kitlegaliaPTIN renewal and your WISP: what the IRS asks you before December 31
Every PTIN issued for 2026 expires on December 31, 2026. When you renew, the IRS asks you to confirm, in writing, that you know you must have a data security plan. If you check that box without a plan on file, you are confirming that you know about a duty you have not met.
What Form W-12 actually asks
Form W-12 is the PTIN application and renewal. Line 11, "Data Security Responsibilities", reads: "I am aware that paid tax return preparers must have a data security plan to provide data and system security protections for all taxpayer information." (Form W-12, Rev. October 2022)
It does not ask you to upload your plan. It asks you to confirm that you know the obligation exists, and from that moment, "I didn't know" is no longer an answer.
The key dates
- December 31, 2026: PTINs issued for 2026 expire (NATP, Oct 19, 2026). You need a valid PTIN to prepare returns for compensation in 2027.
- The fee: the IRS lists a PTIN application or renewal fee of $18.75 (IRS PTIN FAQ).
- Late January 2027: filing season opens. After that, there is no time to write a security plan.
Where the obligation comes from
The data security plan is not an IRS invention. Under the Gramm-Leach-Bliley Act, tax preparers are financial institutions, and the FTC's Safeguards Rule (16 CFR Part 314) requires them to have a written information security program. In August 2026 the IRS repeated it plainly: "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan." (IRS news release IR-2026-92)
The IRS's own guide to writing one is Publication 5708, and its security checklist is Publication 4557, Safeguarding Taxpayer Data.
What your plan needs before you renew
- A named person in charge of the program (the "Qualified Individual").
- A written risk assessment of where client data lives and what could go wrong.
- Safeguards for those risks: access controls, encryption, multi-factor authentication, secure disposal.
- Staff training and a record that it happened.
- Oversight of service providers that touch client data, such as your tax software, cloud storage or IT support.
- An incident response plan, including the FTC notice for breaches affecting 500 or more people.
We cover each element, with the exact rule text, in The FTC Safeguards Rule for tax preparers.
A simple order of work for the next ten weeks
- This week: list every place client data is stored, including email and phones.
- Next week: write the plan and the risk assessment.
- Before December: train your staff, sign the plan, and file it where you can show it.
- Then renew your PTIN, and check line 11 knowing it is true.
Build your WISP before you renew
The WISP Builder turns your answers into a written plan, risk assessment and incident response plan. $199 for the 2027 edition, works offline.
See the builderFrequently asked questions
Do I have to upload my WISP when I renew my PTIN?
No. Line 11 of Form W-12 asks you to confirm you are aware that paid preparers must have a data security plan. It does not ask for the plan itself.
When does my PTIN expire?
PTINs issued for 2026 expire on December 31, 2026. You need to renew for 2027 to prepare returns for compensation.
Is a WISP required by law or only recommended by the IRS?
It is required. Tax preparers are financial institutions under the Gramm-Leach-Bliley Act, and the FTC Safeguards Rule (16 CFR Part 314) requires a written information security program.
Is there an official template?
Yes. IRS Publication 5708 explains how to create a written information security plan and includes a sample. A builder fills it in from your answers so it describes your actual firm.