An accounting firm does not automatically become subject to every comprehensive privacy law in every state where a client lives. Client residence is a useful starting point, but each law has its own scope, thresholds, exemptions, and rules for the information involved.
The firm needs a targeted applicability review and a data inventory. A current WISP helps document security practices; it does not by itself answer every state privacy or breach-notification question.
Key takeaways
Client residence alone is not a complete state privacy-law applicability test.
Read each law’s scope, thresholds and exemptions for the firm’s actual activities.
Distinguish exemptions for an entity from exemptions for particular information.
A WISP documents security work but does not settle all privacy rights or breach duties.
Table of Contents
What should the applicability review establish?
For each relevant state, ask whether the firm meets the statutory business or activity conditions, what information it processes, and whether an entity-level or data-level exemption applies.
Review the role the firm plays. It may determine how information is processed for one activity while providing services under another business’s instructions for a different activity.
Include records beyond tax returns: website inquiries, marketing contacts, employee files, applicant information, and vendor contacts can require separate analysis.
The answer should identify the law and reasoning, rather than simply label the entire client database “financial data.”
Why do GLBA exemptions need careful reading?
The Gramm-Leach-Bliley Act is relevant to the analysis, but state exemptions are not written identically.
An entity-level exemption can remove a qualifying institution from a law’s scope. A data-level exemption can apply only to particular information or processing, leaving other records to be assessed.
That difference matters when an accounting firm handles both regulated client information and other personal information. Do not extend an exemption beyond the statute’s wording or assume every accounting service has identical treatment.
Three examples of different applicability approaches
California: Assess the business and the information
The California Privacy Protection Agency’s FAQ describes covered for-profit businesses and alternative revenue, information-volume, and revenue-from-selling-or-sharing thresholds. Having a California client alone is not the complete test.
The CPPA also describes financial-data exemptions in its business applicability guidance. Assess what information is processed under the relevant financial-privacy rules rather than treating the exemption as an automatic exclusion of every record held by the firm.
Employee, applicant, and business-contact information should not be ignored: the CPPA explains that California residents in those contexts can have CCPA rights.
Colorado: Review consumer scope and statutory exemptions
Colorado’s statute also contains a financial-institution exemption with specific conditions. Review those conditions and the firm’s activities rather than transplanting the California analysis.
The definition of a consumer can affect which records count toward applicability. A count of all names in the firm’s systems is not necessarily the relevant statutory count.
Virginia: Check the chapter’s scope and financial exemption
Virginia Code §59.1-576 sets activity and consumer-volume conditions and provides an exemption for financial institutions or data subject to Title V of GLBA.
Document why the exemption does or does not apply to the firm or information being assessed. Its wording differs from a generic statement that all state privacy laws are layered onto a WISP.
These examples show why a firm-specific review is more useful than a headline count of states with privacy laws.
Build an inventory that makes the review possible
Start with systems and activities, not just offices:
Tax preparation and bookkeeping records.
Client portals, email, and shared document locations.
Website forms, analytics, and marketing tools.
Staff and applicant records.
Outsourced work, vendors, and their permitted access.
Backups, archives, and local downloaded copies.
Record information categories, relevant locations, purposes, recipients, retention, and a responsible owner. Use accurate working categories so the reviewer can identify exemptions and duties without receiving unnecessary personal details.
Update the inventory after a merger, new service, new vendor, or material change in how information is used.
Does a privacy exemption settle breach-notification duties?
No automatic conclusion follows. Comprehensive privacy laws and breach-notification rules are different legal questions.
The response review should identify the applicable information definitions, affected individuals, event facts, notice recipients, and deadlines. Federal requirements, state duties, contracts, and insurer conditions may also need attention.
Use the breach tabletop guide to rehearse who gathers those facts and who obtains the legal assessment. Avoid assuming that one federal deadline applies to every incident.
How does this review differ from the FTC Safeguards Rule?
The FTC Safeguards Rule addresses a covered financial institution’s information security program. State comprehensive privacy laws can address different questions, including the circumstances in which personal information is processed and the rights that apply to it.
Sponsored by Verito
Verito hosts Drake, Lacerte, UltraTax, and QuickBooks on private dedicated servers — with 24/7 support from techs who actually know tax software. Used by 1,000+ accounting firms.
See plans from $69/user →
Coordinate the reviews through the same data inventory, but record the conclusions separately. A security control can support both activities without proving that every state privacy duty has been met. Keep a clear owner for legal applicability and another for implementing the approved technical controls.
Give staff a defined route for requests concerning access, correction, deletion, or other applicable rights. The reviewer should determine whether a right applies and any exception affecting the response.
Verify identity appropriately before sending records. Do not collect excessive new sensitive information merely to process a request.
Track receipt, the applicable response requirement, decisions, and completion. A deletion request should not prompt an employee to remove records that must be retained without review.
“I use Verito to host Drake Accounting, Drake Tax, and TaxDome … Everything runs smoothly, and the performance is exactly what I need for my tax practice. As a tax professional, reliability and security are everything, and Verito has delivered both perfectly.”
Crystal Gilbert · Google, Dec 2025
How Verito helps implement the firm’s security decisions
Verito’s WISP services can support documentation of the firm’s security program. Bring the data inventory and the decisions from the applicability review so the document reflects the actual workflow.
VeritGuard managed IT is relevant to implementing and maintaining technical controls within the agreed scope. Ask who owns account access, device protection, and evidence needed for the firm’s reviews.
Those services support the security work. The state-law assessment and any privacy-notice or rights-response decisions should be made by the appropriate reviewer for the firm’s circumstances.
Camren Majors is co-founder and Chief Revenue Officer of Verito Technologies, a cloud hosting and managed IT company built exclusively for tax and accounting firms. He is the co-author of Beyond Best Practices: Modernizing the Successful Accounting Firm (2026). His work has been featured in NATP TAXPRO Magazine and he has presented for NATP, NAEA, and NSA.
Practice management software runs your firm's clients, projects, deadlines, and time in one place. How to pick the right tool for your firm and host it securely.
