TFN Redaction for Accounting Practices: What to Ask Any Tool

Almost every piece of ATO correspondence your practice handles contains a Tax File Number. That makes TFN handling one of the first things to get right when you store, share or process those documents, and one of the first things to examine when you adopt new software.

This post covers why TFNs are treated differently, the common ways redaction goes wrong, and the questions worth asking any tool that touches your clients' documents. It is general information, not legal advice. For your own obligations, check the Office of the Australian Information Commissioner (OAIC) guidance and speak to your adviser.

Why TFNs get special treatment

TFN information is regulated under the Privacy (Tax File Number) Rule 2015, issued under the Privacy Act 1988. In broad terms, the rule limits how TFN information can be collected, used, stored and disclosed, and it expects organisations to protect it against misuse and loss.

For a practice, the practical consequence is simple: the fewer places a TFN sits in the clear, the smaller your exposure if something goes wrong. A misdirected email, a shared folder with loose permissions, or a vendor breach all become less serious if the documents involved don't contain readable TFNs.

Where TFNs leak in a typical practice

Manual processes spread TFNs further than most people realise:

• Downloaded PDFs saved to desktops, downloads folders and shared drives
• Forwarded emails where a document is attached for a colleague or the client
• Scans and screenshots pasted into tickets, chats or notes
• Third-party tools, including any service that reads documents to summarise them

None of this is negligence. It's what happens when a document with sensitive data passes through several hands and systems.

Why "redacted" can mean very different things

Not every redaction is real. Common approaches differ a lot in how safe they are:

Visual overlay. A black box is drawn over the TFN, but the text underneath is still in the file. Anyone who selects and copies the area, or runs the PDF through a text extractor, can read it. This is the most common failure.

Redacting a copy. The tool produces a redacted version but keeps the original. The risk has been moved, not removed, because a readable TFN still exists in storage.

Redaction at the binary level. The TFN is removed from the PDF's underlying content, not just hidden on the page. Done before the document is stored or passed to any other system, it means no readable copy exists downstream.

The third approach is the strongest, and the difference is worth testing instead of assuming.

Questions to ask any tool

1. At what point are TFNs removed? Before storage? Before any AI or third-party processing? Or after?
2. Is the original unredacted file kept anywhere? Including backups and logs.
3. Is the redaction visual or in the file itself? Ask for a redacted sample and try selecting and copying the area.
4. Do TFNs appear in extracted text, summaries or emails the tool generates?
5. What happens when detection misses one? No detector is perfect. Ask how misses are caught and whether there's a review step.
6. Where is the data stored? Data residency affects your privacy position, and it should be answered specifically.

If the answers are vague, treat that as information.

A simple test for your own practice

Take a recent ATO notice from your own workflow, after the point where you'd normally share it, and try the following: open it, select the area where the TFN appears, and copy it into a text editor. If a readable number comes out, anyone with the file can get it too.

How ATOque approaches it

ATOque detects and redacts TFNs at the PDF binary level before the document is stored and before any AI processing, and the original unredacted PDF is not retained. You can read the details on the security page and the features page.

For a wider checklist of what to ask when you evaluate software, see ATO correspondence software: 10 questions to ask before you choose a tool. If you'd like to see this in action, join the waitlist.