Data Processing Agreements For Accountants

Priya runs a small accountancy firm in Manchester. She handles bookkeeping for some clients, runs payroll for others, prepares company tax returns, and gives tax planning advice to a few growing businesses.

Then one client asks: Are you our processor or controller under UK GDPR, and can you sign our data processing agreement?

If that question makes your head hurt a little, you're not alone. A data processing agreement for accountants in the UK isn't just paperwork. It decides who is responsible for client data, what you can do with it, and what happens if something goes wrong.

The good news is that this doesn't have to be complicated. Once you break your services into payroll, bookkeeping, tax, cloud software and client instructions, the answer usually becomes much clearer.

Do Accountants Need A Data Processing Agreement?

Yes, you need a data processing agreement when your accountancy firm processes personal data as a processor for a client.

Under the UK GDPR and the Data Protection Act 2018, a controller decides why and how personal data is used. A processor uses personal data for the controller, based on their documented instructions.

Article 28 of the UK GDPR says that when a controller appoints a processor, there must be a written contract covering specific data protection terms. That written contract is usually called a data processing agreement, or DPA.

For accountancy firms, this often comes up because you may handle:

• Employee names, addresses, National Insurance numbers and salary details for payroll
• Director and shareholder information for company accounts
• Customer, supplier and transaction data for bookkeeping
• Bank statements, receipts and expense claims
• Tax return information, including personal financial details
• Login details or user access for accounting software

You don't need a DPA for every single client relationship. If you're acting as an independent controller, the right document is usually your engagement letter, privacy policy and client terms, rather than a processor DPA or standalone data processing schedule.

Where many accountancy firms get stuck is that you can be a controller for some services and a processor for others, even for the same client.

Are Accountants Controllers Or Processors Under UK GDPR?

It depends on the service you're providing and how much control you have over the purpose and method of the work.

There isn't one single answer for every accountancy firm. The practical test is this: are you making your own professional decisions about what data you need and how to use it, or are you simply carrying out the client's instructions?

When You're More Likely To Be A Controller

You're more likely to be a controller when you're providing professional accountancy or tax services where you decide how to meet legal, regulatory or professional obligations.

This can include:

• Preparing and filing tax returns based on your professional judgement
• Preparing statutory accounts
• Advising on tax planning or business structure
• Complying with anti-money laundering checks
• Keeping records for your own legal, insurance or professional purposes
• Deciding what information you need to give proper accounting advice

For example, if Priya prepares a corporation tax return for a limited company, she isn't just following a set of mechanical instructions. She decides what information is relevant, checks the tax treatment, applies her professional judgement and may need to keep records to protect her own business. That points strongly towards Priya being a controller for that work.

When You're More Likely To Be A Processor

You're more likely to be a processor when you handle personal data only to perform a task chosen and controlled by the client.

This can include:

• Running payroll using figures and instructions supplied by the employer
• Uploading staff details into payroll software for payslips and HMRC submissions
• Processing expenses exactly as the client directs
• Providing a genuinely mechanical data-entry service where the client decides the categories, systems, purpose and instructions
• Handling employee data only so the client can meet its employer obligations

For example, if a cafe asks you to process monthly payroll for 12 staff, the cafe is usually the controller for employee data. It decides who is employed, what they're paid, when payroll is run and why the data is needed. Your firm may be the processor for that payroll service.

There can still be grey areas. If you also advise the cafe on payroll compliance, pension duties or tax treatment, you may be acting as a controller for that advice while acting as a processor for the payroll processing itself.

How Do The Roles Apply To Payroll, Bookkeeping And Tax Returns?

The role depends on the specific task, so it's best to map your services one by one rather than using the same answer across your whole firm.

Here's how the common accountancy services usually work in practice.

Payroll

Payroll is often a processor activity for the accountant. Your client, as the employer, usually decides the purpose of processing staff data: paying employees, deducting tax, managing pensions and meeting employment obligations.

Your DPA should cover exactly what you do with employee data, including payslips, RTI submissions to HMRC, pension files and year-end documents such as P60s.

That said, you may still be a controller for your own records, invoicing, conflict checks, AML obligations and professional compliance.

Bookkeeping

Bookkeeping by an accountancy firm will often point towards controller status, especially where the firm is acting under professional obligations or using its accounting expertise.

This is because accountants and similar professional service providers may need to take responsibility for the personal data they process when doing a client's books. If you're deciding accounting treatment, making corrections, preparing reports, advising on VAT treatment, identifying errors or exercising professional judgement, you're likely to be a controller for those parts of the service.

Processor status may still be possible, but only in a narrow scenario. For example, if your firm provides a genuinely mechanical administrative data-entry service, carried out solely on documented client instructions, with no professional judgement, no own compliance purpose and no independent retention or legal obligation, that may point towards processor status.

Tax Returns And Accounts

Tax return and accounts preparation often points towards controller status because you're applying expertise and deciding what information is needed to complete the work properly.

You may also need to keep your own file notes and supporting documents for regulatory, insurance and HMRC-related reasons. That's different from simply holding data on the client's behalf.

Cloud Accounting Software

Cloud software adds another layer. You need to ask who chooses the software, who controls the account, who invites users, and who has a contract with the software provider.

If your client has its own subscription and gives you access, the software provider may be your client's processor, and you may be a controller or processor depending on your services.

If your firm provides the software as part of your service package, you may be appointing the software provider as your own processor or sub-processor. Your client terms need to explain this clearly.

What Should A Data Processing Agreement For Accountants Include?

A DPA for accountants should include the mandatory UK GDPR processor terms, plus practical clauses that reflect how accountancy work is actually done.

Article 28 of the UK GDPR requires a processor contract to cover certain points. For an accountancy firm, your DPA should usually include:

• Subject matter and duration: what services you're providing and how long you'll process the data
• Nature and purpose: payroll, bookkeeping, accounts support, tax support or related services
• Types of personal data: contact details, payroll data, tax details, bank details, employee records and transaction information
• Categories of individuals: clients, employees, directors, shareholders, contractors, customers or suppliers
• Client instructions: how instructions are given and what happens if an instruction seems unlawful
• Confidentiality: who in your firm can access the data and on what basis
• Security measures: access controls, passwords, multi-factor authentication, backups, staff training and secure document sharing
• Sub-processors: when you can use payroll software, cloud accounting platforms, document portals or IT providers
• Data breach support: how you notify the client and help them assess reporting duties
• Data subject requests: how you help if an individual asks for access, correction or deletion
• Deletion or return: what happens to data when the client relationship ends
• Audit and information rights: how you show compliance without disrupting your firm

A generic template can miss the way accountants actually work with HMRC submissions, payroll deadlines, AML checks, software access and professional file retention. Your DPA works best when it's tailored to your services and systems.

Do You Also Need An Accountant Privacy Policy?

Yes, if your firm collects personal data as a controller, you usually need a privacy policy or privacy notice that tells people how you use their data.

This is separate from a DPA. A DPA is mainly between your firm and a client when you're acting as a processor. A privacy policy explains your own data use when you're a controller.

Your accountant privacy policy or client privacy notice in the UK should usually explain:

• Who your firm is and how to contact you
• What personal data you collect
• Why you use the data
• Your lawful basis under UK GDPR, such as contract, legal obligation or legitimate interests
• Who you share data with, including HMRC, Companies House, software providers and professional advisers
• How long you keep records
• Whether data is transferred outside the UK
• What rights individuals have, including access, correction and objection rights
• How someone can complain to you or the Information Commissioner's Office

You may need privacy wording for different audiences. For example, your business clients need to know how you handle their contact and billing details. Their employees may also need to know how you handle payroll information if you're acting as a controller for any part of that work.

You should also check whether your firm needs to pay the ICO data protection fee. Many businesses that process personal data need to pay it unless an exemption applies. The amount depends on your organisation's size and type, so it's worth checking the current ICO tier that applies to you.

What Client Data Terms Should Accountancy Firms Put In Their Engagement Letter?

Your engagement letter should include clear client data terms, whether you're a controller, processor or both.

Think of your engagement letter as the commercial home for the client relationship. Your DPA and privacy policy can sit alongside it, but your engagement letter should still set out the data basics in plain English.

Useful client data terms for accountants include:

• Your role: when you act as controller, processor or both
• Client responsibilities: the client must provide accurate data, get any required notices or permissions, and keep login access secure
• Client instructions: how the client gives instructions, especially for payroll and bookkeeping
• Software use: which platforms you use and whether the client agrees to that use
• Data sharing: when you can share data with HMRC, Companies House, pension providers, banks, auditors or software providers
• Record retention: how long you keep files after the engagement ends
• Security expectations: how documents should be sent and what you won't accept, such as passwords in the same email as attachments
• Access and handover: what happens to software access, client records and files when the relationship ends
• Fees for extra work: whether you can charge for unusual data requests, file reconstruction or complex handovers

This is where a well-drafted client data agreement for accountants can prevent awkward disputes later. Without clear terms, you may struggle when a client asks you to delete files you need to retain, give unrestricted software access to a new adviser, or sign a DPA that doesn't fit your role.

What Happens If There Is A Data Breach Or Access Request?

You need a practical process before anything goes wrong, because UK GDPR deadlines can move quickly.

If you're a controller and a personal data breach is likely to risk people's rights and freedoms, you generally need to report it to the Information Commissioner's Office within 72 hours of becoming aware of it. If the risk is high, you may also need to tell affected individuals.

If you're a processor, you must notify the controller without undue delay after becoming aware of a breach. Your DPA should set out who you notify, what information you provide and how quickly you'll act.

Access requests can also come up. Individuals generally have the right to ask for a copy of their personal data, often called a subject access request. Controllers usually have one month to respond, with a possible extension of up to two further months for complex requests.

For an accountancy firm, this can get sensitive. An employee of your client might ask for payroll data. A director might ask for tax records. A former client might ask for everything you hold about them.

Your internal process should cover:

• How staff recognise a data breach or access request
• Who in your firm makes the first assessment
• Whether you're acting as controller or processor for the data involved
• How you contact the client if they're the controller
• How you preserve evidence and stop further unauthorised access
• How you document decisions and timings

You don't need a 50-page manual. You do need a simple, usable process your team can follow on a busy Monday morning.

How Should You Handle Cloud Software And Overseas Data Transfers?

You should check where your software providers process data and make sure your contracts cover any UK GDPR transfer requirements.

Many accountancy firms use cloud bookkeeping, payroll, document signing, client portal and practice management tools. These tools are often essential, but they also mean client data may be handled by third-party providers.

Your client terms should allow you to use suitable software providers. Your DPA should also deal with sub-processors if you're acting as a processor.

Ask these practical questions for each key platform:

• Does the provider process personal data for your firm?
• Is the provider based in the UK, the EEA or somewhere else?
• Does the provider use its own sub-processors?
• What security measures does the provider offer?
• Can you access audit, security or data processing terms, including any data processing addendum?
• What happens to client data if you stop using the platform?

If personal data is transferred outside the UK, you may need extra safeguards. Depending on the destination and provider, this could involve the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses.

This doesn't mean you can't use international software. It means you need to know what you're using, tell clients clearly where needed, and make sure the paperwork supports the way your firm works.

Common Mistakes To Avoid

Most data protection problems in accountancy firms come from unclear roles, unclear documents or unclear software arrangements.

Watch out for these common traps:

• Calling yourself a processor for everything: this can be wrong if you're giving professional advice, doing a client's books using professional judgement or meeting your own legal obligations
• Signing a client's DPA without checking it: some client documents make you accept duties that don't match your role or your systems
• Forgetting payroll employees: payroll data is often the most sensitive regular data you handle
• Using software without client terms: clients should know what platforms you rely on and how data is shared
• Leaving retention open-ended: your terms should say when you keep, return or delete files, while allowing you to meet legal and professional duties
• Ignoring staff training: your DPA won't help much if your team doesn't know how to spot a breach or access request

A good approach is to build a simple data map and records of processing activities. List your services, the data you handle, the systems you use, your likely UK GDPR role, and the document that covers that role. Once you have that, your engagement letter, DPA and privacy policy become much easier to align.

Key Takeaways

• Accountants can be controllers, processors or both, depending on the service and how much control they have over the data use.
• Payroll is often a processor activity, while tax advice, statutory accounts, AML checks and many bookkeeping services point towards controller status.
• A data processing agreement is needed when your firm processes personal data for a client as a processor under Article 28 of the UK GDPR.
• Your engagement letter should include practical client data terms covering roles, software, instructions, data sharing, retention and handover.
• Your privacy policy explains how your firm uses personal data as a controller and should be kept separate from your DPA.
• Cloud software, breach reporting, access requests and overseas transfers should be addressed before a problem appears.

If you'd like help with your client data terms, data processing agreement, privacy policy or software supplier clauses, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.