Why Client Tax Documents Should Never Arrive by Email

Email is not a secure channel for tax documents. Standard email protocols do not provide end-to-end encryption, which means client files containing National Insurance numbers, bank details, and addresses can be intercepted in transit, forwarded accidentally, or stored indefinitely on email servers. Under GDPR and most data protection frameworks, professionals who receive client documents by email may fail to meet the requirement for appropriate technical and organisational measures.

What Email Actually Does with Your Files

When a client sends you a tax document by email, here is what happens technically:

1. The client composes the email and attaches the file. The email sits in their outbox, unencrypted on their device.
2. The email travels from their mail provider to yours. This hop may or may not use TLS encryption. If either server does not support TLS, the email travels in plain text across the internet.
3. The email lands on your mail server. It is stored there, often indefinitely, along with the attachment. Anyone with access to that server (administrators, backup systems, or an attacker who breaches the server) can read the contents.
4. You download the attachment. Now the file exists in at least three places: the client's sent folder, your inbox, and wherever you saved it locally. Each copy is a potential exposure point.

At no point in this process is the document encrypted end-to-end. The email protocol (SMTP) was designed in the 1980s for plain-text messages. Encryption was bolted on later and remains optional, inconsistent, and invisible to the user.

GDPR Implications for Accountants and Professionals

Article 32 of the GDPR requires data controllers and processors to implement "appropriate technical and organisational measures" to protect personal data. Tax documents contain some of the most sensitive personal data that exists: government ID numbers, bank account details, income figures, and addresses.

Receiving this data through standard email is difficult to defend as an "appropriate technical measure" when secure alternatives exist. The key GDPR risks of email-based document collection include:

• Lack of encryption: Standard SMTP does not guarantee encryption. Even when TLS is used for one hop, the next server in the chain might not support it.
• Indefinite storage: Emails with attachments sit in inboxes and backup systems indefinitely unless actively deleted. GDPR's data minimisation principle (Article 5) requires that personal data be kept only as long as necessary.
• Accidental forwarding: One mistyped email address or careless "Reply All" can expose a client's entire financial history to the wrong person. This constitutes a personal data breach under Article 4(12) of the GDPR.
• Breach notification: If a data breach occurs through email compromise, you have 72 hours to notify the supervisory authority (Article 33). Proving what data was exposed in an email breach is far more difficult than auditing access logs from a purpose-built system.

Being GDPR-compliant does not mean you need expensive enterprise software. It means you need a system where data is encrypted in transit, stored with appropriate access controls, and handled with a clear data processing agreement. FileCollect includes a DPA on every plan, including the free tier.

Real-World Risks of Email Document Collection

Beyond the regulatory concern, email-based document collection creates practical risks that affect your firm every day:

Misdirected Emails

A client types one wrong character in your email address, and their passport scan, bank statements, and tax return land in a stranger's inbox. This is not a hypothetical scenario. The UK Information Commissioner's Office (ICO) reports that "data emailed to the wrong recipient" is consistently one of the top reported breach types. Once the email is sent, there is no way to recall it.

Email Account Compromise

If your email account is compromised (through phishing, password reuse, or a server breach), every client document you ever received by email is exposed at once. An attacker with access to your inbox has access to every attachment, every tax return, every bank statement, going back as far as your email retention goes.

Attachment Size Limits and Workarounds

Most email providers limit attachments to 25 MB. When clients need to send larger files, they resort to consumer file-sharing services (WeTransfer, Dropbox links with public access) that may not meet professional data handling standards. Each workaround introduces another system with its own privacy policy and data retention rules.

Email vs. Secure Document Collection

What to Use Instead of Email

The alternative does not need to be complex or expensive. It needs to meet three requirements:

1. Encryption in transit: All data must be encrypted via TLS during upload.
2. Controlled storage: Files should land in a system you own and control (like your own Google Drive), not on a third party's servers.
3. Data processing agreement: The service should offer a DPA that defines their obligations as a data processor under GDPR.

How FileCollect Handles Security

FileCollect is built for exactly this use case. When a client opens your upload link and submits a document, the file is encrypted via TLS 1.2+ during transit. It is temporarily held on EU-hosted servers (encrypted at rest with AES-256) for up to 24 hours while it is delivered to your Google Drive. After successful delivery, the temporary copy is purged.

FileCollect uses Google's drive.file OAuth scope, which means it can only access the specific folder it creates in your Drive. It cannot see, modify, or delete anything else. Your client never touches your Drive directly. They see a clean upload page, submit their files, and the documents arrive in your Drive named and organised.

A DPA is included on every plan, including the free tier. The infrastructure is hosted in the EU, and FileCollect never reads, analyses, or shares file contents. See our full security overview for details, and check pricing (free plan available, Pro at 19.99 EUR/month).

For a practical guide to building your document collection workflow, read how to stop chasing clients for documents. For a ready-made checklist you can send to clients today, see our 2026 tax document checklist.

What You Can Do Today

• Stop accepting client documents by email. Communicate this clearly to clients as a security improvement, not an inconvenience.
• Set up a secure upload link using a tool like FileCollect (free plan available). Send clients one link instead of asking them to email files.
• Update your engagement letters to state that you do not accept sensitive documents by email and provide your preferred upload method.
• Review your email inbox for existing client attachments. Consider deleting or archiving old emails that contain sensitive files you have already processed.