EP8750 - Security of taxpayer records: Overview

Bottom of Page

Manual Contents

All information concerning a taxpayer is confidential. The Security Assurance Manual and the Departmental Security Manual/Computer Misuse Policy cover the extent of confidentiality.

The following instructions are about the security of taxpayers' records held on the computer.

The COP/CODA security arrangements;

allow office management to control and record which staff have access to records for different levels of work
provide an operator with access to, and means to amend, taxpayers' or employers' records in an office by using functions which the operator is authorised to use
give authorised users the means to trace other taxpayers' records using the National Insurance number or name and address.
deny access to anyone with no legitimate need.

Note: Under COP Wider Access, operators now have view and update access to all records within the same COP mainframe, managers must inform staff that they must only access records for which they have a legitimate business need.

Accessing customer records and use of information retrieval facilities

You must only use the computer tracing facilities for your work and not to trace information for entertainment, personal or casual interests. You must only access a customer record where you have a clear and unambiguous reason for doing so. You must not access or attempt to access a customer record, including your own, held on HMRC databases

for curiosity
for any personal non-business related reason
where there could be a conflict of interest, either real or perceived
to check the compliance status of a customer for personal reasons
that relates to you or your spouse, partner, family or friends.

Computer records include the main business file(s) and records containing, for example, personal addresses.

HMRC will take any breach of this policy very seriously. Breaches will result in disciplinary action leading to possible dismissal. Accessing customers’ records without a legitimate business reason will normally result in dismissal. In cases where fraud or disclosure of the information is involved prosecution could also follow.

In day to day work, if you inadvertently access a record of a relative or someone known personally to you, you must notify your manager immediately.

Top of Page

Manual Contents

Information about this page - link will open in a new window