Data protection for accountancy practices

An accountancy practice is almost always a controller, not a processor, for the client personal data it handles, so UK GDPR duties fall on the firm itself. In practice that means paying the ICO data protection fee, having a lawful basis and retention policy for client and anti money laundering records, reporting notifiable breaches within 72 hours and running a complaints process that the Data (Use and Access) Act 2025 now requires.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

Is an accountancy firm a controller or a processor?

The distinction decides who carries the legal obligations. A processor acts only on a controller’s instructions; a controller decides why and how personal data is used. ICAEW’s Technical Advisory Service helpsheet on this question says that, in the ICO’s view, accountants and other professional service firms will generally be data controllers. The reason is the professional obligations that sit on top of the client’s instructions. A firm must decide for itself whether to make a suspicious activity report to the National Crime Agency, and it does that without the client’s authority. ICAEW points out that the ICAEW Code of Ethics and the Money Laundering Regulations 2017 push the assessment towards controller status even for work that looks like routine processing, such as bookkeeping or payroll.

Two consequences follow. First, a client’s standard supplier contract that labels the firm a “processor” does not make it one; ICAEW notes that an organisation cannot be both controller and processor for the same processing activity, and the role depends on what the firm actually does. Second, the firm needs its own privacy notice, its own lawful basis for each activity and its own response to individuals’ rights requests. ICAEW gives a narrow example of genuine processor work: marking exam papers on an examining body’s instructions, where no financial data or AML judgement is involved.

Does a practice have to pay the ICO data protection fee?

Yes, unless an exemption applies. The ICO says organisations, including sole traders, that use personal information must pay a data protection fee under the Data Protection (Charges and Information) Regulations 2018. The tiers published by the ICO are:

Tier	Who it covers	Annual fee
Tier 1 (micro)	Turnover no more than £632,000 or no more than 10 staff	£52
Tier 2 (small and medium)	Turnover no more than £36 million or no more than 250 staff	£78
Tier 3 (large)	Everyone else	£3,763

Paying by direct debit takes £5 off. Staff numbers are the average over the financial year, and each part time member of staff counts as one. The ICO’s fixed penalties for failing to pay are £400, £600 and £4,000 for the three tiers, rising to a maximum of £4,350 in aggravated cases.

Illustration only. A practice with 12 staff and turnover of £580,000 has more than 10 staff but turnover under £632,000. Because tier 1 applies if either test is met, it pays £52, or £47 by direct debit.

ICAEW’s helpsheet on closing a practice notes that a firm that has stopped trading but still stores personal information electronically will still need to pay, so the fee does not automatically end when the practice does.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

What lawful basis covers client data and AML records?

Most client work rests on contract (the engagement letter) and legal obligation (tax filing, payroll reporting, AML checks). Customer due diligence records are the clearest example of legal obligation. Regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 requires copies of due diligence documents and supporting transaction records to be kept for five years from the date the firm knows, or has reasonable grounds to believe, that the business relationship has ended. Transaction records within a relationship need not be kept for more than 10 years.

Regulation 40(5) then goes further than many firms realise: once that period expires, personal data obtained for AML purposes must be deleted unless another enactment or court proceedings require it, the individual has consented, or the firm has reasonable grounds to keep it for legal proceedings. Keeping identity documents indefinitely “just in case” is therefore a breach, not a safeguard. The firm’s wider AML framework is covered on our page on AML supervision for accountants.

How long should client files be kept?

A retention policy should be built from the longest legal requirement for each type of record, not a single blanket period. ICAEW’s closing your practice helpsheet sets out the main reference points:

Schedule 18 to the Finance Act 1998 requires a company to keep records needed for a correct company tax return until the sixth anniversary of the end of the return period.
Section 388 of the Companies Act 2006 requires accounting records to be kept for three years (private companies) or six years (public companies).
ICAEW Audit Regulation 3.11 requires audit working papers to be kept for at least six years from the date of the auditor’s report.
CDD records must be kept for five years after the relationship ends, as above.

Firms also weigh how far back HMRC can look and their own exposure to negligence claims; see how far back HMRC can go. Whatever periods are chosen, write them down, apply them and delete on schedule. Clients’ own original documents should be returned rather than archived.

What must happen when there is a personal data breach?

The ICO’s guidance under Article 33 of UK GDPR says a notifiable breach must be reported to the ICO without undue delay and not later than 72 hours after the firm becomes aware of it. A breach is notifiable if it is likely to result in a risk to people’s rights and freedoms; if risk is unlikely, it need not be reported. Where the risk is high, the affected individuals must also be told directly and as soon as possible. Every breach, reported or not, should be recorded internally.

Typical practice breaches are misdirected emails containing payslips or tax returns, a stolen laptop, and a compromised mailbox used to send fake bank details to clients. The last is common enough that firms should have a written incident plan and consider whether cyber insurance forms part of it.

Illustration only. A junior emails a P60 to the wrong client at 4pm on a Thursday and tells the manager at 9am on Friday. The firm became aware on Thursday afternoon, so if the risk is assessed as likely, the 72 hour clock runs to 4pm on Sunday, not from Friday morning.

How should a practice deal with subject access requests and complaints?

The ICO’s subject access guidance says a request must be answered without undue delay and at the latest within one month of receipt. The deadline can be extended by up to two further months if the request is complex or the person has made several requests, but the requester must be told why within the first month. In most cases no fee can be charged. If the firm genuinely needs clarification, the clock pauses on the day it asks and resumes the day after the answer arrives. The Data (Use and Access) Act 2025 confirms that searches need only be reasonable and proportionate.

The Act also added a duty on organisations to handle data protection complaints. The ICO announced in June 2026 that all organisations must now give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate appropriately and tell the person the outcome. Former clients in fee disputes and departing employees are the most likely complainants, so the procedure should sit alongside the firm’s general complaints process.

What happens to client data when a practice is sold or merges?

ICAEW’s buying and selling fees helpsheet says both buyer and seller need a lawful basis for sharing client files, that legitimate interests will often be appropriate, and that firms should tell data subjects about the change where their privacy notice does not already mention it. Client confidentiality under section 114 of the ICAEW Code of Ethics applies in parallel, so client authority is usually needed before confidential information is disclosed during due diligence. The wider process is covered in selling or closing an accountancy practice.

What are the most common mistakes?

Signing client data processing agreements that describe the firm as a processor, then running AML and tax work as a controller anyway.
Keeping identity documents forever, contrary to regulation 40(5).
Starting the breach clock from when a partner hears about it rather than when the firm became aware.
Letting the ICO fee lapse on closure while archived client files are still held electronically.
Giving HMRC online access to staff who have left; see HMRC agent services account for how user permissions work.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.