When a practice is sold, client files can only pass to the buyer if both firms have a lawful basis for the transfer, the clients’ confidentiality is respected and the people in the files are told what is happening. ICAEW’s guidance is that client authority is usually needed before confidential information is disclosed, that legitimate interests will often be the lawful basis for both seller and buyer, and that clients must be informed, with privacy information reaching them within one month at the latest under Article 14 of the UK GDPR.

Who is responsible for the data before and after the sale?

The ICO regards accountants, like other professional service firms, as generally being controllers of their clients’ personal data, so the seller is accountable for every disclosure it makes during the sale. The ICO’s data sharing code treats a merger, acquisition or other restructure as data sharing where it means data passes to a different or additional controller, and says the same care applies whether a firm is the sharing or the receiving controller. Once files arrive, the buyer becomes a controller of them in its own right, with its own duties.

The structure of the deal affects how much changes. On a sale of fees or an asset sale, data moves from one legal person to another. Where a buyer acquires the shares of a practice company, the company that holds the files stays the same, but it will still need to review its privacy notice and systems as the new owners integrate it. The wider regulatory steps, such as practising certificates, insurance and HMRC agent access, are covered in selling or closing an accountancy practice.

What can the seller show a prospective buyer?

Due diligence is where most avoidable disclosures happen. ICAEW’s helpsheet on buying and selling fees says the seller must observe the fundamental principle of confidentiality in section 114 of the ICAEW Code of Ethics, and that the client’s authority would usually be required before client confidential information is disclosed. It describes a formal confidentiality and non poaching agreement as normal before detailed information is shared, including a hold harmless clause so the buyer does not use what it learns against the seller.

A sensible order is:

  1. share anonymised data first: fee bands, service mix, sector split, client tenure and recovery rates, with no names;
  2. sign the confidentiality agreement before anything identifying is released;
  3. release named information only once the deal is close, and only what the buyer needs to test value and quality; and
  4. keep file reviews on the seller’s premises or systems, with access logged, rather than handing over copies.

Data minimisation under the UK GDPR points the same way: the buyer rarely needs whole client files to price a fee base.

What lawful basis covers the transfer itself?

ICAEW states that both buyer and seller need a lawful basis for processing the personal data in client files in this way, and that in many cases legitimate interests will be appropriate: the seller’s interest in selling its business and the buyer’s interest in expanding its own. It adds that consent may also be appropriate where the client is the data subject. Files also hold data about people who are not the client, such as a company client’s employees or a client’s spouse, and for them legitimate interests is the realistic basis. The choice between bases is explained in lawful basis for client data.

Data protection is only one strand. ICAEW points out that clients have the right to choose their accountant under section 320 of the Code, so the change cannot be imposed on them: the client must be informed and must agree before the buyer does any work. In practice a client who agrees to move to the buyer also authorises the transfer of their file, which deals with confidentiality and fairness together.

How and when must clients be told?

For the buyer, the data has come from the seller, not from the client, so Article 14 of the UK GDPR applies. The buyer must give privacy information within a reasonable period and at the latest within one month of obtaining the data, or at the first communication if the data is used to contact the person, or when the data is first disclosed to another recipient if that is earlier. ICAEW notes that the seller’s existing privacy notice may already mention a possible sale; if not, reasonable steps should be taken to tell data subjects about the change. The ICO’s code says firms should consider when and how they will inform people, and that individuals may have a right to object.

A good introduction letter, sent jointly by seller and buyer before files move, should say:

  • who the buyer is and when the change takes effect;
  • what information will transfer and why;
  • that the client may choose not to move, and what then happens to their file;
  • where the buyer’s privacy notice can be found; and
  • who to contact with questions or objections.

The buyer’s own privacy notice then needs to cover transferred clients from the first day.

What happens to clients who do not move?

Their files stay with the seller, or with whoever is winding up the seller’s practice, and are kept and destroyed under the seller’s retention policy. ICAEW’s guidance on the sale says ownership of and access to client files in the event of a claim should remain with the seller, even if the buyer has temporary custody, so the sale agreement should give the seller a right to recover files it needs to defend a negligence claim.

Anti money laundering records follow their own route. ICAEW says each firm must carry out its own customer due diligence, but the buyer may rely on the seller’s checks if the seller gives written consent, following paragraphs 5.4.1 to 5.4.7 of the CCAB guidance, with the buyer remaining responsible for ongoing due diligence. Under regulation 40 of the Money Laundering Regulations, a firm that is relied on must keep its due diligence records for the regulation 40 period and, if asked within that period, immediately provide copies of identification and verification data. Retention periods are set out in how long practices should keep client files.

How should the files physically move?

The ICO’s code recommends getting technical advice before sharing data between different systems, because migration carries a risk of loss, corruption or degradation of data. After the change it says the receiving organisation must check that records are accurate and up to date, document what it does with the data, apply one consistent retention policy and make sure appropriate security is in place.

For a practice, that usually means migrating only the clients who have agreed to move, by secure transfer rather than email or removable media, keeping an audit trail of what was moved and when, and bringing transferred data onto the buyer’s retention schedule rather than leaving a separate legacy archive with no rules.

How might this work on a small sale?

Illustration only. A sole practitioner sells 120 clients to a local firm. During negotiation the buyer sees an anonymised fee schedule and a sample of 10 files reviewed on the seller’s system after a confidentiality agreement is signed. On exchange, a joint letter goes to all 120 clients explaining the sale and asking each to confirm whether they wish to move. 108 agree. Only their files are migrated, by encrypted transfer, and the buyer’s privacy notice is sent with its engagement letter, well within one month. The 12 who decline keep their files with the seller, who retains them under its policy and keeps the right to access transferred files if a claim arises.

What mistakes come up most often?

  • Sending complete client files, or the full client database, to several prospective buyers before any deal is agreed.
  • Migrating every client, including those who never agreed to move.
  • Relying on the seller’s old privacy notice to cover the buyer.
  • Forgetting that files contain third party data, such as employees and family members, who also need to be considered.
  • Losing the seller’s right to retrieve files needed to defend a claim.
  • Assuming the seller’s AML checks automatically transfer without a written reliance arrangement.

For the commercial side of the deal, see buying an accountancy practice.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.