Treat client records as a regulated operating system, not a folder to copy at settlement. Before buying an accounting practice, establish which records exist, who owns or controls them, why they may be disclosed, where every copy sits, how access is secured and whether the buyer can retrieve a complete, usable file without inheriting an unmeasured privacy or cyber problem.

The answer depends on the transaction structure, the services provided, the entities involved and the terms agreed with clients. A buyer should therefore combine privacy and transaction advice with hands-on testing of records and controls. A clean-looking client list does not prove lawful disclosure, complete workpapers or a secure transfer.

Define the records perimeter

Build an inventory before sampling files. Include practice-management records, tax and BAS workpapers, correspondence, identification-check records, signed authorities, portals, email archives, paper files, scanned documents, backups, former-client files and data held by software or outsourced providers. For each repository, record:

  • the legal entity that holds it and the business purpose for which it is held;
  • the client population, information types and approximate age of records;
  • storage location, administrator, users and access method;
  • retention rule, disposal process and any legal hold;
  • vendor, hosting country, contract and export method; and
  • whether it is proposed to transfer, remain with the seller or be deleted.

Distinguish a share acquisition, where the entity holding information may remain the same, from an asset or client-book transaction that may disclose information to another entity. The OAIC says privacy obligations can apply throughout a business sale and advises vendors to consider de-identification, limited data-room access and contractual control; prospective purchasers should generally avoid collecting personal information where possible (OAIC). Have a privacy lawyer apply that guidance to the actual deal rather than assuming client records automatically follow revenue.

Request evidence, not assurances

Ask for a coherent evidence pack covering:

  • privacy policy, collection notices, engagement terms, client permissions and record-release procedures;
  • data map, record register, retention schedule and destruction logs;
  • user and privileged-access lists, multi-factor authentication settings and recent access reviews;
  • software inventory, patching reports, endpoint protection, encryption and device-management controls;
  • backup scope, frequency, isolation and restoration-test results;
  • cyber insurance, security assessments, penetration tests and unresolved remediation;
  • incident, complaint and data-breach registers, including root-cause and closure evidence;
  • service-provider contracts, data locations, subprocessors and exit/deletion terms; and
  • the proposed client-consent, communication, export, import and seller-access plan.

Reconcile policies to live settings. Select a small, risk-based sample covering a current recurring client, a former client, a client with several entities, a complex advice matter and a file touched by an external provider. Trace each from engagement and identity checking through workpapers, advice, lodgement, billing, retention and any archive. Record missing items, duplicate repositories, excessive access and data that cannot be exported in a usable form.

Test record quality and custody

For registered tax practitioners, the TPB says section 30 of the Tax Agent Services (Code of Professional Conduct) Determination 2024 requires proper records of services provided to clients and former clients. Records must be retained for at least five years after the service is provided and show the service’s nature, scope and outcome, information considered, and advice received and given; more complex matters require relevant facts, assumptions and reasoning (TPB).

Do not confuse a five-year minimum for particular tax-service records with permission to dispose of everything else at five years. Different taxation, corporations, employment, limitation, insurance and professional requirements may apply. Conversely, indefinite retention creates risk. Where APP 11 applies, an entity must take reasonable steps to protect personal information and, subject to legal retention requirements and other qualifications, destroy or de-identify information no longer needed for a permitted purpose (OAIC). Ask legal and tax advisers to produce a repository-specific retention matrix.

Also check the professional framework. APES 110 identifies confidentiality as a fundamental principle and requires members to respect information acquired through professional and business relationships, with detailed application depending on the member, service and circumstances (APESB). Map professional duties, client agreements and statutory rules instead of relying on one generic privacy clause.

Examine cybersecurity as it actually operates

Cyber due diligence should demonstrate whether controls cover every route into client data. Interview the managed-service provider without the seller answering. Review administrator and dormant accounts, shared credentials, remote access, former-staff offboarding, email forwarding, client portals, mobile devices and integrations. Confirm that the buyer will control the domain, identity platform, recovery methods, encryption keys and audit logs at completion.

The Australian Signals Directorate’s small-business guidance recommends multi-factor authentication, software updates and backups as starting measures, followed by Essential Eight maturity level one (Cyber.gov.au). Do not accept tick boxes alone: observe MFA on high-risk services, compare patch reports with device inventory, and restore representative files into an isolated environment. Determine when the last successful restore occurred and whether ransomware or a compromised administrator could alter backups.

Investigate historic incidents and near misses. For entities covered by the Notifiable Data Breaches scheme, an eligible breach generally involves unauthorised access, disclosure or loss that is likely to cause serious harm where remedial action has not prevented that risk; covered entities must notify affected individuals and the Commissioner as soon as practicable (OAIC). Accounting practices can also handle tax file number information, so advisers should determine the precise coverage and whether any past event was properly assessed.

Design a controlled transfer

Turn the findings into a dated responsibility plan. It should identify the lawful basis and client communications for each transfer, the authorised export, integrity checks, quarantined import, permission mapping, seller-account revocation, backup separation and secure disposal or return of residual copies. Preserve necessary audit trails. Avoid a single bulk copy into production on settlement night.

Use decision gates:

Question Satisfactory evidence Warning sign
Can records be disclosed and transferred? Advice tied to deal structure, contracts and actual data Assumption that buying fees includes every file
Are client files complete and usable? Sampled files reconcile across workpapers, advice and lodgements Missing reasoning, seller-only email or inaccessible archives
Are controls effective? Observed MFA, current access lists, tested restore and closed findings Shared accounts, unsupported systems or untested backups
Is incident exposure understood? Complete register, assessments and remediation evidence Informal reports, unexplained alerts or missing logs
Is separation workable? Named owners, timed cutover, residual-data process and rollback plan Uncontrolled bulk export or indefinite seller access

Unresolved gaps may require remediation before completion, a narrower transfer, specific contractual protection, additional cost in the operating plan or a pause. Cyber and privacy findings are inputs for the buyer and advisers; they do not by themselves determine price or legal drafting.

When specialist advice is needed

Engage a privacy and transaction lawyer to advise on due-diligence disclosure, client permissions, transaction structure, retention, breach obligations and sale-agreement protections. A cyber specialist can validate identity, access, devices, cloud configuration, backups, logging and incident history. Tax and professional-practice advisers should test recordkeeping and confidentiality obligations. Coordinate them around one verified data map and transfer plan.

Sources

Disclaimer

This article provides general information only. It does not constitute legal, tax, accounting, financial, credit, valuation or other professional advice. Circumstances differ. Obtain advice from appropriately qualified advisers before acting or entering a transaction.