under the Code, am I covered for the Privacy Act too?
Not necessarily. Confidentiality under item 6, s 30-10(6), is about not disclosing information relating to a client's affairs to a third party without the client's permission, unless you have a legal duty to do so. The TFN Rule adds separate obligations to secure, limit the use of, and destroy individuals' TFN information, and to train staff, and the NDB scheme adds a duty to assess and notify eligible breaches. You can meet the Code and still fall short on these.
Which regulator handles a data breach involving TFNs?
The OAIC. A breach of the TFN Rule is an interference with privacy under the Privacy Act, and s 26WE(1)(d) brings a file number recipient holding individuals' tax file number information into the NDB scheme, which the OAIC administers. The TPB administers the Code of Professional Conduct, not the data-breach scheme. The Act does require you to notify the Board of a significant breach of the Code (s 30-35(1)(ba)), but that is a different duty about a different thing.
Does the 2024 Determination change my Privacy Act obligations?
No. The Tax Agent Services (Code of Professional Conduct) Determination 2024 adds eight further conduct obligations enforced by the TPB. Under s 100(1) of the Determination they apply from 1 January 2025 for larger firms and from 1 July 2025 for an agent with 100 employees or fewer as at 31 July 2024. It does not change who administers the Privacy Act or the substance of the TFN Rule and NDB scheme.
Keep reading
- Does the Privacy Act apply to accountants under $3 million?
- The TFN Rule 2015: what accountants must do
- Can an accountant email a client's TFN?
- Data-breach obligations for accountants handling TFNs
- Back to: Privacy Act compliance for accountants and bookkeepers
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. This page does not assess your obligations under the TPB Code of Professional Conduct, which are administered by the Tax Practitioners Board, and it does not make your firm "TPB compliant". The Privacy Act 1988 (Cth), the TFN Rule 2015, the TPB Code and the 2024 Determination change over time, so check you are working from a current version.