A practice’s privacy notice must tell clients, at the point their data is collected, who the firm is, why and on what lawful basis it uses their data, who it shares it with, how long it keeps it, and what rights they have, including the right to complain. Accountancy firms also have to give new clients the anti money laundering data statement required by regulation 41 of the Money Laundering Regulations 2017, and must reach people whose data comes from someone else, such as a client’s spouse or payroll employees, within one month.

Who needs to receive the firm’s privacy information?

Articles 13 and 14 of UK GDPR give individuals the right to be informed about how their personal data is used. The ICO calls the required content “privacy information”. Article 13 applies when the firm collects data from the person it relates to; Article 14 applies when it obtains data from someone else.

For a practice, Article 13 covers sole traders, partners, landlords and directors who supply their own details. Article 14 catches a much wider group:

  • a client’s spouse or partner whose income is relevant to a return or to the High Income Child Benefit Charge;
  • employees on a payroll the firm runs for a client employer;
  • beneficial owners and directors identified during customer due diligence;
  • individuals whose details appear in data received from HMRC, Companies House or the client’s bank feeds.

The firm also needs separate privacy information for its own staff and job applicants, because the purposes and lawful bases are different. The firm is normally a controller in its own right for client work, which is why it needs its own notice rather than relying on the client’s; our page on data protection for accountancy practices explains the controller question.

What must the notice say?

The ICO’s checklist for the right to be informed lists the content. For data collected from the individual, the firm must give:

  • its name and contact details, and those of any representative and data protection officer;
  • the purposes of the processing and the lawful basis for each, including the legitimate interests relied on where that basis is used;
  • the recipients or categories of recipients;
  • details of any transfers outside the UK;
  • the retention periods or the criteria used to set them;
  • the individual’s rights, including the right to withdraw consent where consent is relied on;
  • the right to complain to the ICO;
  • whether the person is under a statutory or contractual obligation to provide the data, and the consequences of not doing so;
  • any automated decision making, including profiling.

For data obtained from elsewhere, the notice must also give the categories of data and its source.

In an accountancy context the purposes are usually preparing accounts and returns, running payroll, giving advice, carrying out AML checks and marketing the firm’s services. Recipients typically include HMRC, Companies House, software and cloud providers, the firm’s AML supervisor and its professional indemnity insurers. Retention periods should match the firm’s actual policy; see client file retention. The statutory obligation point is worth spelling out for identity documents: clients need to know the firm cannot act without them.

The Data (Use and Access) Act 2025 also requires organisations to help people make data protection complaints and to acknowledge them within 30 days, so the notice is a natural place to say how to complain to the firm as well as to the ICO.

What extra statement do the Money Laundering Regulations require?

Regulation 41(6) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 says that before establishing a business relationship or carrying out an occasional transaction with a new customer, a relevant person must give the customer the Article 13 information and a statement that any personal data received from the customer will be processed only for the purposes of preventing money laundering, terrorist financing or proliferation financing, or as otherwise permitted under regulation 41(3).

Regulation 41(3) allows other use only where another enactment or UK GDPR permits it, or the person consents. In practice the statement explains that data collected for customer due diligence will not be repurposed, for example for marketing. It belongs in the onboarding pack issued before work starts; our page on client onboarding covers the sequence.

When does the information have to be provided?

Where data is collected from the person, the information must be given at the time it is collected. Where it comes from another source, Article 14(3) requires it within a reasonable period and at the latest within one month, or earlier if the firm first communicates with the person or discloses their data to someone else.

The ICO says privacy information must be actively provided. Putting it on the firm’s website is acceptable, but the firm must make people aware of it and give them an easy way to reach it. If the firm starts using data for a new purpose, it must update the notice and tell people before the new processing begins. The ICO specifically asks organisations applying artificial intelligence to personal data to be upfront about it, which is relevant to firms adopting tools that read client documents.

Are there exceptions for data obtained from others?

Under Article 14(5) the duty does not apply to the extent that the person already has the information; providing it is impossible or would involve disproportionate effort; it would seriously impair the objectives of the processing; obtaining or disclosure is expressly required by domestic law with appropriate safeguards; or the data must stay confidential under an obligation of professional secrecy regulated by domestic law. Article 14(6) and (7) say disproportionate effort depends on factors such as the number of people and the age of the data, and a firm relying on it must take appropriate measures, including making the information publicly available. The ICO adds that a data protection impact assessment is needed where providing the information is thought impossible or disproportionate.

For payroll employees, the simplest route is usually for the client employer to pass on the firm’s notice, so the employees already have the information. For a client’s spouse, a short paragraph the client is asked to share often does the job.

How should a practice deliver it?

The ICO requires privacy information to be concise, transparent, intelligible, easily accessible and in clear and plain language, and suggests a layered approach: a short summary with links to the detail. For a practice that usually means a brief data protection paragraph in the engagement letter, the full notice attached or linked, and the regulation 41 statement in the AML section. ICAEW’s engagement letter helpsheet includes example terms of business with data protection clauses for data controllers (Part 4) and a short form template privacy notice (Part 5), last updated in March 2026.

What does a good onboarding sequence look like?

Illustration only. A new limited company client signs up in November. The firm sends its engagement letter with a one paragraph data protection summary and a link to its full notice, plus the regulation 41 statement, before any identity documents are requested. The director’s wife is a shareholder whose details are collected from the director, so the firm asks him to forward a short notice to her and records that it has done so. Two months later the firm starts payroll for the company’s six employees and gives the company a payroll privacy notice to circulate before the first pay run.

What mistakes do firms make?

  • Reusing the website cookie notice as the client privacy notice.
  • Stating consent as the lawful basis for everything, when tax and AML work rests on contract and legal obligation.
  • Omitting the regulation 41 statement or issuing it after due diligence has started.
  • Forgetting people whose data comes from clients, such as spouses and employees.
  • Quoting retention periods that do not match what the firm actually does.
  • Never reviewing the notice when new software, outsourcing or AI tools are introduced.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.