How should a CFP professional handle electronic communications containing confidential client data?

• A. Email confidential data freely within the office.
• B. Store client data on personal devices without protections.
• C. Maintain data in the cloud without controls.
• D. Use secure channels, limit storage of unnecessary data, and implement encryption and access controls.

Answer: (D)

Safeguarding confidential client data in electronic communications means protecting information from unauthorized access both when it’s sent and when it’s stored. The best approach is to use secure channels for transmission—such as encrypted email or a secure client portal—so data remains protected in transit. Store only what is necessary and implement encryption and access controls so that only authorized individuals can view the information, with strong protections on devices and systems used to hold data. This aligns with the CFP professional’s obligation to keep client information confidential and to take reasonable steps to prevent breaches, leaks, or loss.

Plain email of confidential data, storing client information on personal devices without protections, or using cloud services without proper security controls all introduce unnecessary risk and undermine trust and compliance. Using secure methods, limiting data retention, and enforcing encryption and access controls strike the right balance between accessibility and confidentiality.