Client Consent Form for Accountants: What to Cover

A client consent form records permission to collect, use and disclose client information for stated purposes and recipients. Put offshore work and identity checks in clear clauses. A privacy notice explains your handling practices, but reading it does not itself give permission.

What a Client Consent Form Covers

A client consent form tells the client what information you need, why you need it and who can receive it. Match the permissions to the work your practice actually does.

List relevant recipients separately so the client can see each disclosure:

• The ATO for tax services and ASIC for company work you are authorised to perform.
• The client’s other advisers for agreed coordination or professional clearance.
• A lender or mortgage broker when the client requests a particular disclosure.
• Cloud software and document-storage providers handling the client’s records.
• Identity verification services checking the person’s documents.
• Outsourced contractors, including overseas providers, performing specified work.

Give enough detail to identify unexpected recipients. Permission to lodge a return does not automatically cover sending that return to a relative or broker.

Keep the privacy collection notice beside the consent clauses. The notice explains your practices. The consent clauses record the client’s choices about disclosures requiring permission.

Confidentiality Under the TPB Code

Under section 30-10(6) of the Tax Agent Services Act 2009, registered tax and BAS agents must obtain client permission before third-party disclosure. A legal duty to disclose is the exception. The Act’s confidentiality duty applies to information about the client’s affairs, including information you learn indirectly.

A client’s relative asking about their tax affairs is still a third party. Get the client’s permission before answering. For a broker request, record which documents the client allows you to send and to which broker.

The TPB’s confidentiality guidance treats outsourced contractors and cloud-storage providers as third parties. Working for your practice does not remove that status. Its offshore example uses explicit permission through a signed engagement letter.

The TPB accepts a signed consent form, engagement letter or other client communication as evidence of permission. Written permission is a sensible practice policy because you can retain the exact disclosure agreed. The Code does not prescribe one mandatory consent-form format.

Explain what information will go to whom and where before it leaves your practice. The outsourcing guide covers the wider arrangements you need when another provider performs the work.

Privacy Act, the Apps and the TFN Rule

The Australian Privacy Principles (APPs) generally cover private organisations with annual turnover above $3 million. Some smaller businesses are covered too. The OAIC’s small-business checklist identifies exceptions.

These include health service providers, businesses trading in personal information, Commonwealth contractors and businesses related to a covered business. Voluntary opt-in and other prescribed categories also matter. Assess the relevant financial-year history, not just this year’s revenue.

A small practice that becomes an AML/CTF reporting entity must follow the APPs for its AML/CTF information-handling activities. That does not automatically cover all its unrelated business activities. The OAIC’s reporting-entity guidance explains the distinction.

The Privacy (Tax File Number) Rule 2015 applies when your practice handles an individual’s TFN, regardless of the small-business exemption. It does not cover entity TFNs. Other tax laws still restrict TFN handling.

Under the TFN Rule guidance, identify the law authorising collection and its purpose. Explain that refusing to quote a TFN is not an offence and state the actual consequences. Collect only information needed for an authorised purpose.

Protect individual TFN information against loss and unauthorised access, use or disclosure. Restrict access and use a secure collection method. Destroy or permanently de-identify it when retention is no longer legally required or necessary for an authorised purpose. Client consent cannot authorise a prohibited TFN disclosure.

For overseas disclosures, APP 8 normally requires reasonable steps to prevent the recipient breaching the APPs. Your practice generally remains accountable. Name the work and likely countries before seeking permission. The cross-border guidelines distinguish disclosure from use within your effective control.

Ordinary offshore permission does not waive APP 8. Its informed-consent exception needs an express explanation of the lost protections and potential consequences. Have a lawyer assess that exception before relying on it.

Privacy reform is continuing. The 2024 amendments introduced enforcement changes, including OAIC infringement notices. The small-business exemption remains in the OAIC’s published guidance. Check that coverage before relying on it. References to privacy reforms tranche 2 are not proof that every proposed change has commenced.

Privacy Collection Notice at Intake

Give clients the privacy collection notice before they enter TFNs or upload identity documents. APP 5 requires reasonable notification steps before or at collection, or as soon as practicable afterwards. Designing your form to show it first avoids collecting sensitive documents before explaining their use.

The APP 5 guidelines cover the collecting practice’s identity and contact details, purposes and any authorising law. Explain relevant third-party collection, consequences of withholding details and usual recipients. Include likely overseas countries where practicable. Tell clients how your privacy policy covers access, correction and complaints.

Keep the notice link available on the confirmation page and in the client’s retained paperwork. Place the permission choices after the notice. Record consent separately from a tick confirming that the client read the notice.

This short example is for a fictional small practice using an overseas bookkeeping contractor:

Our practice collects the details you give us to perform the agreed tax and bookkeeping work. Information needed for that work goes to the ATO and our named software providers. With your permission, the contractor identified below processes bookkeeping records in the Philippines. Missing details can prevent us completing the agreed work. Contact the practice’s privacy contact to request access or corrections, or to complain.

Our privacy policy explains how we handle these requests.

Add the practice’s actual identity and contact details before use. Include the specific TFN notice where you request a TFN. The short example does not replace either that notice or the separate offshore permission.

Consent for Identity Checks and Offshore Work

Electronic checks through the Document Verification Service (DVS) require express consent before the check. Silence and a preselected opt-out cannot supply it. The IDMatch consent guidance sets out the participation-agreement requirements.

You can adapt this illustrative consent clause: I am authorised to provide these identity details. I give permission for them to be checked against the issuer’s records through the specified verification provider to confirm my identity.

Use your provider’s approved wording in the actual form. Explain the consequences of refusing, available identity-check alternatives and access or complaint rights. DVS users also have restrictions on public statements about their use of the service. The digital identity guide covers choosing a checking method.

For offshore work, identify the contractor, country and tasks beside the client’s permission choice. In the fictional example, the clause can read: I permit the identified contractor in the Philippines to receive my bookkeeping records for transaction processing. I can decline or withdraw this permission by contacting the practice. The practice will explain an alternative arrangement and any effect on the agreed service.

Keep this permission separate from any proposed APP 8 exception. Explain cloud hosting or overseas access where it affects the client’s decision. A broad permission for unspecified future providers gives the client little useful information.

For AML/CTF work, first decide whether the service is a professional designated service. Routine accounting work does not automatically trigger those obligations. When they apply, explain the information collected for customer due diligence and screening, including beneficial-owner and representative details.

Legal AML/CTF collection or reporting does not depend on the client’s permission. Obtain separate consent where the chosen checking method requires it, including DVS checks. If the client refuses necessary information, assess whether you can provide the designated service under AUSTRAC’s customer due diligence rules.

Privacy Consent Form Template

Build your privacy consent form template around the actual client and disclosures. This template structure is general information, not legal advice. Have your practice’s lawyer review the completed wording before use.

Form part	What to include
Practice and client details	Practice legal identity and privacy contact, client name, relevant entities and representative authority.
Collection notice	Purposes, usual recipients, likely overseas countries, refusal consequences and access, correction and complaint information. Put it above the consent clauses.
Agreed work	The services for which you collect and use the information.
Disclosure choices	Separate permissions for relevant recipient categories. Name advisers or lenders when a particular disclosure is requested.
Offshore processing	Provider identity, country, work performed and information shared. Record the client’s acceptance or refusal.
Identity verification	Provider-specific express consent and the consequences of declining the check.
Withdrawal	How to contact the practice, which future disclosures stop and what work may be affected.
Execution	Signer name, capacity, signature and date. Retain the version the person signs.

Use the short collection notice above as a starting point. Describe the actual providers in the completed form and remove categories you do not use. Avoid asking the client to approve every imaginable disclosure.

A privacy policy template has a different job. It explains how your practice manages personal information across its work. Under APP 1, cover information collected and held, collection and storage methods, purposes and disclosures. Explain access and correction rights, complaint handling and likely overseas recipients and countries where practicable.

Keep the policy publicly accessible and give clients a copy on request. A data privacy policy template cannot replace the client’s disclosure permissions or the notice for a particular collection.

Separate Form or a Clause in the Engagement Letter

Consent can sit in the engagement letter when the disclosure is explained clearly and the correct client gives permission. Put the clause where the client will see it before signing. The engagement letter guide covers the other terms surrounding it.

Use a separate data privacy consent form when each adult in a family group needs different choices. It also suits a new offshore arrangement introduced after the engagement starts. Unexpected disclosure buried in a long letter can undermine informed consent.

Separate a company’s authority to engage your practice from an individual’s permission for an identity check. Each director, trustee or partner whose own details are checked needs the required personal consent. One person’s signature for the entity does not automatically give that consent for everyone else.

Collection of someone’s details does not always legally require consent. Give the relevant collection notice and obtain personal consent for the handling or checking that needs it. Keep evidence of any authorised representative’s capacity to act.

Recording, Renewing and Withdrawing Consent

Save the signed form or electronic signature record against the correct client file. Retain the consent text, version and choices alongside who signed, their capacity and when. A bare yes in your tax software does not show what the client agreed to.

Ask again when you introduce a new offshore provider, change the purpose or collect information about a new person in the client group. Check whether existing permission actually covers a changed recipient or disclosure before sending information. There is no reason to replace valid consent just because another year starts.

When consent is withdrawn, record the request and stop future handling that relies on that permission. Tell relevant staff and providers what must stop. Withdrawal does not erase a past disclosure or remove a legal retention or reporting duty.

Explain the practical result to the client. Refusing broker disclosure stops that disclosure. An objection to offshore processing may need a different service arrangement. If the client declines a required identity-check method, assess an accepted alternative before continuing.

If information was disclosed without authority, follow your data breach response plan. For the next onboarding file, check that every consent points to the named person, the stated purpose and the actual recipients before work leaves your practice.