Received another taxpayer's SARS information?
What a South African firm must do when SARS sends it another taxpayer's information by mistake: rule 8, POPIA's breach duty, and a record of each step.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa
A tax clerk opens a statement of account that arrived through eFiling for one of the firm's clients and finds someone else's name at the top. A verification letter lands in the practice's inbox for a taxpayer nobody in the firm has heard of. An assessment downloaded for a client turns out to belong to a different company with a similar name.
It happens, and the first instinct is usually to forward it around the office to ask "is this one of ours?". That instinct is the wrong one. South Africa's tax rules set out what a recipient must do, and the firm's own data protection duties sit alongside them. This article sets out both, and how to leave a clean record.
Rule 8: tell SARS, destroy it, keep nothing
SARS's Electronic Communications Guide quotes rule 8 of the electronic communication rules. It requires a person who receives information about another person that was not meant for them to:
- notify SARS without delay;
- follow SARS's process to destroy the information;
- not disclose it or retain it.
The guide is Issue 1, dated February 2015, and the rules it explains govern electronic communication with SARS, of which eFiling is the part a practice uses every day.
The three duties are short, but each closes off a habit. "Without delay" means the day it is found, not at the next team meeting. "Follow SARS's process" means the firm does not invent its own method of disposal. "Not disclose or retain" means no forwarding to colleagues, no copy saved "in case SARS asks", and no printout left on a desk.
Who handles it inside the firm
Decide this before it happens. A sensible arrangement is that whoever finds the misdirected information stops, does not forward it, and reports it to one named person, usually the firm's information officer or the partner responsible for tax. That person:
- notifies SARS and asks for its destruction instructions;
- confirms where copies exist: the eFiling download folder, the inbox, any shared drive it was saved to;
- destroys every copy as SARS directs;
- writes a short note of what happened and when.
The fewer people who see the document, the simpler the clean-up. That alone is a reason for a firm-wide rule against forwarding.
When it is also a POPIA matter
The POPIA text published on the government's page requires a responsible party that has reasonable grounds to believe personal information was accessed or acquired by an unauthorised person to notify the Information Regulator and the data subject as soon as reasonably possible.
When SARS sends your firm someone else's information, the information came from SARS, and your firm's immediate duty is the rule 8 process above. The mirror image is where the firm's own POPIA exposure usually lies. If one of your firm's clients has had their information sent somewhere it should not have gone, or if the firm itself forwarded a misdirected document onward, the firm needs to consider whether it is now the party that must notify.
The Regulator's step-by-step guide says security compromises are reported on its eServices portal, and that the organisation and its Information Officers must be registered before a report can be submitted. A firm that has never registered its officer will find that out at the worst possible moment. The process for reporting is covered in reporting a security compromise under POPIA.
Closing the doors it may have opened
POPIA's security condition, in the Act as published, requires appropriate, reasonable technical and organisational measures, including identifying foreseeable risks and regularly verifying and updating safeguards. A misdirected document is a good prompt to check whether it travelled further inside the firm than it should have.
In Achekam, three controls help with that check:
Shared links. If the document was shared from the firm's vault, it was shared with a named person by an e-mailed link that can be revoked, and every view and download is recorded. Revoke any link to it, and the record shows who opened it before you did.
Access to the client. Partners and administrators can restrict a client, or one engagement, to named people with a reason. If a misdirected document was filed against a client by mistake, restricting that client while the clean-up happens limits who can open it. The restriction is lifted rather than deleted later, with who did what and when recorded.
The change log. Record Governance keeps a log of changes to governed records, showing who did what, when and with what result, and the log can be checked for an unbroken chain. It covers records under record governance rather than every screen, so it supports the firm's own note rather than replacing it.
Recording what was done
Keep a short incident note on the firm's own file, with no copy of the misdirected information attached. It should show:
| Item | What to record |
|---|---|
| Discovery | Date, who found it, how it arrived |
| Containment | Who else saw it; links revoked; copies located |
| SARS | Date notified, how, and the destruction instruction received |
| Destruction | Date each copy was destroyed, and by whom |
| POPIA | Whether a client's own information was exposed, and the decision on notification with reasons |
If the same thing happens twice, the notes will show whether the cause was SARS's or the firm's own process. For the firm's wider duties, see POPIA for accounting firms holding client data.
The rule in SARS's own words
SARS's Electronic Communications Guide explains the electronic communication rules under the Tax Administration Act, including the rule on information received in error. Circulate the relevant page to every staff member who uses eFiling, together with the name of the person they should tell.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
