Some examples and categories of IRS SBU data include, as outlined in the tables in this subsection:

This table lists some examples of the (FTI) category of SBU data. Refer to IRM 10.5.1.2.4, Federal Tax Information (FTI), for more information about FTI.

This table lists some examples of the privacy (PII) category of SBU data. Refer to IRM 10.5.1.2.3, Personally Identifiable Information (PII) for more information.

This table lists some examples of other categories of SBU data.

Documents previously designated as Official Use Only (OUO) and Limited Official Use (LOU) include SBU data. Treasury policy requires using SBU data to describe such documents. [TD P 15-71]

Examples and categories of PII may include the following, when used to distinguish or trace an individual’s identity, or when combined with information that is linked or linkable to an individual:

Email addresses, by themselves as the method of the email conveyance, do not need encrypting, but when combined with the content and attachments of an email, the email address may become SBU data.

As for other SBU data and PII in the public record or publicly available, the requirements differ, depending on the information.

Context is important. PII that does not seem high risk or sensitive may still require protection if its context makes it risky or sensitive. For example, a collection of names in a list, file, or query:

The IRS makes its privacy policies and practices readily available to individuals, such that we inform individuals of the collection, use, retention, and disclosure of their PII, and we get individuals’ consent to the greatest extent practical. For purposes of this privacy principle, consent may sometimes be express or implied. This statement does not replace any requirement for prior written consent under 5 USC 552a(b) or any other applicable law.

Agencies may share space under Executive Order 14274, Restoring Common Sense to Federal Office Space Management-The White House, and OMB M-25-25, Implementation of Utilizing Space Efficiently and Improving Technologies Act PDF.

For unescorted staff-like access, other non-IRS agency personnel must access space with a personal identity verification (PIV) card and meet requirements like those in IRM 10.5.1.6.15, Contracts, and IRM 10.2.18.6.1, Unescorted Access, including:

The greater the potential for harm, the more at risk the SBU data becomes. As outlined in NIST SP 800-122:

We must protect all SBU data (including PII and FTI). Limit what SBU data we share based on:

[Purpose Limitation, Strict Confidentiality]

Externally: Only share SBU data (including PII and FTI) with authorized individuals outside of IRS, in encrypted files, if you meet all these conditions:

If creating new spreadsheets or databases that include SBU data (including PII and FTI) from a larger file or database is necessary, consider whether it requires a PCLIA. [RA-08]

Redacting, masking, or truncating tax information does not change its nature. It is still tax information.

System and information owners, based on responsibilities in IRM 10.8.2.3, IT Security Roles and Responsibilities, must implement and maintain the technical capabilities that support data classification processes and sensitivity labeling, including:

End users are IRS personnel who create, modify, access, or share data as a part of their assigned duties. End users handling data in their daily duties must:

The applied sensitivity label must align with the highest level of sensitive information stored within the site. Site sensitivity labels control access, restrict sharing based on authorized need to know, and apply proper protections. Apply the following site sensitivity label rules:

The IRS uses automated tools where technology feasible to enforce protections, identify incompatible data, and correct content to align with site sensitivity labels.

Identify: Collect information about IRS data assets, including structured and unstructured data such as file type, metadata, and content, as close as possible to the time of their creation, discovery, or import.

Analyze: Evaluate data to determine its sensitivity based on content, context, and applicable classification criteria.

Label: Apply sensitivity labels to data based on data classification decisions and embed labels as metadata to support protections and handling requirements.

Mark: Apply required visuals or embedded markings (such as CUI banners, headers, footers, or watermarks) to communicate data sensitivity.

Protect: Apply cybersecurity and privacy controls to protect data based on its classification.

Train: Provide training to personnel on data classification and sensitivity labeling requirements.

Monitor: Monitor data assets and systems for classification accuracy, labeling consistency, and compliance with protection requirements.

When possible, conduct cellular phone conversations in a private setting (and not in a crowded public setting) to minimize the potential for eavesdropping. Cordless devices are rarely, if ever, used outside of a person’s home and do not lend themselves to conversations in crowded areas, but can still pose a risk of someone overhearing a conversation that the taxpayer does not want overheard.

For contacts initiated by IRS personnel that discuss SBU data (including PII or FTI), you must inform the other party you are calling from a cell phone or other cordless device when in a public place where others could overhear sensitive information. This will alert the other party of the potential for the inadvertent disclosure of their tax information. When calling from a private setting where others cannot overhear the conversation, you don’t have to say the call is originating from a cell or cordless phone.

Even when you don’t expect to discuss sensitive information in a call from a public place, you still should consider telling the other party you are using a cell phone or other cordless device in case a sensitive issue comes up in the discussion.

This supports reasonable belief:

When you can’t positively identify the number reached as the taxpayer’s or representative’s, ask for a return call without giving the taxpayer’s name, if practical. If the call is in response to an earlier taxpayer inquiry or request, say the call is in response to an earlier inquiry or request. In such a case, you must not say the nature of the original situation nor reveal any specifics about the return call if it involves sensitive information.

Except as authorized by the temporary policy in Temporary Flexibility for Encrypted Emails with Taxpayers and Representatives, do not send emails that include SBU data (including PII and FTI) to taxpayers or their authorized representatives, even if requested, because of the risk of improper disclosure or exposure.

When taxpayers request email contact and accept the risk of such, limited allowable situations without risking unauthorized disclosure of SBU data include:

When responding to unrequested emails from taxpayers or tax professionals, respond by letter or phone if possible; if address or phone number are not available, respond by email. You must:

A sample response to unrequested emails:

If you are authorized to email SBU data to authorized recipients, you may email SBU data (including PII and FTI) to those external stakeholders using IRS IT-approved encryption technology (review IRM 10.5.1.6.8, Email and Other Electronic Communications) only when the:

Do not encourage or suggest stakeholders email SBU data (including PII and FTI) unencrypted or outside of a previously approved secure email program.

IRS personnel must use IRS email for email communications with other IRS personnel about official business matters. They must encrypt the body of all internal email messages with SBU data (including PII and FTI) using IT-approved encryption.

Personal Information – You may send your own SBU data (including your PII and your FTI) to or from your personal email accounts, if you encrypt it with IT-approved encryption. Examples may include your own:

Training or publicly available information – You may send non-case-related content, including links, to and from yourself when IT Security constraints prevent access. Examples of this include online training or meetings, such as webinars and seminars, as well as publicly available information (including public profile photos or business photos intended for publication with permission of pictured individuals).

Exigent circumstances, such as in emergencies. This includes when the IRS network is down and there is an urgent need to communicate or in disaster recovery situations, and you do not have other options. Limit SBU data to that necessary for the situation. Encrypt necessary SBU data with IT-approved encryption. Examples may include:

After evaluating business needs with potential risk, refer to the following limited exceptions for encryption in external emails. You must encrypt any SBU data with IT-approved encryption beyond these exceptions. Review IRM 10.5.1.6.2, Encryption.

For secure external communication, we strongly recommend using IRS secure alternatives to email to protect privacy and security. Review IRM 10.5.1.6.8, Email and Other Electronic Communications. These alternatives include:

When IRS personnel carry SBU data (including PII and FTI) in connection with a trip or during daily activities, they must protect it and keep it with them when possible.

Field employees might have SBU data needing protection while temporarily stored at the taxpayer's site.

When sending SBU data by mail within the U.S. and Territories (serviced by USPS):

When sending SBU data to offices Overseas:

You must ship packages with SBU data (including PII and FTI) that weigh 13 ounces or more through a private delivery carrier.

For shipping electronic media, including removable media such as USB drives and other portable storage devices, you must encrypt it first. Refer to IRM 10.8.1.4.10.4, MP-05 Media Transport.

For all SBU data shipments through a private delivery carrier, the sender must follow the procedures included below for properly double packaging, double labeling, and tracking the shipment, including the use of Form 3210, Document Transmittal (or equivalent). Whether you use a Form 3210 or its equivalent, you must include enough information on the transmittal to identify the package contents in case of its loss or disclosure, so the IRS can notify affected individuals and take steps to decrease the possibility that the information will be compromised or used to perpetrate identity theft or other forms of harm.

When shipping SBU data through private delivery carrier, you must use UPS CampusShip at all non-Campus locations and non-FMSS-contract-mailroom-supported offices; Campus locations and FMSS-contract-mailroom-supported offices may use UPS CampusShip, but it is not mandatory at those locations. UPS CampusShip is an internet-based shipping system that you can access from any location that has internet access. The IRS has rolled out UPS CampusShip across the country to IRS field offices not serviced by a FMSS contract mailroom. Find information about UPS CampusShip:

CampusShip allows employees to:

You must double-package and double-label SBU data packages before shipping. Double-packaging helps protect the contents if the outer package is damaged or destroyed during the shipping process. Duplicate shipping labels allow proper delivery of the contents without potential disclosure if the external package is damaged or destroyed.

The sender must also decide whether to ship via ground service or express (Overnight and Second Day Air) services:

For all SBU data shipments through a private delivery carrier, the sender must prepare Form 3210, Document Transmittal (or its equivalent), identifying the package contents for all packages with SBU data and asking for recipient acknowledgement. This practice includes shipments to IRS offices, contractors, and external agency partners, when applicable. For external partners, use an equivalent to Form 3210. Whether you use a Form 3210 or its equivalent, you must include enough information on the transmittal to identify the package contents in case of its loss or disclosure, so the IRS can notify affected individuals and take steps to decrease the possibility that the information will be compromised or used to perpetrate identity theft or other forms of harm.

Internal packaging may include any of the following:

Label the internal package with the following information:

Place the properly labeled, packaged, and sealed internal package into the external package. External packaging materials may include:

Use enough packing material inside the package so the contents do not move or shift when shaken.

Do not mark or label external packaging material with information showing that package contents include sensitive information. You can mark packages as "time sensitive" or "process immediately" as applicable to ensure prompt processing. Labels that show sensitive contents include:

Once received, the recipient will verify receipt of the contents and sign the acknowledgment copy of the Form 3210 (or equivalent). The recipient will return the Form 3210 (or equivalent) acknowledgement to the sender using secure email (electronic or scanned copy), fax, or mail. If the SSN was not redacted as required on the Form 3210 (or equivalent), redact all but the last four digits of the SSN before returning it to the sender.

If the tracking information shows the package arrived, the sender must contact the intended recipient to confirm actual receipt of the package.

Protect printed documents with SBU data and follow the IRS clean desk policy in all work locations (including field and telework). Review IRM 10.5.1.5.1, Clean Desk Policy.

Any other text messaging (texting) for official business remains prohibited.

External electronic transmission and online data exchanges address uploading or downloading, secure file transfer, file sharing, peer-to-peer (P2P), collaborative technology and systems, third-party sites (commercially available file-sharing sites in the cloud or private file-sharing on remote servers), and blocked or blacklisted sites.

Do not post or upload SBU data (including PII and FTI) online, including IRS official internal or external websites or cloud-based systems or services, unless secured with IT-approved access controls by the IRS (or by an IRS vendor bound by contract to protect the information). [NIST SP 800-122; TD P 85-01]

Use only IRS identifiers (name or email) when conducting official business.

When moving an office or material, make plans to protect and account for all SBU data (including PII and FTI), as well as government property. Consider the relevant factors of the move (such as the distance involved and the method used in making the move).

Place hardcopy waste material with SBU data in locked receptacles specifically marked for sensitive document destruction (SDD or shred bins). This includes material shredded with non-compliant equipment that does not meet requirements.

For microforms with SBU data (microfilm, microfiche, or other reduced image photo negatives): [NIST SP 800-88, Guidelines for Media Sanitization]

For temporary storage, while waiting for destruction of sensitive waste, you don’t have to put it in a locked receptacle if you follow these requirements for burn bags or shred boxes:

[TD P 15-71, Treasury Security Manual, Chapter III, Section K, Storage and Destruction]

If an independent contractor collects and destroys tax information media, to prevent the necessity of having an IRS employee present during destruction, the contract must include the safeguard provisions required by IRC 6103(n) and regulations.

Report the loss or theft of a GPS device with taxpayer addresses (whether a government-issued GPS or a personally-owned GPS), as a potential data breach of PII:

Except for the use of a GPS in IRM 10.5.1.6.11.1, Global Positioning Systems (GPS), we strongly encourage you not to use your personal devices (such as phones, tablets, fitness watches, or wearable devices) or applications on them to identify taxpayer or work addresses with location services (geolocation), geotagging, or GPS features of any social media accounts (such as Facebook Check In™ or Find My Friends™). Geotagging pinpoints location, which might inadvertently reveal a taxpayer’s home or business, or show activities and location at an IRS office. You should use an IRS-furnished device (if issued) when finding and receiving directions to taxpayer addresses.

Widely available electronic recording and monitoring technology (such as online meetings, Microsoft 365 Teams™/Copilot™ digital cameras, smartphones, and smart devices, such as Meta™ Glasses) raises privacy and security concerns. For more details review:

Privacy concerns for recording (including audio, video, transcription, photographic, or infrared) in the workplace or while conducting official business center around individual employee privacy, the potential disclosure of SBU data (including PII and FTI), data minimization, and federal records creation and retention. When deciding to record, you must consider the sensitivity of the topic being discussed and apply the approval, consent, and safeguarding requirements in this subsection, in the context of IRM 10.5.1.3.2, IRS Privacy Principles.

If you must record in the workplace, you need these elements for authorized recording:

Business need: Record meetings, conversations, or other workplace activities only when there is a legitimate business need and the recording meets the approval, consent, and safeguarding requirements in this subsection. Avoid recording solely for convenience or to preserve meetings for later review. Examples of legitimate business needs that allow for limited recording in the IRS workplace with approval and consent include:

Consent: If you must record, get consent to record from all participants. For example, before you record, announce why you need to record and ask for consent. They can give explicit consent (verbal or by other action) or give implied consent after notice of recording by staying on the call or in the meeting. If you intend to disclose the recording for a legitimate business need, get written consent, such as via Form 15293, Consent for Disclosure of Non-Tax IRS Records Protected under the Privacy Act. Refer to IRM 10.5.6.2.3, Privacy Act Consent to Disclosure. For photo or video in IRS publications, use Form 14483-A, Model/Photo Release, instead of Form 15293, Consent for Disclosure of Non-Tax IRS Records Protected under the Privacy Act.

Monitoring of the public outside IRS facilities must not occur without first consulting Privacy Policy [Treasury’s Privacy and Civil Liberties Impact Assessment Template and Guidance]. For help, email *Privacy.

All IRS contracts, with few approved exceptions, must include the entire current version of the SBU data privacy requirements language (formerly contract clauses) found on the IRS Acquisition Policy (IRSAP) site Index C (pdf):

[PM-17; SA-04]

In addition to the SBU data contract requirements language, include in the solicitation, request for proposal, contract, statement of work (or similar document, such as task order, performance work statement, or statement of objectives), and work order [Privacy Act; IRC 6103(n)]:

For position risk designations, following IRM 10.23.2.5, Position Risk Designations:

The overarching, general IRS internet privacy policy notice at IRS.gov/privacy (IRS Privacy Policy page) informs the public of the information collection procedures and the privacy measures in place for its public-facing websites and digital services. It gives useful information that the public would need to make an informed decision about whether and how to interact with the IRS online. [OMB M-23-22; OMB M-10-23; E-Government Act; OMB A-130; OMB M-03-22; Openness and Consent; PM-20; PT-05]

The OMB requires the following for an agency’s privacy policy page, as shown by the IRS Privacy Policy page :

A unique Privacy Act statement for a public-facing website or digital service must include a link to and detail any differences from the IRS Privacy Policy. This statement must appear at the point of collection, which means at the entry point where the data collection differs from the IRS Privacy Policy. While the IRS Privacy Policy serves as an overarching general notice, your website or digital service needs to tell the public what different information you collect. It serves as the online version of the Privacy Act notice described in IRM 10.5.6.4.2, Notice to Individuals Asked to Supply Information (Privacy Act Notice). This policy applies to any public-facing website or digital service hosted by or for the IRS. [Privacy Act; OMB M-23-22; OMB M-10-23; E-Government Act; OMB A-108; OMB A-130; OMB M-03-22, Openness and Consent; PT-05; PT-05(2)]

Any IRS internal or publicly accessible website that links to external sites that are not part of an official government domain must label or distinguish non-governmental content, including links to third party websites. This label, also known as a privacy departure notice, alerts visitors that they are about to leave the IRS website and its privacy practices. [OMB M-23-22; OMB M-10-23; Openness and Consent; PT-5]

The IRS addresses this by:

The IRS uses the IRS Intranet Privacy Policy and Privacy Act Statement for internal, non-public facing websites and digital services as a modified version of the IRS Privacy Policy. [OMB M-23-22; E-Government Act; OMB M-03-22; Openness and Consent; PT-05(2)]

IRS internal digital services also require an online Privacy Act statement if they collect personnel PII. This must be at the point of collection or via a link. [OMB M-23-22] A link to the IRS Intranet Privacy Policy and Privacy Act Statement meets this requirement for all internal digital services that only collect personnel PII for access and audit trail purposes.

You must not post SBU data (including PII and FTI) on public calendars with uncontrolled access.

The following applies any time a business needs to enter some form of SBU data (including PII and FTI) on a shared calendar:

Use this table for other calendar entries:

Online meeting tools include M365 Teams™, Zoom Workplace™, and AdobeConnect™. Use only IRS IT-approved tools as they will have the necessary authorization and protections, such as encryption, so you can do business with necessary SBU data (including PII and FTI) in a secure environment.

When using approved virtual meeting tools with encrypted communication for official IRS business, you must apply these principles:

When putting SBU data (including PII and FTI) on shared storage, check to make sure only those with a need to know have access. Sharing data in collaborative data environments (such as a SharePoint™ site, a group or team site in Teams™, or your OneDrive™) might offer valuable benefits with inherent privacy risks. Understanding the risks involved with sharing data on these sites is key to managing those risks with tight access, privacy, and security controls in place. Collaborative environment access controls must limit access using proper site, folder, file, or other permissions.

The IRS PCLIA process addresses privacy concerns for IRS systems with SBU data (including PII and FTI) using cloud computing. These issues include:

The roles listed in IRM 10.24.1.1.3 , Roles and Responsibilities, list accountability for IRS personnel who use AI and generally align with roles described in the Audience section of this IRM. A crosswalk of some key roles identified in both policies includes:

Make sure safeguards are in place to purge data or otherwise prevent unauthorized re-disclosure after authorized AI use.

For more information about disclosure policy, refer to the IRM 11.3 series, Disclosure of Official Information. For more information about reporting incidents and data breaches, refer to IRM 10.5.4.3, Reporting Losses, Thefts and Disclosures.

Be transparent about your use, design, or implementation of AI. In the context of AI, the IRS privacy principle of openness includes the ability to understand how the AI made the decision. Without unduly exposing sensitive information, describe the AI decision-making process in the privacy documentation, such as a PCLIA or AI risk assessment. This documentation informs individuals about the uses to which they consent when they provide data. [Privacy Act sections (e)(2) and (e)(3)]

To the greatest extent practical, disclose what content was created with the help of and how AI tools were used (for example, drafting or editing), if you use an AI tool to create a business product (such as an email, guidance document, news article, or computer code). Refer to IRM 10.24.1.7, Generative AI (GenAI) Policy.

IRS provides openness about AI use, which helps taxpayers understand consent requirements and expectations, as described in IRM 10.5.2.2.6, PCLIAs on IRS.gov, and IRM 10.24.1.5, AI Use Case Inventory.

Only share data with an AI tool authorized to receive the information for the performance of official duties. The IRS privacy principle for strict confidentiality requires IRS users, developers, and providers of AI to protect data and share it only with authorized individuals and systems. [Privacy Act section (b); IRC 6103]

IRS personnel must be sure the AI tools they use are authorized for IRS use. You must not share SBU data with public AI tools, like ChatGPT or Google’s AI tools. Sharing such data may be an unauthorized disclosure of sensitive information. Refer to IRM 10.5.5, IRS Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program Policy, Guidance, and Requirements.

PETs apply the privacy principles via techniques designed to enable the collection, analysis and sharing of information while protecting data confidentiality and privacy. Common PETs include:

Use of SSNs is acceptable when any of these options mandates such use:

You must use Form 14132, Social Security Number Retention Justification for Forms, Letters, Notices, and Systems, for new and revised products with SSNs during the Publishing Service Request (PSR) and Office of Taxpayer Correspondence (OTC) Request for Services processes. The completion of this form will make sure requesters evaluate the need for using an SSN while also allowing Privacy to effectively track the use of SSNs within correspondence process. Procedures include creating or revising:

Non-tax forms (Media and Publications): Media and Publications can not process Request for Services for new forms with SSNs, or revised forms with a change to a TIN field, until OTC receives verification of a signed Form 14132. This table outlines the process:

IRS correspondence (OTC): OTC can not process Request for Services for new forms with SSNs, or revised forms with a change to a TIN field, until OTC receives verification of a signed Form 14132. This table outlines the process:

Tax forms (Tax Forms and Publications): This table outlines the process:

Consider how we use the SSN throughout the information lifecycle (reviewing all forms, notices, letters, and systems), and consider the following about SSN data:

When Creating New Forms, Notices, Letters, and Systems: Business and system owners must practice due diligence when creating new forms, notices, letters, and systems to make sure they apply the necessary-use criteria. Use this table:

To meet this control, you must follow the policies in this IRM on the individual access control, including:

Follow the otherPrivacy and IRS policies that supplement the individual access control, including:

To meet this control, you must follow the policies in this IRM on the limit personally identifiable information elements control, including:

Follow the other Privacy and IRS policies that supplement the limit personally identifiable information elements control, including:

To meet this control, you must follow the policies in this IRM on the audit record retention control, including:

Follow the other Privacy and IRS policies that supplement the audit record retention control, including:

To meet this control, you must follow the policies in this IRM on the plan of action and milestones control, including: