0622 Publ 4465-A (PDF)

Official source: IRS Forms, Instructions & Publications (https://www.irs.gov/pub/irs-pdf/p4465a.pdf), retrieved 2026-10-03. U.S. Government work (17 U.S.C. § 105).

---

Safeguarding federal tax information and information protected bythe Privacy Act is critically important. As a contractor for the Internal Revenue Service, you and your employees are responsible for protecting all federal tax returns and return information and information subject to the Privacy Act entrusted to you. Internal Revenue Code (IRC) Section (§)6103 sets out the requirements for protecting and for disclosing confidential returns and return information and the Privacy Act of 1974 applies to the requirements for protecting personal information and other information protected by the Privacy Act.

The law prohibits contractors from disclosing federal returns or return information unless allowed by statute. You and those who work for you have a responsibility to understand and apply the provisions of the law that relate to your job.

The General Rule – Tax Information Is Confidential! §6103 makes all returns and return information confidential. No one may access or disclose returns or return information unless specifically authorized by the IRC. A statutory exception, §6103(n), allows IRS to disclose federal returns and return information to contractors and their employees for tax administration purposes.

Definitions You Need to Know: Return - A return is any tax or information return, estimated tax declaration or refund claim (including amendments, supplements, supporting schedules, attachments or lists) required by law and filed with the IRS. Examples of returns include Forms 1040, 941, 1099, 1120 and W-2. They can be filed on paper or electronically. Refer to §6103(b) (1) for the statutory definition.

Return Information - The definition of return information is very broad. Refer to §6103(b)(2) for the statutory definition. Return information includes, but is not limited to:

★ Any other information, other than the taxpayer’s return, that IRS

obtained from any source or developed through any means that relates to any person’s liability under the IRC for any tax, penalty, interest, etc. ★ The taxpayer’s name, mailing address, identification

number (social security number or employer identification number) and other information from a return, including names of dependents or business location. ★ Information collected by the IRS about any person’s tax matters,

even if there are no identifiers like name, address and identification number. ★ Simply removing identifying information does not mean that what’s

and must be protected from unauthorized access or disclosure. ★ Information on transcripts of accounts. ★ The fact that a return was filed or fact of examination,

investigation or collection activity or information about someone’s tax balance. Important provisions in the law, in federal regulations, and in your contract: §6103(a) – Prohibits disclosure of returns and return information unless permitted by law. This provision specifically covers contractors.

§6103(b) – Defines terms used in the statute such as return, return information and tax administration.

§6103(n) – Allows disclosure of returns and return information to contractors and their employees, to the extent necessary, for purposes of tax administration. (Treasury Regulation §301.6103(n)-1 - Places certain limitations on disclosures to contractors.)

§6103(p)(4) – Sets out the safeguard requirements for protecting federal tax returns and return information.

§7513 - Authorizes the use contractors to process and reproduce film, photos and documents for tax purposes. (Treasury Regulation §301.7513-1 - Establishes safeguard requirements for contractors working with films or photo impressions.) Your contract with the IRS also contains information about your legal responsibilities for safeguarding information.

Penalties It is a crime for a contractor or contractor’s employee to knowingly and willfully disclose federal tax returns or return information to someone not authorized to receive it, or to access tax data without a business need to do so (known as UNAX).

Criminal Penalties:

Under §7213, willful unauthorized disclosure of returns or return information by a contractor or former contractor is a felony. The penalty is a maximum $5,000 fine and/or up to five years in jail plus the costs of prosecution.

Under §7213A, willful unauthorized access or inspection (UNAX) of taxpayer records by contractor or contractor employee is a misdemeanor. The penalty is a fine of up to $1,000 and/or one year in prison.

Civil Penalties:

Under §7431, any taxpayer whose return or return information has been knowingly or negligently inspected or disclosed by a contractor or contractor’s employee in violation of §6103 may sue for civil damages.

left is no longer return information. It remains return information

Penalties may include:

★ damages of $1,000 for each act of unauthorized access or disclosure, ★ or actual damages sustained, whichever is greater ★ punitive damages (in the case of willful or gross negligence) ★ costs of the action (which may include attorney’s fees) There is no liability under §7431 if the disclosure of the return or return information was the result of a good faith but mistaken interpretation of §6103.

Other Sensitive IRS Data Some contractors may have access to IRS records covered by the Privacy Act or access to Sensitive But Unclassified (SBU) information. SBU information includes information once labeled Official Use Only (OUO) or Limited OUO.

A new naming convention is planned for the future where SBU data will be referred to as Controlled Unclassified Information (CUI). Regardless of its designation, SBU data is protected by law. Unauthorized disclosure is subject to penalties under Title 18 of the United States Code §§641 and 3571.

Privacy Act protected information cannot be disclosed without the authority to do so. The routine use provision of Title 5 of the United States Code, §552a(b)(3), allows the disclosure of Privacy Act protected records to contractors. The published system of records notice must include language allowing contractors access to information in that system. Criminal penalties for Privacy Act violations are found in the law at Title 5 of the United States Code, §552a(i).

Resources for Safeguarding Tax Information Publication 4812 - is a “layperson’s guide” to NIST SP 800-53 when access to IRS information or information systems under contracts for services on behalf of the IRS is outside of IRS controlled facilities or the direct control of the Service.

Internal Revenue Manual 10.8.1 - Information Technology (IT) Security, Policy and Guidance - applies when contractors are accessing IRS information and information systems at government controlled facilities.

Avoid Unauthorized Disclosure – Follow These Tips: Safeguard confidential tax information, records protected by the Privacy Act and SBU material regardless of its format, be it electronic (hard drive, tape, disk, or other portable storage device), recorded (video or audio), in databases or on paper:

★ Always follow appropriate physical and information security

guidelines.

Incident/Data Breach Reporting A security incident as defined by OMB M-17-12 is an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

A data breach is the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for another than authorized purpose.

Report incidents and data breaches in any medium or form, including paper, oral, and electronic, immediately upon discovery.

Report all Security and Privacy incidents related to IRS processing, SBU data, or contractor information systems, immediately upon discovery, to the CO and COR, and the Computer Security Incident Response Center (CSIRC) Operations Team at (240) 613-3606.

If the incident/data breach involves returns, or return information, or threatens the safety or security of personnel or information systems, or involves a willful, unauthorized disclosure, the COR will report the incident/data breach to the Treasury Inspector General for Tax Administration (TIGTA) hotline at (800) 366-4484.

★ Observe the clean desk policy. Don’t leave confidential infor

mation on your desk or on computer screens when you are away. ★ Protect laptop computers and removable media that contain

sensitive tax information. ★ Don’t discuss confidential federal tax matters with others unless

they have a need to know for tax administration purposes. Don’t discuss confidential tax matters on coffee breaks, at home or outside the office. ★ Prepare all correspondence carefully. Completely over-write

the information added to any pattern letters you use. Review all correspondence before sending to ensure that the text and all enclosed materials (reports, attachments, schedules, and other inserts) are intended for the recipient. ★ Use double sealed envelopes when mailing confidential tax infor

mation or take other precautions to prevent viewing of actual content. ★ Use a document receipt to verify that confidential material has

been properly received when information is mailed or hand carried. ★ Dispose of confidential tax information appropriately, whether on

paper or digital media.

IRS Cybersecurity i s responsible for all safeguard reviews of contractors and contractor compliance, with Facilities Management and Security Services (FMSS).

IRS Contracting Officer’s Representative (COR) is the functional liaison primarily responsible for executing the contract and communicating with the contractor.

IRS Disclosure provides technical guidance and support about Disclosure questions and disclosure law and policy.

Publication 4465-A (Rev. 6-2022) Catalog Number 40149Q Department of Treasury Internal Revenue Service www.irs.gov