Your Copier Kept a Copy of Every Tax Return. Who Wipes It When the Lease Ends?

The checkbox you probably just ticked

PTIN renewals for 2027 are open.^[3] On the paper version, Form W-12, line 11 asks you to check yes or no next to this sentence: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."^[2] As of September 1, 2026, 886,338 people held a current PTIN, 209,076 of them CPAs.^[4]

That plan is the WISP, and the requirement behind it comes from the FTC's Safeguards Rule. The rule names "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution.^[1] In July, the IRS Office of Professional Responsibility tied the WISP to Circular 230 duties and listed, among the basics, "wiping (or destroying) old hard drives, fax machines, printers, and other office equipment."^[8]

Our opinion: a WISP that covers the laptops and forgets the copier has a copier-sized hole in it.

Your copier is a computer that lives by the break room

A WISP that covers the laptops and forgets the copier has a copier-sized hole in it.

Printree, on tax-firm data security plans

The FTC's copier guide doesn't sugarcoat it: the drive "stores data about the documents it copies, prints, scans, faxes or emails," and that data can be stolen remotely or pulled off the drive once it's removed.^[5]

Now picture what your machine sees from January to April: W-2s, 1099s, driver's licenses, voided checks for direct deposit.

The IRS agrees. Publication 4557 tells tax pros to "wipe clean or destroy old computer hard drives and printers that contain sensitive data."^[6] Publication 5708, the IRS's WISP template, says to catalog every device that touches taxpayer data, printers included, and to get a signed acknowledgment from vendors "such as your IT Pro, cleaning service, or copier servicing company."^[7]

Your copier tech made it into the IRS's sample WISP. Did they make it into yours?

Then the lease ends

"Digital copiers often are leased, returned, and then leased again or sold," the FTC notes.^[5] Your drive doesn't retire when your lease does. In a federal health-privacy case, a health plan agreed to pay $1,215,780 after it returned multiple photocopiers to a leasing agent without erasing the hard drives, exposing the health information of up to 344,579 people.^[10] Different rulebook, same machine.

"Reset" is not the same as "wiped"

Deleting isn't overwriting. The FTC says deleting data or reformatting the drive "doesn't actually alter or remove the data." It can still be recovered with utility software.^[5]

Overwriting isn't always the answer either. The federal media-sanitization standard, revised in September 2025, warns that people who kept relying on overwrite techniques as storage moved to flash memory "can be exposing their data to increased risk." It also notes that some office equipment only offers a factory reset, which may just delete file pointers. That counts as "clear," the lowest of its three tiers (clear, purge, destroy).^[9] Ask which sanitize option your copier supports.

Pulling the drive yourself can backfire. Copier drives often carry firmware the machine needs, so removing one can leave a leased copier inoperable. The FTC says to use skilled technicians.^[5]

The same federal standard says purge or clear may beat destroy when you factor in "contractual obligations (e.g., lease returns)."^[9] Translation: the lease is a reason to wipe properly, not an excuse to skip it.

The two-year clock vs. the five-year lease

The Safeguards Rule requires procedures to dispose of customer information "no later than two years after the last date the information is used" for that customer, with exceptions for legitimate business needs and legal retention.^[1] A copier cache isn't a records-retention system. It's leftovers.

On Printree's published terms,^[16] a first-season scan on a never-overwritten drive could sit there 60 months on a 60-month lease, 2.5 times the two-year benchmark, or about 2.6 times on 63 months. The FTC's fix is boring and effective: use the security features, and "securely overwrite the entire hard drive at least once a month."^[5]

Small shop? The rule excuses firms holding information on fewer than 5,000 consumers from a few pieces, like the written risk assessment and the incident response plan. Encryption, disposal and service-provider oversight aren't on that list.^[1]

What a forgotten drive could cost, on paper

We haven't seen this math in a copier proposal, so we ran it on a hypothetical drive holding records for 1,000 clients.

• Federal. The tax code's civil penalty for a preparer who discloses return information is $250 per disclosure, capped at $10,000 per calendar year. If the disclosure is tied to identity theft, it's $1,000 each, capped at $50,000.^[11] Whether a returned drive is a "disclosure" depends on the facts.
• Massachusetts. Electronic media with personal information must be destroyed or erased so it "cannot practicably be read or reconstructed." The fine runs up to $100 per person affected, capped at $50,000 per instance.^[12] 1,000 × $100 is $100,000, so the cap kicks in at $50,000.
• New York. Up to $5,000, and acts from the same incident count as one violation. The law's definition of a record includes "computer tapes or discs," and data that's properly encrypted falls outside it.^[13]
• Texas is the twist. Its disposal law allows up to $500 per business record, but it doesn't apply to financial institutions as federal law defines them.^[14] The FTC puts tax preparers in that category,^[1] so for Texas tax firms the federal rule may be the one that counts. Ask your attorney.

Then there's reporting. Under the Safeguards Rule, if unencrypted information about 500 or more consumers is acquired without authorization, you have to notify the FTC within 30 days of discovery. Encrypted data doesn't count unless the key was exposed too.^[1] That's the best argument we know for turning encryption on today.

For scale: a Printree lease at $209–$349 a month is $12,540–$20,940 over a 60-month term ($209 × 60 and $349 × 60).^[16] The Massachusetts ceiling alone is 2.4 to 4 times the whole lease. Run your own term in the copier lease calculator.

Six things to do before your copier goes back

1. Put the copier in your WISP. Publication 5708 says to list every device that touches taxpayer data.^[7]
2. Turn on encryption and scheduled overwrite now. The FTC says these features come standard or as add-on kits.^[5] Encryption also changes whether a lost drive triggers the 30-day FTC notice.^[1]
3. Find the drive clause in your lease. The FTC says the contract should state that you keep the drives at end of life, or that the provider will overwrite them. Those services typically cost extra, but you may be able to negotiate when you're signing a new lease.^[5] The lease is still non-cancelable,^[15] so the drive won't get you out early. It's one more line to settle before the end date.
4. Get your copier tech's signature. Publication 5708's sample acknowledgment names the copier servicing company,^[7] and the Safeguards Rule wants service providers bound by contract.^[1]
5. Demand a certificate of sanitization. The federal standard's sample form records the make, model, serial number, method, tools and verification.^[9] If it doesn't list a serial number, it's a receipt, not a certificate.
6. Don't do it in April. If your lease ends in filing season, start the drive conversation now. Nobody does careful data work during the crunch.

How we handle it: our FAQ says encryption and automatic overwrite can be turned on when the copier is set up, and end-of-life drive wiping or drive retention is arranged at term end for regulated environments.^[15] Get that in writing with any provider, including us. Our accounting firm copier leasing page covers the rest of the tax-season setup, and if you want out early, here's how to get out of a copier lease.