GDPR for Accountants: What Practices Need to Do

Summary

The GDPR applies to accountants whenever they process personal data about clients, employees or clients’ customers. A firm is a controller when it decides why and how it uses data, and a processor when it acts for a client. Each role brings duties: a lawful basis, appropriate security, written processor contracts and, for controllers, breach notification within 72 hours where feasible.

This guide covers roles, lawful basis, retention, security, suppliers, breaches, individual rights and a practical checklist. Article references are to the GDPR. Retention and fee points are UK-specific and are marked as such.

Key Takeaways

• Names, addresses, payroll records and tax details are personal data. A firm that handles them needs a lawful basis under Article 6 and security under Article 32.

• Role depends on the work. A controller determines the purposes and means of processing (Article 4(7)). A processor processes on behalf of a controller (Article 4(8)) and needs an Article 28 contract.

• In the UK, regulation 40 of the Money Laundering Regulations 2017 sets a five-year retention period for certain records, after which the personal data must be deleted unless an exception applies.

The GDPR Applies Because of the Data Accountants Hold

Accountants handle personal data about clients, client staff, and clients’ customers and suppliers. A payroll file, a self-assessment return and a set of sales ledgers all contain information about identifiable people.

Article 5 sets the principles for processing, and Article 5(2) adds that the controller must be able to demonstrate compliance. Those duties follow the data, so they apply regardless of the firm’s size.

For practical steps to meet that duty, see our guide to GDPR implementation.

Role Depends on the Work, so Check Each Engagement

Article 4(7) defines a controller as the body that, alone or jointly with others, determines the purposes and means of processing. Article 4(8) defines a processor as a body that processes personal data on behalf of the controller. The label follows what the firm does in practice. Our guide to controllers and processors explains the test.

A firm can hold different roles for different services. Assess each engagement separately and record the answer.

Where a firm is a processor, Article 28(3) requires a contract that sets out the subject matter, duration, nature and purpose of the processing, and binds the processor to act only on documented instructions.

Article 28(10) adds that a processor that determines the purposes and means of processing in breach of the GDPR is treated as a controller for that processing.

Every Use of Client Data Needs a Lawful Basis

Article 6(1) lists six lawful bases. Three are worth checking first for an accountancy practice:

• Contract (6(1)(b)): processing necessary to perform a contract with the data subject. It fits an individual client. It does not cover that client’s employees, who are not party to the engagement.

• Legal obligation (6(1)(c)): processing necessary to comply with a legal obligation the firm is subject to.

• Legitimate interests (6(1)(f)): processing necessary for the legitimate interests of the firm or a third party, unless the individual’s interests or rights override them.

Payroll files can contain special category data, such as health information or trade union membership. Article 9 prohibits processing it unless a condition in Article 9(2) applies, which must be used in addition to an Article 6 basis. Article 10 covers data about criminal convictions and offences.

Articles 13 and 14 require the firm to give people information about the processing. Article 13 applies when the firm collects the data directly from the person. Article 14 applies when it comes from someone else, such as data about a client’s employees.

Anti-Money Laundering Rules Set Some Retention Periods

In the UK, regulation 40 of the Money Laundering Regulations 2017 requires a relevant person to keep copies of customer due diligence documents and information, and supporting records for transactions. The period is five years from the date the business relationship ends, or from completion of an occasional transaction. For transaction records that form part of a business relationship, a relevant person is not required to keep them for more than 10 years.

Once the period has expired, the regulation requires the firm to delete personal data obtained for the purposes of the Regulations, unless:

• it is required to keep the records by or under an enactment, or for court proceedings;

• the data subject has consented to the retention; or

• the firm has reasonable grounds for believing the records are needed for legal proceedings.

This is a UK rule. The legislation.gov.uk page lists amendments that are not yet in force (S.I. 2026/621), so check the current text before you set a retention schedule.

Records outside these rules still fall under the storage limitation principle in Article 5. Our guide to data minimisation covers it.

Security Must Match the Risk

Article 32(1) requires the controller and the processor to implement technical and organisational measures that give a level of security appropriate to the risk. It takes into account the state of the art, costs, and the nature, scope, context and purposes of processing. The examples it lists, as appropriate, are:

• pseudonymisation and encryption of personal data;

• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services;

• the ability to restore availability and access to personal data in a timely manner after a physical or technical incident; and

• a process for regularly testing, assessing and evaluating the effectiveness of the measures.

Article 32(4) adds that anyone acting under the authority of the controller or processor who has access to personal data may process it only on the controller’s instructions, unless the law requires otherwise. For a practice, that covers its own staff.

Article 4(12) defines a personal data breach to include accidental disclosure of, or access to, personal data. A payroll file sent to the wrong recipient fits that definition.

Software Suppliers and Subcontractors Need Contracts

Cloud accounting packages, practice management tools and IT support providers often process client personal data for the firm. Where the firm is the controller, a supplier in that position is a processor. Article 28(1) requires the controller to use only processors that provide sufficient guarantees.

Check each supplier’s data processing agreement against the Article 28 requirements. Under Article 28(2), a processor may not engage another processor without the controller’s prior specific or general written authorisation. Our guide to GDPR sub-processors explains the chain.

If a supplier stores or accesses data outside the UK or the EEA, it needs a transfer route. See our guide to sharing data outside the EU.

A Breach Plan Has to Work Within 72 Hours

Article 33(1) requires a controller to notify the supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to pose a risk to individuals. If it is not made within 72 hours, the notification must give reasons for the delay.

Article 33(2) requires a processor to notify the controller without undue delay after becoming aware of a breach. Article 33(5) requires the controller to document every breach, including the facts, its effects and the remedial action taken.

Article 34(1) requires the controller to tell affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Write down who decides whether a breach is reportable and who contacts the regulator and clients. Our guide to data breach reporting covers the steps.

Clients and Staff Have Rights Over Their Data

Chapter III gives individuals rights including access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21). A request can come from a client, a client’s employee or a member of the firm’s own staff.

Article 12(3) requires the controller to respond within one month of receiving a request. The period can be extended by two further months where necessary, taking into account the complexity and number of requests, and the individual must be told of the extension within the first month.

UK Firms May Need to Pay the Data Protection Fee

The ICO states that under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that use personal information need to pay a data protection fee, unless they are exempt. Use the ICO’s self-assessment to check whether your firm qualifies for an exemption.

Seven Steps Put the Rules Into Practice

A short plan covers the points above:

• Map the data: list what personal data the firm holds, where it is stored and who can access it.

• Set the role: decide controller or processor for each service, and record the reasoning.

• Update engagement terms: add the Article 13 and 14 information and, for processor services, an Article 28 contract.

• Set retention periods: apply regulation 40 where it applies, and set a period and a reason for other records.

• Review security: compare your measures with the Article 32 examples, and run a GDPR audit if you have not had one.

• Check suppliers: collect processing agreements and sub-processor lists from every tool that touches client data.

• Prepare for breaches: name who decides, who notifies, and where breaches are logged.

For high-risk processing, ask whether a data protection impact assessment is needed.

Conclusion

The GDPR applies to accountants because they handle data every day. The work comes down to a clear role for each engagement, a lawful basis, retention periods that follow the law, security that matches the risk, contracts with suppliers and a breach plan that works within 72 hours.

We are updating this guide because the original was short, quoted fines and did not cover roles, retention, suppliers or individual rights. Review your engagement letters and supplier contracts against these points, and speak to our GDPR consultants if you want them checked.

Frequently Asked Questions

Is an Accountant a Data Controller or a Data Processor?

It depends on the service. A firm that determines the purposes and means of processing is a controller under Article 4(7). A firm that processes on behalf of a controller is a processor under Article 4(8). Assess each engagement and record the answer.

How Long Must Accountants Keep Client Records?

There is no single period. In the UK, regulation 40 of the Money Laundering Regulations 2017 requires customer due diligence records and supporting transaction records to be kept for five years after the relationship ends, with a 10-year limit for some transaction records. For other records, set a period and a reason, and apply the storage limitation principle in Article 5.

Does an Accountancy Practice Need a DPO?

Not in every case. Article 37(1) requires a DPO for public authorities and organisations whose core activities involve large-scale, regular, and systematic monitoring of individuals, or large-scale processing of special category or criminal offence data. Check your own activities against those tests.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.