Data protection measures and practices that accounting firms and software providers must enforce

The General Data Protection Regulation (GDPR) was introduced in a bid to strengthen the protection of data and refresh existing legislation.

With it came new measures and practices for any business handling the personal data of its clients. Not just the way that it is stored, but also how customer information is used, transmitted, and collected. For accountants and for the software providers they use, where handling confidential data happens multiple times daily, this was huge news.

The impact of data handling rules for fintech and its users


Unfortunately, there’s no such thing as a cookie-cutter approach, where one data management system fits all businesses of all sizes. Probably the closest thing to a flexible solution are the cloud-based software providers. Not only do they supply the software, they supply the remote-server which stores the information going through it.

Accountancies taking ultimate responsibility for their clients’ data need to see that fintech is highly secure. Equally, the tech firms must meet stringent security requirements in order to get the appropriate licensing. It’s a tightly controlled sector, and that’s fair enough. Nobody wants their personal information to start leaking out everywhere.

What data protection measures must an accountancy firm take?


Ensure you have a registered data controller


Somebody within the company must be registered with the Information Commissioner’s Office (ICO) as a data controller. This isn’t a new formality so even for those established before GDPR this was probably already a box ticked.

Carry out an internal audit


Audit existing processes and systems against the compliance requirements will reveal the holes which need improvements.

Common weaknesses tend to be in how data is received or transmitted. Any software being used should also be compliant in the way data is treated and transferred.

For instance, bank feeds connect a user’s bank account to their bookkeeping software, automatically logging transactions. From bank to software and the connection in between, it’s a data sensitive process. This is why they’re subject to stringent regulation.

Create a Privacy Policy or ‘Privacy Note’


This is a public document which communicates the data protection measures you are taking. Practices are required to provide clients with access to this as soon as any information is requested from them. This includes the sign-up form.

There are plenty of official resources on the internet to help write a privacy document but in general it includes:

  • Details and identity of the company and its Data Protection Officer
  • Information regarding the transfer of data to any third parties
  • The retention period of the data (i.e. how long you intend to keep hold of it for)
  • How to withdraw consent at any time (where applicable)

Requesting client consent


As well as signposting to a privacy document when requesting information, businesses are also obliged to get consent for acquiring someone’s data. The opt-in must be deliberate, too – no pre-ticked or opt-out boxes here! This is especially important when designing website forms.

Provide access to personal data


Any individual must have readily available access to the information stored about themselves, upon request. This must be done so free of charge unless there are mitigating circumstances which make a fee viable, such as if the information is requested repeatedly.

Letters of disengagement


If and when a client decides to leave a firm, a letter of disengagement must be provided. It should clearly state how long their information will be retained before it is destroyed. The document should also outline exactly how this information will be disposed of.

If a controller or processor of data was to fail in complying with the regulations, they could be subject to a penalty of up to 4% of the company’s annual turnover or around £17.8 million – whichever sum is the larger of the two. So, failing to comply with GDPR is not only bad practice and inconsiderate towards customers, it can also be potentially fatal for a business when it comes to its finances.

The list above is by no means an exhaustive list of what is required of accounting firms around data protection. If this is something you are addressing in your business; we recommend seeking the advice of a legal professional for more in-depth information.

Pandle is a free accounting software designed to save time and reduce errors in bookkeeping. Learn more about using Pandle with your accountancy and bookkeeping clients.


Bekki Barnes

With 5 years’ experience in marketing, Bekki has knowledge in both B2B and B2C marketing. Bekki has worked with a wide range of brands, including local and national organisations.

Automated Testing Tools and Their Impact on Software Quality

Natalia Yanchii • 09th October 2024

Test automation refers to using specialized software tools and frameworks to automate the execution of test cases, thereby reducing the time and effort required for manual testing. This approach ensures that automation tests run quickly and consistently, allowing development teams to identify and resolve defects more effectively. Test automation provides greater accuracy by eliminating human...

Custom Software Development

Natalia Yanchii • 04th October 2024

There is a wide performance gap between industry-leading companies and other market players. What helps these top businesses outperform their competitors? McKinsey & Company researchers are confident that these are digital technologies and custom software solutions. Nearly 70% of the top performers develop their proprietary products to differentiate themselves from competitors and drive growth. As...

The Impact of Test Automation on Software Quality

Natalia Yanchii • 04th October 2024

Software systems have become highly complex now, with multiple interconnected components, diverse user interfaces, and business logic. To ensure quality, QA engineers thoroughly test these systems through either automated or manual testing. At Testlum, we met many software development teams who were pressured to deliver new features and updates at a faster pace. The manual...

Custom Software Development

Natalia Yanchii • 03rd October 2024

There is a wide performance gap between industry-leading companies and other market players. What helps these top businesses outperform their competitors? McKinsey & Company researchers are confident that these are digital technologies and custom software solutions. Nearly 70% of the top performers develop their proprietary products to differentiate themselves from competitors and drive growth. As...

The Impact of Test Automation on Software Quality

Natalia Yanchii • 03rd October 2024

Software systems have become highly complex now, with multiple interconnected components, diverse user interfaces, and business logic. To ensure quality, QA engineers thoroughly test these systems through either automated or manual testing.
The Digital Transformation Expo is coming to London on October 2-3. Register now!