Who controls the data in an accounting engagement, and what that decides about your duties

Accountancy records can reveal identity, income, spending, debts, workers, customers and family circumstances. Protecting them requires a record of processing that sets out each purpose and responsibility under the UK GDPR and the Data Protection Act 2018, not a generic confidentiality clause.

What to take away

Inventory information and purpose

Trace data from enquiry through acceptance, delivery, filing, billing, complaint, termination and deletion. Include email, portals, practice software, payroll systems, paper, backups, call recordings and AI tools.

For each activity, complete a record-of-processing template with the people concerned, fields, source, purpose, lawful basis, recipients, location, retention and owner. Do not collect full tax references or bank details in a marketing form when a later secure stage can obtain them.

The ICO's lawful-basis guide explains that the organisation must select and document an appropriate basis before processing. Consent is not automatically the right answer for every accounting record.

Determine controller and processor roles

The ICO controller and processor hub explains that roles depend on who decides purposes and means. A practice can act as a controller for its own acceptance, legal, billing or complaint purposes while another arrangement may involve processing on instructions.

For example, a practice is controller for its own billing records, deciding why and how to invoice. It is processor for a client's payroll when it runs payroll only on the client's documented instructions. The client remains controller for that payroll data, including pay rates, tax codes and statutory payments.

For VAT filing, the practice is processor if it files returns on the client's instructions and does not set the purpose. It is controller for its own anti-money-laundering checks and engagement records.

Analyse each function. Do not let a supplier's standard contract decide the factual role. Where parties jointly determine matters, assess joint-control responsibilities rather than choosing the more convenient label.

Govern suppliers and subprocessors

Complete a subprocessor register covering bookkeeping, payroll, document, cloud, communication, e-signature and support providers before access. Set out service, data, hosting, encryption, identities, permissions, incident reporting, continuity, deletion, audit evidence and exit in the register.

The ICO's detailed controller-processor contract guidance lists processing details and contractual topics including instructions, confidentiality, security, subprocessors, rights assistance, end-of-contract action and audits. The page is flagged for review after legislative change, so reopen it before contracting.

Limit access and credential risk

Give each worker an individual account and only the information required for their task. Use strong authentication, controlled devices, logging and prompt removal when roles change. Audit privileged access and shared inboxes.

Never ask a client to disclose their HMRC sign-in credentials. Use the proper client-authorisation and agent-service routes. Separate test from live records and prohibit staff from uploading customer information to unapproved AI systems.

Set retention and secure disposal

Build a retention schedule for legal, regulatory, professional, contractual and operational needs for each record class. Typical periods include six years from the end of the accounting period for tax records and three years after the tax year for PAYE records.

Other periods include five years after the end of the business relationship for money laundering records and six years from the end of the financial year for company accounting records. Keep source evidence, advice, approval, submission and acknowledgement together for the approved period. Avoid "retain indefinitely" without a reason.

Make deletion effective across active systems, exports and supplier arrangements, subject to controlled backup cycles and genuine holds. Log exceptions and check them at each retention review.

Prepare for rights and incidents

Create a route to recognise access, correction, objection and other requests, verify identity proportionately and search all relevant stores. Respond to rights requests within one month, extendable by two further months for complex requests. Do not alter a historic submitted record without preserving what happened and why.

For a personal data breach, contain the incident, preserve evidence, assess the risk to people's rights and freedoms, and log it. Notify the ICO within 72 hours if the breach is likely to result in a risk to rights and freedoms. Tell affected individuals without undue delay if there is a high risk.

A breach that is unlikely to risk rights and freedoms, such as a properly encrypted lost device, may not need reporting, but you should still record it.

Exercise a misdirected payroll file, compromised account and unavailable cloud platform. Define containment, evidence preservation, risk assessment, notification decisions, customer communication and recovery. Keep current contact information outside the affected system.

Test the arrangements in practice

Sample access logs, exports, deleted users, supplier changes, retention actions and customer records. A policy may look complete while staff rely on email attachments and personal downloads.

Test a sample each quarter and check that the record of processing matches what staff actually do. Check that deletion has happened in every system, export and supplier area.

Assign each finding an owner and deadline. Reassess when software, subprocessors, service scope, law or professional guidance changes. Obtain qualified data-protection and legal review for the actual arrangements before publication or implementation.

Retain the review evidence.

Before you act

Common questions

How do you decide whether a practice is a controller or a processor?

See "Determine controller and processor roles" above for the function-by-function test.

What should a supplier contract cover before access is granted?

See "Govern suppliers and subprocessors" for the contractual topics and the subprocessor register.

How should retention and disposal be handled?

See "Set retention and secure disposal" for the retention schedule and typical periods.