NDAs for Accountants and Bookkeepers: Offshore Staff, Outsourced Work and Selling the Practice Before the TPB’s New Penalties Start

On 1 October 2026 the Tax Practitioners Board gets new teeth. As Accountants Daily reported on 18 September, the Board will be able to pursue new civil penalties for breaches of the Code of Professional Conduct, issue infringement notices and accept enforceable undertakings. Confidentiality of client information is one of the Code’s items. So if your practice sends client files to an offshore bookkeeper, a cloud provider or an outsourced payroll team, now is the week to check that the right people have signed the right paper. Claim Done drafts a non-disclosure agreement for accounting and bookkeeping practices for a flat A$49, and you can start one here.

The short version: a practice needs two things, and most have only one. The client has to consent to their information going to a third party. And the third party has to be bound to keep it confidential. The engagement letter does the first job. It does nothing about the second.

What actually changes on 1 October, and what does not

The confidentiality rule itself is not new. Code item 6 says you must not disclose information relating to a client’s affairs, or a former client’s, to a third party unless you have the client’s permission or a legal duty to do so. The TPB’s page on confidentiality of client information sets it out and has not been softened for the cloud era: the Board says outsourcing and cloud storage are increasingly common, but the obligations under item 6 “have not changed”.

What changes is the consequence. Until now, a Code breach meant administrative sanctions: a written caution, required training, supervision, suspension or termination of registration. The Accountant’s summary of the reforms confirms that from 1 October new civil penalties apply to registered practitioners who breach the Code, alongside higher maximum civil penalty thresholds. Neither article puts a dollar figure on it, so neither will we. The practical point is simpler. A confidentiality slip that used to cost you a caution can now cost you money, and the Board has said it will take a proportionate, risk-based approach. Proportionate to what you did to prevent it is a reasonable reading.

The rule covers BAS agents too. The TPB’s wording refers to tax or BAS agent services throughout, so a registered bookkeeper is in exactly the same position as a registered tax agent.

Who counts as a third party (it is a longer list than you think)

The TPB defines a third party as any entity other than you and your client. Its own examples include:

• anyone you outsource tax or BAS agent services to
• other entities in your service trust structure, unless the engagement letter defines the client as the whole structure
• offsite data storage, including cloud storage
• external service providers such as IT consultants and cleaners

In the Board’s outsourcing and offshoring questions and answers it goes further: using an external auditor is outsourcing, and so is storing client documents on a file-hosting service like Microsoft OneDrive.

Read that list again with your own practice in mind. The overseas assistant who reconciles bank feeds. The contractor who does your year-end rush. The IT firm with admin rights to your server. The prospective buyer who wants to look through your client ledger before making an offer. Every one of them is a third party. Some you will need client consent for, some you will need to bind with a confidentiality agreement, and most you need both.

The two documents, and why the engagement letter is only half

The TPB is specific about consent. Before disclosing, you tell the client what information is going, to whom, and where, and you get their permission. It accepts a signed engagement letter, a signed consent, or another communication. In its Q&A it confirms an engagement letter satisfies item 6 provided it clearly informs the client what is disclosed, to whom and where, and obtains written permission. If the data sits on overseas servers, the client needs to be told that.

That covers your side of the line with the client. It does not bind the person receiving the files. Asked what stops data leaking once it is offshore, the Board’s answer lists controls, and first among them is “an appropriate confidentiality agreement between you and your outsourced provider”, followed by encryption, access controls, audit trails and segregation of duties.

The gap is easy to fall into. A practice updates its engagement letter to mention offshore processing, feels compliant, and never gets the processor to sign anything. The client consented to the disclosure. Nobody agreed to keep it confidential. If that processor later reuses a client list or leaves with a copy of the files, the practice is the registered entity answering to the Board, and it has nothing in writing to enforce against the person who caused the problem.

The offshore bookkeeper you employ directly

A common set-up now: a full-time bookkeeper in the Philippines, India or elsewhere, working from home on your systems. The TPB was asked about exactly this. Its answer is that it is offshoring, that the person may be a third party depending on how they are engaged (through a service trust, or holding data off your systems), and that client permission must say whether disclosure will be made overseas.

It also says you remain responsible for the work being competent, with adequate supervision and review by registered practitioners. That is a separate obligation from confidentiality, and worth reading in full if you run an offshore team.

For the paperwork, the confidentiality agreement with an offshore worker has to be more specific than a domestic one, because you are less likely to be able to enforce it in a hurry. Spell out which systems they may use and which they may not (personal email, personal cloud drives, messaging apps), what happens to downloaded files and devices when the engagement ends, and that they must tell you immediately if anything goes astray. If they are engaged as a contractor rather than an employee, you also want an independent contractor agreement covering scope, payment and who owns the work product. An NDA does confidentiality and nothing else.

What an accounting practice’s NDA should actually say

A generic NDA downloaded for a software deal will miss most of what matters to a practice. The clauses that earn their place:

1. A definition of confidential information that names your material. Tax file numbers, ATO and online services data, bank statements, payroll records, client lists, fee schedules, workpapers and anything derived from them. The TPB’s own definition of information includes knowledge derived indirectly, so the agreement should too.
2. A permitted purpose. The recipient may use the information only to perform the services you engaged them for. Not to train, market, or build a book of their own.
3. Approved systems and locations. Where the data may be stored and accessed. This is what your engagement letter has already told clients, so the two documents should say the same thing.
4. No onward disclosure without your written consent. Including to their own subcontractors. Your client consented to one named provider, not to that provider’s cousin.
5. A legal-duty carve-out that mirrors item 6. The recipient may disclose where the law requires it, but must tell you first where the law allows.
6. Prompt breach notification. You need to know fast, because you may have your own obligations to clients and regulators once something goes wrong.
7. Return or destruction at the end, including devices and backups, with written confirmation.
8. Obligations that survive termination. Client information does not stop being sensitive when the contract does.

If you want to test a document someone else has handed you, our guide to reviewing an NDA’s scope, term, carve-outs and return of materials walks through what to look for.

Buying or selling a fee base

This is where practices get caught out without noticing. A buyer’s due diligence wants client numbers, fee history, service mix, and sometimes names. On the TPB’s definition, a prospective purchaser is a third party. Showing them identifiable client information before clients have agreed to it sits uncomfortably with item 6, sale or no sale.

The workable sequence: de-identified figures first, under a signed NDA; identifiable information only later, and only with appropriate client permission or once the sale arrangements allow it. The NDA should also stop the buyer approaching your clients or staff if the deal falls over. Get that signed before the first spreadsheet leaves your office.

Before you start: the ten-minute check

List every person or business outside your practice that touches client data. Then answer two questions for each: has the client consented to them, in writing, including where the data goes? And has that person signed something that binds them to confidentiality? Any row with a “no” in the second column is the gap the new penalty regime makes expensive.

If a client of yours has left owing fees, that is a separate problem with its own fix; we covered it in recovering unpaid fees from a client who disappeared.

Getting the NDA done with Claim Done

Claim Done builds the agreement from your answers: who the parties are, what they will see, where they will work, how long the obligation lasts and what happens at the end. It costs a flat A$49, with no retainer and no subscription; every service is listed on the pricing page. Claim Done’s document engine drafts it, you read it and approve it, and it is then sent to you by email, ready for the other party to sign. Most practices need more than one, and each is a separate document built for that relationship.

Claim Done is not a law firm and does not give legal advice. It will not tell you whether your service trust is structured correctly, and it will not defend you in a TPB investigation. For the everyday job of getting your offshore bookkeeper, your outsourced processor or a prospective buyer to sign a confidentiality agreement that fits an accounting practice, it is quick and costs A$49.

Start with the relationship that worries you most. Go to Claim Done and start your non-disclosure agreement, choose the NDA service, answer the questions about the parties and the data, and you will have a document to review and approve before the new penalties apply on 1 October.

Frequently asked questions

Does my engagement letter already cover confidentiality for outsourcing?

It covers the client's consent, if it says what information goes, to whom and where, and the client signs it. That is what the TPB asks for under Code item 6. It does not bind the provider receiving the information, which is why the Board also points to a confidentiality agreement between you and your outsourced provider.

Do bookkeepers and BAS agents need an NDA with offshore staff?

A registered BAS agent is bound by the same Code of Professional Conduct as a tax agent, including the confidentiality item, so the same logic applies. If an offshore worker handles client data, get client consent that discloses the overseas arrangement and get the worker to sign a confidentiality agreement that names approved systems and what happens to data at the end.

Is an NDA enough when I engage an offshore contractor?

No. An NDA only deals with confidentiality. A contractor also needs an agreement covering scope of work, payment, ownership of work product and termination. Most practices use an independent contractor agreement alongside the NDA.

Can I show a buyer my client list when selling my practice?

Be careful. On the TPB's definition a prospective buyer is a third party, and item 6 restricts disclosing client information to third parties without permission or a legal duty. Share de-identified figures first under a signed NDA.

How much does an NDA from Claim Done cost?

A Claim Done NDA is a flat A$49, with no subscription. You answer the questions, review and approve the draft, and it is sent to you by email. Current pricing for every document is on the pricing page.