Updated Checked by the Tax-Services.ca editorial team How we check
Accounting data security comes down to a short list: strong sign-ins, backups you can restore, updates that install themselves, and a written plan for the day something goes wrong. The Canadian Centre for Cyber Security lists 13 baseline controls for organizations under 500 employees, and most of them cost more attention than money. The CRA also expects you to keep your books for six years, so a lost laptop is a tax problem as well as a privacy one.
What makes books worth stealing?
Your ledger holds bank details, client names, payroll files with Social Insurance Numbers and the login to your GST/HST filing. One stolen spreadsheet gives a fraudster enough to phone your bank and sound convincing.
Small firms often assume nobody would bother, and that hope lasts until a bookkeeper’s mailbox is taken over and a fake invoice goes out under your name. The Cyber Centre says cybercrime is the threat most likely to reach small and medium organizations in Canada, and its baseline cyber security controls were built for exactly that threat. Size is no shield.
Which controls do the most work?
You don’t need all 13 on day one. Start with the ones that stop the common attacks.
| Control | What the Cyber Centre says |
|---|---|
| Strong sign-in | Use multi-factor authentication wherever possible, and treat financial, admin and cloud accounts as mandatory |
| Updates | Turn on automatic updates for software and hardware if the option exists |
| Backups | Keep copies off site, and store long-term (for example weekly) copies offline |
| Test restores | Practise restoring, so you know a backup works before you need it |
| Incident plan | Write down who handles an incident and who to call, and keep a paper copy |
Look at that backup row again. A backup that sits on the same network as your accounting file can be locked by the same attack. The offline copy is the one that saves you.
Data back ups are a critical piece of the effort to ensure quick recovery not only from cyber security incidents such as ransomware or malware but also from natural disasters, equipment failures, or theft.
Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security, cyber.gc.ca
What does accounting data security mean for your records?
Security and record keeping pull in the same direction. The CRA says you generally keep records for six years from the end of the last tax year they relate to. Some records, such as the share registry and papers on buying or selling property, are kept indefinitely. If you want to destroy books early, you need written permission from the CRA on Form T137.
Electronic records count. The CRA wants them kept in a readable electronic form even when you also have paper. So an old accounting file on a dead drive doesn’t satisfy anything. Test that you can still open last year’s file, and the year before.
Keep the receipts that carry your claims, too. The CRA lists what a receipt should show: the date, the supplier, what you bought and, for GST/HST registered suppliers on purchases over $100, their business number. A scanned receipt that misses these details is a weak record.
What if the data does leak?
If you hold personal information about clients or staff, PIPEDA probably applies to you. The Privacy Commissioner says you report a breach of security safeguards when there is a real risk of significant harm to a person, whether one person is affected or a thousand. You also tell the affected people.
Every breach goes in a record, even the ones you don’t report. Keep that record for at least 24 months. It should show the date, the circumstances, the type of information and if anyone was told. Knowingly skipping these duties can lead to fines.
We couldn’t find a fixed number of hours for reporting on the pages we read. The Commissioner’s wording is “as soon as feasible”, so don’t wait until you have every answer.
A worked example with a real cost
Say you buy $5,000 of equipment in Ontario and pay $650 of HST, which the GST/HST calculator confirms. That $650 is a credit you may claim only if you can show the invoice. Lose the file and the invoice goes with it. Now picture that across a year of purchases. Rebuilding from bank statements takes days, and a bank line doesn’t show the supplier’s business number.
The payroll side is the same. Your payroll remittance calculator shows what you owe the CRA each period, and the file behind it holds employee names and SINs. That file needs the same lock as the rest.
What can you fix this week?
Pick an afternoon, not a project. Turn on two-step sign-in for your bank, your accounting software and your email, since email is how a thief resets everything else. Check that updates are on. Copy last month’s books to a drive that then gets unplugged and goes in a drawer. Open the copy to make sure it works. Write the phone numbers you’d need after a break-in (your bank, your accountant, your IT person if you have one) on a sheet of paper and tape it somewhere sensible.
That’s maybe an hour of work. It covers most of what the table above asks for.
Common mistakes
Sharing one login between the owner, the bookkeeper and the accountant is the classic. When someone leaves, you can’t remove only them. Give each person their own account and remove it the day they go.
Another one is storing passwords in the spreadsheet you’re protecting. And people forget the phone: if bank alerts and approval codes land on a phone with no screen lock, the strong sign-in isn’t strong.
Cloud accounting software moves some of the work to the vendor, but not your part. The Cyber Centre has a control for cloud and outsourced IT, and you still choose who gets access. We won’t compare products here, because we can’t verify claims about any of them.
If you run a corporation, your books also feed the return that the corporate tax calculator estimates. Clean, recoverable data there saves you from filing on guesses. And if you sell to customers, run your invoices through the GST/HST calculator before the file goes anywhere.
What this page is based on
Record-keeping periods come from CRA guidance on business records and electronic records. Breach duties come from the Office of the Privacy Commissioner of Canada. The baseline controls are from the Canadian Centre for Cyber Security. We checked these pages in September 2026. This site has no link with any of these bodies, and none of this replaces a review of your own systems.
Frequently asked questions
How long do I keep accounting records in Canada?
The CRA says generally six years from the end of the last tax year they relate to. Records on property, the share registry and similar history are kept indefinitely.
Do I have to report every data breach?
You report to the Privacy Commissioner when there is a real risk of significant harm. You still record every breach and keep that record for at least 24 months.
Are electronic records enough for the CRA?
Yes, if you keep them in a readable electronic form for the full period, even when a paper copy exists.
What is the first thing to fix?
Turn on multi-factor sign-in for your financial, admin and cloud accounts, then set up an offline backup and test a restore.
Can I destroy old books early?
Only with written permission from the CRA. The request goes on Form T137.
All family and benefits calculators
- Self-employed taxes in Canada: income, CPP and GST
How tax works when you are self-employed in Canada: reporting income and expenses, paying both halves of CPP, instalments and when to register for GST