safeguardsmonitor.com/safeguards-rule-exemptions· printed from the live page · figures carry their own as-of dates

The Safeguards Rule Exemption Under 5,000 Consumers: Exactly What Is Waived

Checked against the primary record: July 17, 2026 · Exception adopted: December 9, 2021 (86 FR 70308); unamended since

This explains the FTC Safeguards Rule's small-firm exception: which requirements it waives and how its 5,000-consumer count works. It is general information, not legal advice for your specific situation. For that, consult a qualified professional.

#CopiedWhat does the under-5,000 exemption actually say?

The entire exemption is one sentence of regulation. Section 314.6 of the Safeguards Rule, and the rule's own heading for it is the narrower word "Exceptions," switches off four listed paragraphs for any financial institution that maintains customer information concerning fewer than 5,000 consumers. Tax preparation firms are financial institutions under the rule, named in it directly, so a small practice can qualify like any other covered business. Here is the full text:

Read it closely and three things stand out. It waives exactly four paragraphs, each named by letter and number, and nothing else. It conditions the relief on what you maintain, not on headcount, revenue, or return volume. And it says nothing about the written plan itself, which lives one section earlier in the rule and is untouched. The section was added in the 2021 overhaul, in which the Commission cited the impact of the new requirements on small businesses (86 FR 70272), and it has not been amended since.

#CopiedWhich requirements are waived, and which stay?

Here is the complete map, every requirement by its subsection letter. Two rows carry the word "split," because there the exception removes a sub-paragraph rather than a whole element, a difference that is easy to flatten and worth keeping. Even the FTC's own compliance guide (revised December 2024) describes the relief only as an exemption from "certain provisions"; the list below is the regulation's own.

The two split rows are where precision pays. On risk assessment, 314.6 waives paragraph (b)(1): the requirement that the assessment be written and meet three listed criteria. The surrounding duty survives. Your program must still be based on a risk assessment, and (b)(2) still requires you to reexamine your risks periodically. A qualifying firm can do that thinking without producing the formal document; it cannot skip the thinking. On testing, the waiver removes (d)(2), the prescriptive regime of continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months. What survives is (d)(1): you still have to regularly test or otherwise monitor whether the safeguards you rely on actually work.

#CopiedDo I still need a WISP if I'm exempt?

Yes. The written information security plan (the WISP) is required by 16 CFR 314.3(a), which tells every covered institution that "You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts," a sentence that continues into safeguards "appropriate to your size and complexity." No size threshold anywhere in Part 314 touches that requirement; we read the full part, 314.1 through 314.6, on July 17, 2026. Qualifying under 314.6 shortens what the plan must contain. It does not remove the plan.

Two opposite errors circulate about this section, and this page exists to correct both. The first treats nothing as waived: every requirement presented as binding on every firm, the threshold never mentioned. The second waves away too much: treating the incident-response waiver as if a small firm had no security-event duties at all (the FTC breach report stands, and so do the safeguards), folding the Qualified Individual into the exemption (314.4(a) appears nowhere in 314.6), or miscounting the rule itself into "seven elements" or "twelve requirements" (the program has nine, (a) through (i), plus the separate notification duty at (j)). Each claim in that catalog can be checked against the one sentence of regulation quoted above, which is why this page quotes it.

For a genuinely small practice, the honest reading is good news. What remains is the part a small firm can actually meet: a written plan scaled to your size, a named person responsible for it, and safeguards you mostly run anyway. The four heaviest process items are off your list.

#CopiedHow do you count 5,000 consumers?

The count is where the exemption is won or lost, and the rule's definitions do more work than summaries of them suggest. Three definitions from 16 CFR 314.2 govern. A "consumer" is "an individual who obtains or has obtained a financial product or service from you that is to be used primarily for personal, family, or household purposes, or that individual's legal representative." "Customer information" means any record containing nonpublic personal information "about a customer of a financial institution," in paper, electronic, or other form, "handled or maintained by or on behalf of you or your affiliates." And the exception applies to a firm that "maintains" such information concerning fewer than 5,000 consumers. Maintain is present tense: the test is what you hold, not what you take in per year.

Applied to a tax practice, those definitions settle more than you might expect. Here is the count, step by step:

1. Count what you maintain, not what you filed this season. The trigger is holding the information. Every individual whose records sit in your software, your cloud storage, or your file cabinets belongs in the count, whatever year the engagement was.
2. Former clients stay in the count while their files do. A "consumer" is anyone who "obtains or has obtained" your service. Time does not remove them; disposal does. The rule's own disposal safeguard, 314.4(c)(6), sets a two-year default with exceptions; the exact timing is covered in our guide to the full rule.
3. A joint return adds two. Each spouse is an individual who has obtained the service for personal or family purposes, so a married-filing-jointly engagement puts two consumers in the count, not one household.
4. Entity work, by itself, does not add consumers. The definition reaches individuals obtaining a service "primarily for personal, family, or household purposes." A corporate or partnership return prepared for the business is not that. The owner whose personal return you also prepare is.
5. Dependents are the honest open question. A dependent listed on a client's return did not obtain your service, so on the definition's plain terms the dependent is not a consumer, even though the file carries their information. The rule does not address dependents by name, and we could find no FTC statement that does (we checked the rule text and the FTC's business guidance on July 17, 2026). Treat this edge as unsettled rather than assumed.
6. Re-run the count when the practice changes. Growth, a book-of-business purchase, or simple retention can push a firm past 5,000, and the four waived items apply in full once you no longer qualify. A dated count, refreshed beside your plan's regular review, is cheap insurance.

The count decides which duties bind your firm, and some of its edges (dependents above all) are not settled in the rule's text. If your practice sits anywhere near 5,000, or your answer turns on an unsettled edge, confirm your status with a qualified professional before you rely on the exemption.

#CopiedDoes the exemption change what happens if something goes wrong?

No. This is the boundary the word "exemption" obscures: 314.6 reduces what your program must contain, and changes nothing about what a failure can cost. Coverage is untouched, so the rule still applies to your firm. The breach-notification duty is untouched, so a reportable event still runs on the FTC's clock. And the civil-penalty exposure on the books is untouched: qualifying under 314.6 does not lower what a violation can cost. By site policy the verified figures live on one page, each with its source and as-of date. The exception edits your program; it is not a liability shield.

The breach-reporting arithmetic deserves one more sentence, because two different thresholds get conflated. Your 5,000-consumer status is about all the information you maintain; the FTC report is triggered by a single event. Under 16 CFR 314.4(j), a notification event involving the information of at least 500 consumers must be reported to the FTC no later than 30 days after discovery, and 314.6 does not except anyone from that duty. A practice holding 4,000 clients' files is excused from four program elements and still one stolen unencrypted backup away from a reportable event.

#CopiedFAQ

#CopiedThe bottom line

The under-5,000 exception is real relief, delivered in one precise sentence: four paragraphs off, everything else standing. A practice that qualifies escapes the written risk assessment, the monitoring-or-penetration-testing regime, the written incident response plan, and the annual report. It still owes the written plan, the Qualified Individual, all eight safeguards, staff training, vendor oversight, and the FTC's breach clock. Count honestly, date the count, and put what remains on paper.