A Breach at Your Law Firm, CPA Firm, Tax Practice or Advisory Firm: Who to Notify, and How Fast
It starts with an email account, a lost laptop, or a vendor’s notice. Someone at your Texas law firm, CPA firm, tax practice or advisory firm clicked something, a password was reused, and now there is a login from somewhere nobody at the firm has ever been. Or a laptop is gone. Or the vendor that hosts your files just sent a notice of its own.
The first question is what happened. The second, and it arrives within the hour, is who the firm has to tell — and by when.
The answer is not one clock. A Texas firm in any of these four professions can be inside several notice duties at once, each with its own trigger, its own threshold and its own deadline, and they do not wait for each other. This page sets them out, from the rules themselves, so you know which questions to put to your counsel today rather than next week.
The clock every Texas firm is on
Texas breach notification law reaches any person who conducts business in Texas and owns or licenses computerized data that includes sensitive personal information. There is no registration test and no size test.
Individuals. Notice to each affected individual without unreasonable delay, and not later than the 60th day after the firm determines that a breach occurred.
The Attorney General. If the breach involves at least 250 Texas residents, notice to the Attorney General not later than the 30th day, on the Attorney General’s electronic form, with the content the statute lists.
Credit bureaus. If the firm is notifying more than 10,000 people, the nationwide consumer reporting agencies are told as well.
If you hold the data for someone else. A firm that maintains data it does not own must notify the owner of the data immediately after discovering the breach. For a firm that holds records on behalf of a client or a custodian, that clock starts before the others.
Your own procedure can be the route. The statute provides that a firm following its own notification procedures, as part of an information security policy whose timing is consistent with the statute, complies by doing so. That is the reason to have the procedure written before the breach, and the reason its deadlines cannot be looser than the law’s.
Whether a particular incident is a breach under the statute, and when the firm “determined” it, are questions for your counsel. The clocks above are what counsel will be working against.
The clocks that reach a CPA firm or tax practice
The Board’s rule, for a CPA firm. The Texas State Board of Public Accountancy requires a licensee, immediately upon becoming aware of the loss of, or loss of control over, the confidentiality of client records, to notify the affected client in writing of the date and time of the loss, if known. The rule says expressly that loss includes a cybersecurity breach. It also requires the firm to keep a back-up system so that affected clients can be identified and notified. This is a binding Board rule, and its trigger is “immediately,” not a day count.
The federal rule, for any firm under the Safeguards Rule. A tax preparer or CPA firm that is a financial institution under Gramm-Leach-Bliley has a duty under the FTC Safeguards Rule that took effect in May 2024: if a notification event, as the rule defines it, involves the information of at least 500 consumers, the firm must notify the Federal Trade Commission as soon as possible and no later than 30 days after discovery, on the FTC’s electronic form.
The rule also fixes when discovery happens: on the first day the event is known to any employee, officer or agent of the firm, other than the person committing the breach. Not the day a partner was told. A firm whose front desk knew for a week before anyone escalated has already spent a week of its thirty days.
And a recommendation, clearly labelled as one. IRS Publication 4557 recommends that a tax professional report data theft or loss to the IRS Stakeholder Liaison. That is IRS guidance, not a legal requirement, and it is worth doing for the practical reason that the IRS can flag affected returns. It does not replace any of the clocks above.
The clocks that reach an investment adviser
Which rules reach an adviser turns on registration, so the first question is which kind of adviser the firm is.
SEC-registered. Regulation S-P requires customer notice as soon as practicable, and no later than 30 days after the firm becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. It also requires the firm’s service providers, by contract, to notify the firm no later than 72 hours after they become aware of a breach on their side. A vendor that tells you on day ten has already cost you a third of your own clock.
An SEC-registered adviser is also a financial institution under Gramm-Leach-Bliley, which lifts it out of the Texas statute’s protect-and-destroy duties — but not out of its breach notice duties. The 60-day and 30-day Texas clocks above still run, alongside Reg S-P’s 30-day clock. Two rules, two clocks, one breach.
Texas-registered. The State Securities Board’s rules require a registered adviser to give the Board notice of a cybersecurity incident whenever the firm is already giving notice to any state or federal agency, a self-regulatory organization, or to customers under the Texas breach statute. It runs alongside those notices, never instead of them.
What reaches a law firm
The Texas Disciplinary Rules of Professional Conduct set no notification clock. What they set is the duty of confidentiality under Rule 1.05, and the duties of partners and supervisory lawyers under Rule 5.01 that make a breach at the firm the firm’s problem rather than one person’s. What the client is told, and when, is a judgment for the lawyer and the firm’s counsel.
The Texas breach statute reaches the law firm exactly as it reaches everyone else: the 60-day clock to individuals and the 30-day clock to the Attorney General at 250 Texas residents, with no carve-out for the profession.
One thing we do not do. We do not tell you whether an incident is a breach under any of these rules, whether a clock has started, or who has to be told. Those are legal determinations, and they belong to your counsel. What we can do is establish what happened, when the firm first knew, and what information was involved — the facts every one of those determinations rests on — and have that ready for counsel in hours rather than days.
What to do in the first day
Stop the bleeding, and preserve the evidence. Change the compromised credentials, revoke sessions, isolate the machine — and do not wipe anything. The logs are how you will establish what was accessed and when, and the clocks above turn on that.
Fix the date the firm first knew. Not the date a partner heard. The date anyone at the firm, or working for it, first knew. Write it down with the source.
Establish what information was involved, and whose. Whether it included sensitive personal information as the Texas statute defines it, customer information as the federal rules define it, client records as the Board’s rule defines them. How many people, and how many of them are Texas residents. Every threshold above turns on those counts.
Get counsel on the phone with those facts. Which duties apply, whether the clocks have started, and what the notices must say are counsel’s calls. Counsel makes better calls faster with the facts already assembled.
Check your vendor contracts. If the breach is on a vendor’s side, whether the vendor told you within the time your contract required is a fact that matters to your own clocks.
See the eleven obligations that reach Texas legal and financial firms →
How Briggs IT Services helps
Before a breach, we build the part that makes the first day survivable: the written incident response plan with the right clocks in it for your firm type, the vendor contract terms that require notice within the time your own rules give you, the logging that lets you establish what happened, and the data inventory that tells you whose information you hold and where they live. The Texas statute rewards a firm that has that procedure in place; the federal rule assumes it.
We start with a Compliance Readiness Review. We gather what your firm actually has, then review it against what federal and Texas law and your licensing body’s rules state as duties for your firm. You get a written report: what the firm could do today if a breach happened tonight, where the gaps are, and what closing each one takes.
From there we create the plan. If you have IT, internal or outside, we guide them through the changes and they do the hands-on work. If you have no IT, we do the hands-on work ourselves, inside a scoped remediation phase with a defined end. Then we build the documentation and keep it current.
Common questions
How long does a Texas firm have to notify people after a breach?
Under the Texas statute, notice to affected individuals is due without unreasonable delay and not later than the 60th day after the firm determines a breach occurred. If at least 250 Texas residents are affected, the Attorney General is notified not later than the 30th day. Whether an incident is a breach under the statute, and when the firm determined it, are questions for your counsel.
Does a small firm have to notify the Texas Attorney General?
The Attorney General notice turns on the number of Texas residents affected — at least 250 — not on the size of the firm. The statute has no size test.
Our vendor had the breach, not us. Do we still have to notify anyone?
The Texas statute’s notice duties fall on the person who owns or licenses the data. A vendor that maintains your data must notify you immediately; what you then owe your clients and the state is yours, and your counsel’s, to determine. For an SEC-registered adviser, Reg S-P requires the vendor contract to demand notice within 72 hours for exactly this reason.
Do we have to report a breach to the IRS?
IRS Publication 4557 recommends reporting data theft to the IRS Stakeholder Liaison. That is guidance, not a legal requirement. The binding federal duty for a firm under the Safeguards Rule is the FTC notice at 500 or more consumers, within 30 days of discovery.
When does the 30-day FTC clock start?
On the first day the event is known to any employee, officer or agent of the firm, other than the person committing the breach. That is the rule’s own definition of discovery. It is why the firm’s incident response plan has to give every staff member a way to report something the same day they see it.