IRS employees cannot freely browse anyone’s tax records. They may access returns and return information only when they need it to perform official tax-administration duties. That rule applies to the particular information requested, not just to whether the employee works for the IRS; internal sharing also requires an official need on the recipient’s part.
What “need to know” means
IRS employees may access returns and return information only when they have a need to know it for their tax-administration duties, according to IRM 11.3.22.2.1. The employee’s job alone is not blanket permission to look up a taxpayer. Authorization depends on the employee’s official duties and the information needed for the work.
As an Amazon Associate I earn from qualifying purchases.
The same principle applies when one employee shares information with another. The employee proposing the disclosure is responsible for establishing that the recipient has an official tax-administration need. For requests for legal, technical, or procedural assistance, the manual describes checking that need case by case. When an identity is not necessary for assistance or training, staff should avoid sharing identifying details. Removing identifiers, however, does not necessarily make information unprotected if the remaining figures are original return information.
How federal law limits disclosure
Internal access takes place within a broader legal framework. Internal Revenue Code section 6103 generally restricts disclosure of federal tax returns and return information, while providing exceptions for specified recipients and purposes. The IRS describes section 6103(h) as allowing access by federal officers and employees for tax-administration purposes.
Other authorities are also purpose-specific. For example, the IRS describes section 6103(k)(6) as permitting certain disclosures needed to obtain otherwise unavailable information in official audits, collection work, and civil or criminal tax investigations. These defined authorities do not create a general license to inspect records out of curiosity or for personal reasons.
What safeguards apply to access
The IRS’s Unauthorized Access to or Inspection of Taxpayer Records (UNAX) program covers employees and contractors, including certain vendor and outsourcing personnel with staff-like access. The UNAX manual describes required training and background investigations before access to sensitive information is granted. The manual page says its current version took effect April 21, 2026, superseding the March 8, 2023 version: IRM 10.5.5.
Audit records are another safeguard. IRS Safeguards guidance says records should allow the agency to reconstruct successful and unsuccessful access attempts and other material system activity. The guidance lists events such as logins and logoffs, authorization failures, privileged-user activity, changes to access rights, and the responsible user or account, along with the event’s date and time. Audit trails themselves should be protected against unauthorized access, deletion, or alteration: IRS Publication 1075.
The IRS also describes proactive auditing signals, including unusual access volume, access to records an employee previously viewed despite no current assignment or need, and patterns involving a small geographic area or restricted taxpayer identifiers. Such signals can prompt review; on their own, they are not proof of misconduct.
What happens if someone looks without authorization
The IRS calls willful unauthorized access to or inspection of taxpayer records UNAX. Its disclosure-awareness material identifies IRC section 7213A as the relevant misdemeanor provision. The IRS says willful unauthorized access can carry a fine of up to $1,000 and up to one year in prison, and describes potential civil damages under section 7431. Those are general descriptions; the precise consequences depend on the statute and the facts of a case. See the IRS’s UNAX guidance.
IRS managers and employees are instructed to report suspected willful unauthorized access, inspection, disclosure, or related Privacy Act violations promptly upon discovery, as described in IRM 10.5.5.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the public guidance does not establish
Public IRS material describes the need-to-know rule, UNAX program requirements, audit logging, and monitoring signals. It does not establish one universal approval chain or access-review schedule for every IRS system. A particular system may have additional procedures, but those should not be assumed to apply across the agency.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
