Confidentiality & Privileged Information Policy
This policy defines how every person at FinEx identifies, protects and handles confidential and legally privileged client information, in addition to the obligations in our client NDAs and contracts.
1. Principle
All information received from or about a client is confidential unless it is clearly public. Personnel must assume confidentiality and act accordingly. Confidentiality is owed to the client, to the client's employees, customers and vendors whose data we see, and to taxpayers whose returns we help prepare.
2. Classification
| Class | Examples | Handling |
|---|---|---|
| Restricted | Taxpayer identifiers (PAN, SSN, TFN, NI numbers), bank credentials, payroll data, privileged legal documents, notices under investigation | Named individuals only; never printed unless essential; never sent by email attachment where a secure folder is available |
| Confidential | Ledgers, financial statements, returns, contracts, pricing, correspondence with authorities | Engagement team only; approved channels and storage only |
| Internal | Firm procedures, templates, training material | Personnel only |
| Public | Published website content and marketing material | No restriction |
3. Privileged information
Clients sometimes share advice from their lawyers, documents prepared for litigation or communications that attract legal professional privilege. Personnel must:
- Mark and store such documents separately within the client folder, with access limited to the engagement partner and the individuals who strictly need them.
- Use them only for the purpose for which the client shared them.
- Never forward, quote or summarise them to any third party, including tax authorities, without the client's express written instruction.
- If any authority requests such material, inform the engagement partner immediately so that the client can be notified and can decide whether to assert privilege.
We do not claim that our own accounting or tax communications are themselves legally privileged; where privilege matters, we work under the direction of the client's legal advisers.
4. Conversations and meetings
Client matters are not discussed in public places, on social media, with family or friends, or with other clients. Client names are not disclosed as references or in marketing without written permission.
5. Requests from third parties
Any request for client information from a bank, auditor, authority, journalist or other third party is referred to the engagement partner. Information is released only with the client's written authority or where the law compels it, and then only to the minimum extent required.
6. Breach
A breach of this policy is a serious disciplinary matter and is handled under our incident procedure. Confidentiality obligations continue after a person leaves the firm.
Questions about security?
We are happy to complete your vendor-security questionnaire and walk your team through our controls.