When contractors handle confidential taxpayer data, what measures should tax administrations implement?

• A. Strict access controls
• B. Public disclosure of access logs
• C. No special measures beyond internal policies
• D. Relaxed confidentiality agreements

Answer: (A)

When external contractors handle confidential taxpayer data, the most important protection is restricting and carefully monitoring who can access that data. This means strict access controls: grant only the minimum data and the minimum level of access each contractor needs to perform their work, enforce strong authentication and role-based permissions, separate duties where possible, and require regular reviews of who has access along with robust audit logs. These controls create accountability and reduce the chance of improper viewing or leakage, which is crucial when third parties are involved.

Publicly disclosing access logs would expose sensitive information and could undermine privacy and security. Relying only on internal policies without technical enforcement leaves safeguards to human compliance, which is unreliable in practice. Relaxed confidentiality agreements weaken protection and could run afoul of legal and regulatory requirements. By implementing strict access controls, tax administrations better protect confidential data and maintain trust while contractors perform their duties.