7th IOTA Annual International Conference “Cybersecurity and Data Protection in Tax Administrations”

As digital transformation continues to reshape tax administration, cybersecurity and data protection have become essential to maintaining public trust, safeguarding critical information and ensuring the continuity of public services. The Conference provided a platform to discuss these challenges from strategic, operational, organisational, and technological perspectives, while highlighting the importance of international cooperation and knowledge sharing.

Building Trustworthy and Secure Digital Tax Systems

The Conference opened with welcoming remarks from Mrs Elena Petrova, IOTA President and Director General of the Tax Administration of North Macedonia, delivered via video message, and Mrs Alix Perrignon de Troyes, Executive Secretary of the IOTA Secretariat. Mr Joshua Aslett, Deputy Division Chief at the International Monetary Fund, and Mr Luca Tagliaretti, Executive Director of the European Cybersecurity Competence Centre, delivered keynote contributions that set the scene for discussions on the evolving global threat landscape and the need for proactive risk management.

The first sessions explored the strategic and policy frameworks required to protect sensitive data and maintain trust in digital tax systems. Mr Alexandre Garcia of the OECD Global Forum on Transparency and Exchange of Information for Tax Purposes, Mr Anders Reitan Roald of the Norwegian Tax Administration and Mr Alberto Zapico Alonso of the Spanish Tax Agency shared perspectives on data use, artificial intelligence and the challenges associated with securing increasingly interconnected digital environments.

The discussions then turned to cybersecurity and data protection governance, focusing on leadership, accountability and coordination within tax administrations. Moderated by Mr Øivind Strømme of the Norwegian Tax Administration, the session featured presentations by Mr Gabriel Bellenger of Accenture and Mrs Valentina Ion of Microsoft emphasising the need for clear ownership of risks, executive oversight, coordination between business, technology, cybersecurity and data-protection functions, and effective governance of suppliers and cloud services. The subsequent fireside chat brought together Mr Jože Senica of Europol, Valentina Ion, Mr Yacine Zaitri of Accenture and country representatives to examine practical approaches for strengthening governance, managing third-party risks and embedding security into organisational decision-making.

From Cyber Threats to Operational Resilience

The operational sessions focused on how tax administrations can prepare for cyber threats, detect incidents, respond effectively and restore critical services. Speakers shared practical experiences and case studies addressing vulnerability management, threat monitoring, incident response, business continuity and cooperation between public and private sector organisations.

Contributions included an online presentation by Mr Vinicius Pimentel de Freitas of CIAT; an examination of communication between fiscal partners following cyberattacks by Mr Adrien Poulalion of the French General Directorate of Public Finances; and practical perspectives from Mr Tõnis Kuuse of the Estonian Tax and Customs Board.

Mr Maximilien Vermeiren of Mastercard explored the role of public-private collaboration in strengthening operational resilience, while Mrs Valentina Ion of Microsoft examined the critical first 72 hours of a ransomware attack against a public administration and the factors that can help accelerate recovery.

The first day concluded by placing people at the centre of cybersecurity. Mrs Linda Walbeck Olsen of the Norwegian Tax Administration presented “The Human Vulnerabilities”, broadening our understanding of how a supportive working environment, trust between managers and employees, and regular conversations about difficult situations can help identify vulnerabilities before they become security risks. This was followed by a discussion involving Joshua Aslett of the International Monetary Fund and Mr László Hajnal of the Tax Administration of the Czech Republic. The session highlighted the importance of awareness, practical training, effective communication and a strong organisational security culture in complementing technical safeguards.

Turning Knowledge into Practical Solutions

The second day focused on translating cybersecurity and data protection principles into practical approaches that tax administrations can apply in their daily work.

Mr Kevin McGillivray of the Norwegian Tax Administration examined the management of data protection and security risks when artificial intelligence is introduced into tax administration. Mr Laurynas Riauba of RoyaltyRange followed with a case study on emerging risks associated with artificial intelligence in software-as-a-service environments.

Participants then took part in interactive parallel sessions covering three complementary areas: 1) strategy, governance and compliance; 2) incident readiness, response and collaboration; and 3) people, technology and secure innovation. These discussions enabled participants to exchange national experiences, identify common challenges and consider practical measures that could be adapted to their own administrative contexts.

The outcomes of the parallel sessions were brought back to the plenary, allowing participants to share key findings, potential solutions and priorities for future cooperation. Mrs Denisa Albu Rasmussen from FAST Enterprises chaired the reporting from the moderators of the parallel sessions: Mr Kevin McGillivray of the Norwegian Tax Administration, Mr Roberts Pumpurs of the  Latvian State Revenue Service and Mr Johan Hedström of the Swedish Tax Agency, who translated their discussions into ideas and practical recommendations that can be adapted and applied within tax administrations.

The Conference continued with a technology-focused session moderated by Mr Matt Blanks from Mastercard, featuring Mr Nikolaj La Cour of Netcompany, Mr Evan Sylvester of FAST Enterprises, Valentina Ion of Microsoft and Mr Jannic Horst of SAS Institute. Their contributions explored how emerging technologies, analytics and artificial intelligence can support secure and resilient tax systems, including identity and privileged-access management, threat detection, incident response and the protection of sensitive information. The session discussions concluded that technology can accelerate detection, analysis and response. However, technology creates resilience only when it operates within effective governance and supports accountable human decision-making.

The closing panel, moderated by Mr Steve Lahos of Luxembourg's Registration Duties, Estates and VAT Authority, brought together Mr Márió Mile of the Institute of Cybersecurity in Hungary, Mr Thomas Monefeldt of Netcompany, Mr Alexandre Negadi of SAS Institute,  and Mrs Mary O'Leary of DataTorque. The discussion considered how tax administrations can anticipate emerging risks, strengthen institutional capabilities and maintain public trust while continuing their digital transformation.

The IOTA Expo and 30 Years of Cooperation

Running alongside the Conference, the IOTA Expo, “Cybersecurity and Data Protection Technical Knowledge,” offered participants the opportunity to explore technological developments, operational solutions and practical use cases supporting more secure digital tax administration. The exhibition provided a space for tax administration representatives and technology providers to exchange ideas, discover emerging solutions and discuss how innovation can support stronger cybersecurity capabilities and data protection practices.

The Conference also provided an opportunity to celebrate a significant milestone in the organisation's history. In 2026, IOTA marks 30 years of cooperation and knowledge sharing among tax administrations. The IOTA30 Anniversary Booth invited participants to engage with the organisation's history through interactive quiz activities, revisit key milestones and celebrate the community that has shaped IOTA over three decades.

Strengthening International Cooperation for the Future

Throughout the two-day Conference, speakers and participants emphasised that effective cybersecurity and data protection depend not only on technological solutions but also on clear accountability, stronger safeguards, tested recovery plans, more secure innovation and deeper cooperation across the IOTA community.

By bringing together expertise from tax administrations, international organisations and the technology sector, the 7^th IOTA Annual International Conference provided a valuable opportunity to exchange practical experiences and explore approaches to building secure, trusted and future-ready tax administrations.

IOTA thanks all speakers, moderators, participants and partners for their contributions to the Conference and their continued commitment to international cooperation, knowledge sharing and the strengthening of tax administrations.