Clients trust you with their most sensitive records.
Bank statements, payroll, tax identifiers and ID documents are personal data, and clients increasingly ask for a data processing agreement. A clear process for handling, storing and deleting their data makes you easier to hire and harder to replace.
Your role depends on the service
For work done on a client's instructions, such as payroll or bookkeeping, you are generally a processor. For other work, such as advice or statutory duties, you may be a controller, and national rules differ. The pack helps you decide and document it.
Your tools hold client data
Cloud accounting, document portals and email all store client records. The sub-processor checklist shows what to verify with each and how to add or change tools.
Tax records have set periods
Clients' records must usually be kept for a legal period, but not indefinitely. Retention guidance separates what to keep from what to delete or return.
Five parts. One clear approach to client data.
Each part stands on its own and also points to the next: the handling rules shape your tool list, the DPA clauses formalise it, and the notice tells clients what you do.
Client data handling
Receive, store and share client data with care.
- What to collect, how to receive it and where it is stored
- Who in your firm may access each client's data
- Sending and sharing client files securely
Sub-processor checklist
Know the tools that hold your clients' records.
- What to verify with each tool: DPA, data location, transfer mechanisms
- A simple process for adding or removing a sub-processor
Retention for tax records
How long to keep what, and what to do afterwards.
- How long to keep client records, working papers and payroll data
- Notes on national tax and accounting rules
- When to delete, return or anonymise records after the engagement
DPA clauses when you act as processor Template clauses
The Article 28 contract your clients may ask for.
- Clauses covering instructions, confidentiality, security, sub-processors and assistance
- Handling data subject requests and breaches on the client's behalf
- Return or deletion of data at the end of the engagement
Privacy notice for your own clients
Tell clients what you do with their data.
- What you collect about clients and their contacts, and why
- Wording for engagement letters and your website
Real wording, not a table of contents.
Two short excerpts from the pack. Highlighted fields are the parts you fill in for your own firm.
Processing only on instructions
The Accountant processes personal data only on the Client's documented instructions, including regarding transfers to a third country, unless required to do otherwise by law. The Accountant ensures that everyone authorised to process the data is bound by a duty of confidentiality, and does not engage another processor without the Client's prior authorisation.
Replace the defined terms with your firm and client names, and attach the list of approved sub-processors as [Annex].
The full pack covers every Article 28(3) point as a clause or checklist item.
Information about you and your clients
We collect the details clients give us to carry out our engagement, such as names, contact details, tax identifiers and financial records. We use them to deliver our services and to meet our legal duties, and keep them for [retention period]. Where we process client data on a client's instructions, the client's own privacy notice applies and our agreement with them governs how we handle it.
Questions can be sent to [contact email].
The full pack adds wording for engagement letters and websites.
These are shortened starting points. Your own notices and records must reflect what you actually do, and national rules vary. The pack shows you where to check.
Who it's for, and who it isn't.
A good fit if you
- Run an accountancy, bookkeeping or tax advisory practice
- Handle client financial, payroll or identity data
- Use cloud accounting, document portals and email
- Have no in-house privacy counsel
Not enough on its own if you
- Are a large firm with statutory audit duties and a dedicated compliance team
- Process special-category data for clients at scale, for example payroll with health information
- Work where national professional rules fix your role and need local advice
- Need a signed, lawyer-reviewed contract; the pack is not legal advice
Five parts. One payment.
Everything on this page, delivered together. Adapt it to your business, update your notices and answer the next question from the same documents.
- Client data handling
- Sub-processor checklist
- Retention for tax records
- DPA clauses when you act as processor
- Privacy notice for your own clients
Before you ask —
Who is the Accountant & Bookkeeper Compliance Pack for?
Accountants, bookkeepers and tax advisers in the EU that process client financial and personal data and need clear processor arrangements and notices.
What do I receive?
Five parts: client data handling rules, a sub-processor checklist, retention guidance for tax records, DPA clauses for when you act as processor and a privacy notice for your own clients. You get your download page straight after checkout, with no account to create.
Am I a controller or a processor?
It depends on the service and on national rules. Where you handle data only on a client's instructions, such as routine bookkeeping or payroll, you are generally a processor. Where you decide how and why data is used, for example under your own professional or legal duties, you may be a controller. The pack explains the difference and helps you document it.
Can I keep client records after the engagement ends?
Only for as long as you have a legal duty or another valid reason. Tax and accounting rules set minimum periods, which differ by country. The retention guidance explains what to keep, what to return and what to delete.
Do my clients need a DPA with me?
Where you act as a processor, yes: Article 28 requires a written contract with set content. The pack gives template clauses and a checklist so you can offer a standard one to every client.
Is this legal advice?
No. The pack is a practical starting point. The wording and records are drafts you adapt to how you really work, and national rules vary. Have a qualified lawyer review anything you rely on.
What if it isn't what I expected?
Email hello@gdprgard.eu within 14 days for a full refund. No form to fill in.
Be the firm clients trust with their records.
Get the handling rules, DPA clauses, retention guidance and notices in one pack.
Get the Pack — €39