Data protection measures and practices that accounting firms and software providers must enforce

The General Data Protection Regulation (GDPR) was introduced in a bid to strengthen the protection of data and refresh existing legislation.

With it came new measures and practices for any business handling the personal data of its clients. Not just the way that it is stored, but also how customer information is used, transmitted, and collected. For accountants and for the software providers they use, where handling confidential data happens multiple times daily, this was huge news.

The impact of data handling rules for fintech and its users


Unfortunately, there’s no such thing as a cookie-cutter approach, where one data management system fits all businesses of all sizes. Probably the closest thing to a flexible solution are the cloud-based software providers. Not only do they supply the software, they supply the remote-server which stores the information going through it.

Accountancies taking ultimate responsibility for their clients’ data need to see that fintech is highly secure. Equally, the tech firms must meet stringent security requirements in order to get the appropriate licensing. It’s a tightly controlled sector, and that’s fair enough. Nobody wants their personal information to start leaking out everywhere.

What data protection measures must an accountancy firm take?


Ensure you have a registered data controller


Somebody within the company must be registered with the Information Commissioner’s Office (ICO) as a data controller. This isn’t a new formality so even for those established before GDPR this was probably already a box ticked.

Carry out an internal audit


Audit existing processes and systems against the compliance requirements will reveal the holes which need improvements.

Common weaknesses tend to be in how data is received or transmitted. Any software being used should also be compliant in the way data is treated and transferred.

For instance, bank feeds connect a user’s bank account to their bookkeeping software, automatically logging transactions. From bank to software and the connection in between, it’s a data sensitive process. This is why they’re subject to stringent regulation.

Create a Privacy Policy or ‘Privacy Note’


This is a public document which communicates the data protection measures you are taking. Practices are required to provide clients with access to this as soon as any information is requested from them. This includes the sign-up form.

There are plenty of official resources on the internet to help write a privacy document but in general it includes:

  • Details and identity of the company and its Data Protection Officer
  • Information regarding the transfer of data to any third parties
  • The retention period of the data (i.e. how long you intend to keep hold of it for)
  • How to withdraw consent at any time (where applicable)

Requesting client consent


As well as signposting to a privacy document when requesting information, businesses are also obliged to get consent for acquiring someone’s data. The opt-in must be deliberate, too – no pre-ticked or opt-out boxes here! This is especially important when designing website forms.

Provide access to personal data


Any individual must have readily available access to the information stored about themselves, upon request. This must be done so free of charge unless there are mitigating circumstances which make a fee viable, such as if the information is requested repeatedly.

Letters of disengagement


If and when a client decides to leave a firm, a letter of disengagement must be provided. It should clearly state how long their information will be retained before it is destroyed. The document should also outline exactly how this information will be disposed of.

If a controller or processor of data was to fail in complying with the regulations, they could be subject to a penalty of up to 4% of the company’s annual turnover or around £17.8 million – whichever sum is the larger of the two. So, failing to comply with GDPR is not only bad practice and inconsiderate towards customers, it can also be potentially fatal for a business when it comes to its finances.

The list above is by no means an exhaustive list of what is required of accounting firms around data protection. If this is something you are addressing in your business; we recommend seeking the advice of a legal professional for more in-depth information.

Pandle is a free accounting software designed to save time and reduce errors in bookkeeping. Learn more about using Pandle with your accountancy and bookkeeping clients.


Bekki Barnes

With 5 years’ experience in marketing, Bekki has knowledge in both B2B and B2C marketing. Bekki has worked with a wide range of brands, including local and national organisations.

Ab Initio partners with BT Group to deliver big data

Luke Conrad • 24th October 2022

AI is becoming an increasingly important element of the digital transformation of many businesses. As well as introducing new opportunities, it also poses a number of challenges for IT teams and the data teams supporting them. Ab Initio has announced a partnership with BT Group to implement its big data management solutions on BT’s internal...

WAICF – Dive into AI visiting one of the most...

Delia Salinas • 10th March 2022

Every year Cannes held an international technological event called World Artificial Intelligence Cannes Festival, better known by its acronym WAICF. One of the most luxurious cities around the world, located on the French Riviera and host of the annual Cannes Film Festival, Midem, and Cannes Lions International Festival of Creativity. 

Bouncing back from a natural disaster with resilience

Amber Donovan-Stevens • 16th December 2021

In the last decade, we’ve seen some of the most extreme weather events since records began, all driven by our human impact on the plant. Businesses are rapidly trying to implement new green policies to do their part, but climate change has also forced businesses to adapt and redefine their disaster recovery approach. Curtis Preston,...