Collecting Tax File Numbers Safely: The TFN Rule Explained

What the TFN Rule asks of an employer, and how to collect tax file numbers without leaving copies lying around.

A tax file number is one of the most sensitive things a new employee hands you. It also arrives at the busiest moment of hiring, which is when it tends to land in an inbox or a spreadsheet.

There is a specific set of rules for it. Here is what they ask, in plain terms.

Who can ask for a TFN

Only certain organisations can ask for a tax file number. The OAIC lists employers among them, along with the ATO, banks and super funds.

An employer collects it through the tax file number declaration. The ATO uses the details on that form to work out how much tax you withhold from the person's pay, as set out in its payer information and obligations.

The person doesn't have to give it to you

"There is no law that says you must give your TFN" to an organisation allowed to ask for it, according to the OAIC. But there are consequences: the person may pay tax at the highest marginal rate.

For an employer, the ATO is specific. If a new employee has applied for a TFN, they have 28 days to give it to you, and you withhold at the standard rate in the meantime. After that, you withhold the top rate of tax unless the ATO tells you otherwise.

When you ask for a TFN, the OAIC's TFN Rule guidance says you must tell the person which law lets you collect it, that it is not an offence to refuse, and what happens if they do.

The TFN Rule applies to small businesses too

Most small businesses (annual turnover of $3 million or less) are not covered by the Privacy Act. Tax file numbers are an exception, even if the wider Australian Privacy Principles don't apply to you.

The Privacy (Tax File Number) Rule 2015 sits under the Privacy Act, and "any individual, organisation or agency that is allowed to ask for your TFN information must follow the TFN Rule", the OAIC says. A breach of the Rule is an interference with privacy under the Privacy Act.

What the Rule asks

The OAIC's guidance boils down to four things:

• Only collect and use it for an authorised purpose. For an employer, that means tax and super law. Don't use it as a general ID number or to match people across your other records.
• Protect it. Take reasonable steps to keep TFN information safe from loss, unauthorised access, use, modification and disclosure, on paper and on screen.
• Limit who can see it. Only staff who need to handle TFN information should have access to records that contain it.
• Get rid of it when you're done. Once no law requires you to keep it and you no longer need it for an authorised purpose, securely destroy it or permanently de-identify it.

The guidance gives practical examples: strong passwords, audit logs that track who accessed the information, and secure storage for paper files.

In practice

Don't collect it by email. The ATO says plainly: don't ask your payee to send their TFN declaration information by email, because it is not a secure channel.

Keep it out of shared spreadsheets. A spreadsheet on a shared drive is easy to copy and hard to restrict. Limiting access is one of the Rule's requirements, so keep TFNs somewhere you control who can open them.

Restrict access to the people who run payroll. Nobody else on the team needs to see a TFN.

Know how long to keep it. The ATO lists TFN declarations among the employment and payroll records an employer keeps for 5 years, counted from when you made or received the record or completed the transaction it relates to, whichever is later. Its TFN declaration guidance also covers keeping an earlier form after a new one replaces it, and keeping the last form after someone stops being paid. Check what applies to you.

Then delete it. When the retention period ends, destroy or de-identify the record, including any copies in inboxes, downloads folders and backups you control.

If TFNs are exposed

The Notifiable Data Breaches scheme applies to anyone holding TFN information, to the extent TFN information is involved in a breach. The OAIC's guidance gives "small businesses that are required to secure tax file number information" as an example.

A breach is notifiable when someone gets unauthorised access to the information, or it is disclosed without authority, and that is likely to result in serious harm you haven't been able to prevent. If you suspect one, you must take all reasonable steps to assess it within 30 days. If it is notifiable, you tell the OAIC and then the affected people, each as soon as practicable. The OAIC has an online form for the notification.

This is a summary, not legal advice. For your own situation, read the OAIC's TFN guidance and the ATO's payer obligations, or ask your accountant.

How WorkZerk handles it

In WorkZerk, a request marked Sensitive is encrypted with a key held apart from the database, masked for your team, viewable in full only by admins, and every view is logged. The TFN declaration in the starter request packs is already marked Sensitive, and you can set sensitive answers to be deleted automatically a set time after a portal closes. See keeping sensitive information private or staff onboarding in Australia.