The shift to remote work has done something unexpected to the accounting profession. It hasn’t just changed where tax returns get prepared — it’s quietly turned every home office into a compliance liability that most practitioners didn’t sign up for. The same laptop that opens a client’s multi-state tax filing also streams movies, processes personal email, and lets a family member browse the web. That overlap was manageable when office networks and IT departments created a clear boundary. For remote accountants, that boundary has essentially dissolved.
The question isn’t whether your home setup meets last year’s security checklist. It’s whether you’re tracking which state laws now apply to the data sitting on your hard drive, what professional standards expect you to do about it, and how the devices you use every day create exposure you might not see until it’s too late.
Accounting compliance
Remote work security
State privacy laws
This post contains affiliate links.
The Data That Moves Through Your Home Network
Accounting firms handle more sensitive data per transaction than most industries. Tax returns contain Social Security numbers, income details, payroll data, R&D documentation, financial statements, and tax basis records that span years. Many firms retain decades of archived filings, workpapers, and financial snapshots — often stored on file servers with unlabeled folders and outdated backups.
When that data lives on a device that also serves as a family entertainment hub, the risk profile changes. PracticeProtect, an industry blog focused on accounting risk, describes this as “one device, many lives” — the same laptop used for client tax preparation and bank portal access in the morning becomes the evening Netflix machine. Browser extensions, misconfigured personal cloud sync, or a family member’s app can create a silent exfiltration path that no office-based security policy anticipated. The privacy risks that emerge when work and personal life share the same endpoint are often invisible until something goes wrong.
The Australian Cyber Security Centre’s 2023-24 annual assessment found that business email compromise, credential theft, and social engineering remain dominant incident types. Those threats exploit human patterns — weak passwords, reused credentials, predictable mistakes — that become harder to control when work and personal life share the same machine.
State Laws Are Changing Faster Than Most Firms Can Track
There’s no single national US privacy standard equivalent to the GDPR. Instead, a patchwork of state laws — California’s CCPA and CPRA, Virginia, Colorado, Utah, Texas, Montana, and more — keeps expanding, each with its own thresholds, exceptions, and breach notification timelines.
For accounting firms, the exposure is structural. Even a small practice gets pulled under a state privacy umbrella if any client interacts with residents of a strict-law state. Multi-state firms manage what TaxRobot, a tax-technology resource, calls “exponential complexity” — fifty different jurisdictional rules that shift yearly.
The practical complication: firms that rely solely on federal rules like the Gramm-Leach-Bliley Act or IRS Publication 4557 can develop significant compliance blind spots. GLBA exemption doesn’t mean exemption from California or Colorado law if you meet their thresholds. A firm that believes it’s covered by federal standards may discover it’s not when a state regulator comes calling. The privacy measures every remote worker should follow at minimum must account for the jurisdiction where each client resides.
State laws also demand specificity that many firm privacy policies don’t deliver. They require clear answers on what data is collected, why, where it’s stored, who accesses it, and whether AI tools or third-party vendors process it. Boilerplate language no longer suffices.
State privacy laws make infinite data retention a liability. Firms must walk the line between IRS retention mandates and privacy law deletion requirements — a tension that requires active management rather than a set-it-and-forget-it approach. Long-term projects like R&D tax credits, basis tracking, and multi-year audits complicate the timeline further.
What Professional Standards Now Expect
The AICPA revised its Statements on Standards for Tax Services effective January 1, 2024, adding Section 1.3 on data protection. The standard requires “reasonable efforts to safeguard taxpayer data” — language intentionally broad to accommodate firm size differences, technology changes, and evolving threats. But broad doesn’t mean vague.
A sole practitioner’s plan will look different from a 100-member firm’s, but basic expectations hold across both: virus-scanning software, VPN, secure software, strong passwords. Beyond that, the standard expects firms to avoid unnecessary data storage, mask personally identifiable data where possible, and establish data privacy training programs. Data security basics for remote employees have moved from optional to expected.
The Gramm-Leach-Bliley Act Safeguards Rule applies to all tax return preparation firms regardless of size. It requires a written information security plan (WISP) describing how the business protects nonpublic personal information. The IRS now asks preparers to verify WISP existence during PTIN application and renewal. According to The Tax Adviser, there are anecdotal reports of IRS agents proposing fines during CPA audits for missing WISP documentation.
IRS Publication 4557 provides the detailed guide on administrative, technical, and physical security measures. Non-compliance can mean fines or revocation of the right to practice.
The Privacy Scenarios That Actually Play Out
A 2023 survey of 214 US-based WFH workers published on arXiv found that 93.9% had experienced at least one privacy-invasive scenario during a remote work call. The scenarios ranged from a household member’s voice being picked up by the mic to sensitive data visible on a shared screen.
The study’s findings map directly onto accounting work. The two scenarios that caused the highest discomfort were autonomy-related — being unable to stop the camera or mic during an urgent private moment. Over 80% of those who experienced these scenarios reported discomfort. Yet these were also the least experienced scenarios, suggesting that when employers mandate always-on camera or mic policies, the psychological cost is high.
Data scenarios — computer data or browsing data inadvertently displayed on a shared screen — caused discomfort in about half of those who experienced them. For an accountant screen-sharing a client’s tax return or financial statement, the risk is not hypothetical. Handling client data with care in a remote setting means knowing exactly what’s visible before you share your screen.
Most uncomfortable experiences (74.3%) did not escalate to harm, according to the study. When harm did occur, it was almost always minor and psychological. But the study also found that workers violated or would violate employer rules to protect their privacy — 41.2% turned off the camera when prohibited, 38.8% turned off the mic. That creates a tension between compliance with firm policy and personal privacy protection that no written policy alone can resolve.
Open-ended responses in the same study revealed a recurring theme: the home feels violated when personal space is broadcast without control. For accountants who already spend their days inside other people’s financial lives, losing control over their own physical environment adds a layer of strain that technical fixes alone don’t address.
Practical Moves That Reduce Exposure
The same study found that manual protective measures were far more common than smart ones. Covering the camera or muting the mic happened more often than using virtual backgrounds or noise cancellation. For data, 41.6% of workers used manual measures like closing tabs or using a separate browser, while only 8.4% used smart measures like screen-sharing a specific window or disabling notifications.
The gap suggests that many workers don’t know about available features, find them inconvenient, or face employer restrictions on using them. That’s a solvable problem.
For accounting firms specifically, automation reduces the manual touchpoints that create risk. Structured cloud-based workflows for tax basis tracking, R&D credit documentation, and financial record intake limit human error — the number-one cause of data incidents according to industry guidance. Wrong document sent, wrong folder upload, wrong storage location — these are the errors that state privacy laws penalize regardless of intent. Data loss prevention tools can help contain those errors before they become incidents.
Encryption, VPNs, and multi-factor authentication are baseline, not optional. A reliable VPN like ExpressVPN secures the connection between your home network and firm systems, and antivirus protection like Bitdefender covers the endpoint itself. But the practical step that matters most may be the least technical: knowing exactly what data you hold, where it lives, and how long you keep it.
- Map every device that touches client data — including personal phones and tablets
- Verify your WISP exists and matches how work actually happens from home
- Enable screen-share controls that show only the active window, not the full desktop
- Run a retention audit: what data are you holding that you no longer need?
- Test your incident response plan with a realistic remote-work scenario
Why Integration Changes the Equation
The security industry has spent years selling point solutions — MFA here, endpoint detection there, a separate tool for device management. The result is a collection of bolt-on controls that don’t talk to each other.
For accounting firms, the real shift is toward unified platforms where identity systems, endpoint tools, access controls, and compliance documentation operate as a coherent system rather than disconnected products. When an employee leaves, access revocation happens instantly across all systems rather than becoming a multi-day IT project. When device posture changes, access policies adjust automatically.
This matters because the old boundary — the office network — no longer exists. Access now initiates from home Wi-Fi, cafés, airport lounges. The common denominator is identity, not network location. Zero Trust isn’t a marketing slogan; it’s the operational logic that matches how work actually happens. Two-factor authentication is one piece of that identity-based approach, but it works best when integrated with device posture checks and access policies.
The Australian Cyber Security Centre and Gartner both describe the move from implicit “inside” trust to identity-and-context verification for every session. For accounting firms meeting regulatory obligations, this means audit trails, compliance documentation, and access controls must work together rather than in isolation. Cloud storage best practices become part of a larger architecture where every access request is verified, every session is logged, and every device is known.
Technology alone isn’t enough. Staff training on privacy obligations needs to be ongoing, specific, and practical. Regular internal audits ensure that policies match real-world workflows. But the architecture that supports those efforts — integrated, identity-based, continuously verified — is what turns compliance from a checklist into a capability.
◈
The data privacy demands on remote accountants aren’t going to ease. State laws will keep multiplying. Professional standards will keep tightening. The devices in your home will keep serving both work and life simultaneously.
What’s within your control is the structure you put around that reality — knowing what data you hold, securing the endpoints that touch it, and building workflows that reduce the manual handling where mistakes happen. None of it guarantees perfect privacy. But it describes what’s reasonable to expect from a profession that handles other people’s most sensitive financial information, from a home office, every single day.
That’s the standard worth meeting.