Do accountancy practices need a data protection officer

Q: How might two firms reach different answers?

Illustration only. Firm A is a three partner practice with 400 clients, mostly sole traders and small companies, plus payroll for 20 employers. Client data is core to the business, but there is no monitoring or profiling and the special category data it holds, such as occasional health details supporting a late filing appeal, is incidental. It records that no DPO is required, names its practice manager as data protection lead, and reviews the decision each year. Firm B runs a bureau processing payroll, sickness absence and occupational health related deductions for 60,000 employees of large clients, across the whole UK, on a continuing basis. Measured against the ICO's factors of numbers, volume, range, geography and duration, it has a real argument that it processes special category data on a large scale as a core activity. It takes advice, appoints an outsourced DPO reporting to the board, publishes the contact details and notifies the ICO.

Most accountancy practices are not legally required to appoint a data protection officer. Under Article 37 of the UK GDPR a DPO is mandatory only for public authorities and for organisations whose core activities involve large scale systematic monitoring of individuals or large scale processing of special category or criminal offence data, and the ICO says a small organisation is unlikely to need one. A firm that does appoint a DPO, even voluntarily, takes on the full set of legal rules about independence, resources and reporting lines.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

When does the law require a data protection officer?

Article 37(1) of the UK GDPR requires a controller or processor to designate a DPO in three situations:

the processing is carried out by a public authority or body, except courts and tribunals acting in their judicial capacity;
its core activities consist of processing which, by its nature, scope or purposes, requires regular and systematic monitoring of individuals on a large scale; or
its core activities consist of processing special category data under Article 9, or personal data about criminal convictions and offences under Article 10, on a large scale.

The duty applies to processors as well as controllers. If none of the three tests is met, there is no legal requirement, although the ICO points out that every organisation still needs enough staff and resources to meet its UK GDPR obligations. The ICO has flagged that its DPO guidance is under review following the Data (Use and Access) Act, so check for updates before relying on the detail.

Does a typical accountancy practice meet those tests?

A private practice is not a public authority, so the first test does not apply. The other two turn on three ideas: core activities, monitoring and large scale.

Core activities are the primary business activities of the organisation. The ICO contrasts these with secondary processing such as the firm’s own payroll and HR records, which happen all the time but are not the firm’s key objective. For an accountancy practice, handling client personal data is plainly part of its core activity, so the question becomes what kind of processing that is.

Regular and systematic monitoring covers tracking and profiling, online or offline, with behavioural advertising as the ICO’s example. Preparing accounts and tax returns is not monitoring in that sense.

Large scale is not defined in the UK GDPR. The ICO says to consider the number of people involved, the volume and range of data, the geographical extent and the duration of the processing. Its examples of large scale processing include a hospital, an insurer or a bank processing customer data, and it states that individual professionals processing patient or client data are not processing on a large scale. That is why the ICO tells small organisations they are unlikely to need a DPO.

Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.

From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.

See my price in 2 questions or call 01795 841 310.

★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews

Which practices should look harder at the question?

The answer can change as a firm grows or changes what it does. The tests are worth revisiting where a practice:

runs payroll or HR services for many client employers, so that bulk employee data, including sickness and family leave records, becomes a core service rather than a by product;
has grown through acquisitions into a large network handling tens of thousands of individuals across many offices;
offers services built on profiling or scoring individuals, for example credit or affordability assessments; or
handles significant volumes of health or criminal records data as part of a specialist service.

None of these automatically triggers the requirement. They are the points at which the scale and nature of the processing should be assessed again and the conclusion written down.

Who can be the data protection officer?

Article 37(5) requires a DPO to be chosen for their professional qualities, in particular expert knowledge of data protection law and practice and the ability to carry out the Article 39 tasks. The ICO says the law does not specify credentials; the level of expertise should be proportionate to how complex and risky the processing is, and sector knowledge is an advantage.

Article 37(6) allows the DPO to be a member of staff or to act under a service contract, and the ICO confirms an externally appointed DPO must have the same position and tasks as an internal one. A group of undertakings may share one DPO under Article 37(2) provided the DPO is easily accessible from each establishment.

The main constraint for a small firm is conflict of interest. Article 38(6) allows the DPO to have other duties only if they do not create a conflict, and the ICO explains that the DPO cannot hold a position that leads them to decide the purposes and means of processing. In a practice where the partners decide what client data is collected, which systems hold it and who it is shared with, a managing partner or IT partner acting as DPO is likely to face that conflict on the ICO’s reasoning. An operations manager with compliance responsibilities, or an outsourced DPO, is often the cleaner choice.

What does a data protection officer actually do?

Article 39 sets the minimum tasks:

informing and advising the firm and its staff about their data protection obligations;
monitoring compliance with data protection law and the firm’s own policies, including assigning responsibilities, awareness raising, staff training and audits;
advising on data protection impact assessments and monitoring their performance;
cooperating with the ICO; and
acting as the ICO’s contact point, including on prior consultation under Article 36.

Article 38 requires the firm to involve the DPO properly and in good time in all data protection issues, give them the resources and access they need, and ensure they receive no instructions about how to carry out their tasks. The DPO must report directly to the highest management level and must not be dismissed or penalised for doing the job. Individuals may contact the DPO about their data and their rights.

The firm must publish the DPO’s contact details and give them to the ICO under Article 37(7). The ICO says the published details need not include a name, but the DPO’s name must be given when reporting a personal data breach to the ICO and to affected individuals. The ICO’s public register of controllers includes DPO contact details where an organisation has one. The DPO is not personally liable for compliance; that stays with the firm as controller.

What if the firm appoints one voluntarily?

A firm can appoint a DPO even when not required to, but the ICO is clear that the same requirements about position and tasks then apply as if the appointment were mandatory. A partner given the title without independence, resources or a direct line to the partners’ meeting would leave the firm in breach of Articles 37 to 39 even though it never needed a DPO in the first place.

Many practices therefore name a data protection lead or privacy manager instead. The ICO notes that data protection specialists who are not the DPO should not be referred to as the DPO, because that is a specific legal role. Pick the title deliberately and use it consistently in privacy notices, engagement letters and internal policies; see privacy notices for accountancy clients.

How might two firms reach different answers?

Illustration only. Firm A is a three partner practice with 400 clients, mostly sole traders and small companies, plus payroll for 20 employers. Client data is core to the business, but there is no monitoring or profiling and the special category data it holds, such as occasional health details supporting a late filing appeal, is incidental. It records that no DPO is required, names its practice manager as data protection lead, and reviews the decision each year.

Firm B runs a bureau processing payroll, sickness absence and occupational health related deductions for 60,000 employees of large clients, across the whole UK, on a continuing basis. Measured against the ICO’s factors of numbers, volume, range, geography and duration, it has a real argument that it processes special category data on a large scale as a core activity. It takes advice, appoints an outsourced DPO reporting to the board, publishes the contact details and notifies the ICO.

What should a firm without a DPO do instead?

The ICO recommends recording a decision not to appoint a DPO, with the reasons, to help demonstrate accountability. Beyond that, the obligations that a DPO would oversee remain the firm’s own: paying the ICO fee, keeping records of processing, handling breaches and access requests, and carrying out impact assessments for high risk projects. Someone needs clear ownership of each. See data protection for accountancy practices, reporting a personal data breach and data protection impact assessments.

What mistakes do practices make?

Appointing a partner as DPO by default, creating a conflict with their role in deciding how client data is used.
Calling someone the DPO in a privacy notice without giving them the independence and resources Article 38 requires.
Never writing down why a DPO is not needed, leaving nothing to show the ICO if asked.
Failing to update the ICO and published contact details when the DPO changes.
Assuming a DPO carries personal responsibility for compliance, when the firm remains liable.
Not revisiting the question after a merger or a move into bulk payroll or HR services.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.