An acceptable privacy practice for a tax consultancy agency should include obtaining explicit consent from the client before releasing any personal information rather than relying solely on management's approval. Management approval alone does not ensure that client consent has been granted, thus potentially violating privacy rights. Instead, sensitive personal information should be shared only with the client's explicit permission, respecting their privacy and autonomy over their data.