Data protection measures and practices that accounting firms and software providers must enforce
The General Data Protection Regulation (GDPR) was introduced in a bid to strengthen the protection of data and refresh existing legislation.
With it came new measures and practices for any business handling the personal data of its clients. Not just the way that it is stored, but also how customer information is used, transmitted, and collected. For accountants and for the software providers they use, where handling confidential data happens multiple times daily, this was huge news.
The impact of data handling rules for fintech and its users
Unfortunately, there’s no such thing as a cookie-cutter approach, where one data management system fits all businesses of all sizes. Probably the closest thing to a flexible solution are the cloud-based software providers. Not only do they supply the software, they supply the remote-server which stores the information going through it.
Accountancies taking ultimate responsibility for their clients’ data need to see that fintech is highly secure. Equally, the tech firms must meet stringent security requirements in order to get the appropriate licensing. It’s a tightly controlled sector, and that’s fair enough. Nobody wants their personal information to start leaking out everywhere.
What data protection measures must an accountancy firm take?
Ensure you have a registered data controller
Somebody within the company must be registered with the Information Commissioner’s Office (ICO) as a data controller. This isn’t a new formality so even for those established before GDPR this was probably already a box ticked.
Carry out an internal audit
Audit existing processes and systems against the compliance requirements will reveal the holes which need improvements.
Common weaknesses tend to be in how data is received or transmitted. Any software being used should also be compliant in the way data is treated and transferred.
For instance, bank feeds connect a user’s bank account to their bookkeeping software, automatically logging transactions. From bank to software and the connection in between, it’s a data sensitive process. This is why they’re subject to stringent regulation.
Create a Privacy Policy or ‘Privacy Note’
This is a public document which communicates the data protection measures you are taking. Practices are required to provide clients with access to this as soon as any information is requested from them. This includes the sign-up form.
There are plenty of official resources on the internet to help write a privacy document but in general it includes:
- Details and identity of the company and its Data Protection Officer
- Information regarding the transfer of data to any third parties
- The retention period of the data (i.e. how long you intend to keep hold of it for)
- How to withdraw consent at any time (where applicable)
Requesting client consent
As well as signposting to a privacy document when requesting information, businesses are also obliged to get consent for acquiring someone’s data. The opt-in must be deliberate, too – no pre-ticked or opt-out boxes here! This is especially important when designing website forms.
Provide access to personal data
Any individual must have readily available access to the information stored about themselves, upon request. This must be done so free of charge unless there are mitigating circumstances which make a fee viable, such as if the information is requested repeatedly.
Letters of disengagement
If and when a client decides to leave a firm, a letter of disengagement must be provided. It should clearly state how long their information will be retained before it is destroyed. The document should also outline exactly how this information will be disposed of.
If a controller or processor of data was to fail in complying with the regulations, they could be subject to a penalty of up to 4% of the company’s annual turnover or around £17.8 million – whichever sum is the larger of the two. So, failing to comply with GDPR is not only bad practice and inconsiderate towards customers, it can also be potentially fatal for a business when it comes to its finances.
The list above is by no means an exhaustive list of what is required of accounting firms around data protection. If this is something you are addressing in your business; we recommend seeking the advice of a legal professional for more in-depth information.
Pandle is a free accounting software designed to save time and reduce errors in bookkeeping. Learn more about using Pandle with your accountancy and bookkeeping clients.
