No PTIN, and still fully in scope.

The federal obligation most people talk about is anchored to preparing returns. Bookkeepers are often told this means the rules do not reach them. That is the wrong conclusion, because the state obligation is not anchored to a licence at all, and payroll work usually pulls you into the federal one anyway.

Free WISP Readiness Check Flat-rate pricing, unlimited devices

Where your obligation actually comes from

What applies to you

201 CMR 17No licence test, no size thresholdThe Massachusetts standards apply to every person who owns or licenses personal information about a resident. Holding a client's employee roster with Social Security numbers is enough.

Personal informationName plus SSN, licence number, or a financial account numberPayroll files and bank reconciliations contain all three. This is the most common category bookkeepers hold without registering that they hold it.

16 CFR 314Activities incidental to financial activitiesWhether the Safeguards Rule reaches a given bookkeeping practice depends on what it actually does. Payroll processing and tax work push firmly toward yes. Ask your attorney about your own facts.

c. 93H and 93IBreach notice and secure destructionBoth attach to holding the data, not to holding a credential. The notice duties run to the Attorney General, the Director of Consumer Affairs and the affected resident.

Where the gaps usually are

The five things that catch bookkeepers out

Client accounting file access

You often hold credentials or delegated access to a client's own accounting system and bank feeds. That is an access-control question your program has to answer explicitly.

Payroll is the sharpest exposure

Employee Social Security numbers and direct deposit details sit in one file. It is usually the highest-risk asset in the practice and the least protected.

Shared logins

Small bookkeeping practices run on shared credentials more than any other segment. Unique identification per person is a named requirement, not a preference.

Working from client files by email

Sending a payroll register as an email attachment is transmission of personal information over a public network, which is squarely covered.

You are somebody else's vendor

Your accounting-firm and business clients are required to impose safeguards on you by contract. Arriving with that clause already drafted turns an awkward request into a selling point.

The reach-through nobody expects

Because 17.03(2)(f) requires your clients to oversee their service providers, the firms you work for will eventually send you a security questionnaire. Most bookkeepers meet this for the first time as a scramble. Having the answers already written is the whole point.

Know another firm that needs this? Each one that signs up with your code takes 20% off your own renewal. Five and you pay nothing.

How the discount works →

What you get

A free readiness check first

Nine questions, an instant readiness outcome and a gap list. Download the report or have it sent to you with recommended next steps.

A one-time custom build

Your firm-specific plan, documenting your real devices, staff, software and vendors across all ten required parts. What it includes

Then ongoing monthly checks

Flat rate, unlimited devices, no per-device charges. Setup waived on annual plans. See pricing

You are probably in scope. Find out precisely where.

The quiz covers the federal elements and the Massachusetts ones together, so you see both at once.

Take the free quiz See what setup produces