Data Processing Agreement (DPA)
Last updated: October 2025
This Data Processing Agreement (“Agreement”) forms part of the engagement or service contract (“Principal Agreement”) between:
(1) Your Accountant, a company registered in England (“Processor”), with its registered office at:
Your Accountant
Email: info@youraccountant.co.uk
Website: https://youraccountant.co.uk
and
(2) The Client (“Controller”), who receives professional accounting, bookkeeping, or tax services from Your Accountant Ltd.
Together referred to as “the Parties”.
1. Purpose and Scope
1.1 This Agreement governs the processing of personal data by Your Accountant Ltd on behalf of the Client in connection with services provided under the Principal Agreement.
1.2 The Parties acknowledge their respective roles as Data Controller (the Client) and Data Processor (Your Accountant Ltd) under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Definitions
For the purposes of this Agreement:
“Personal Data” means any information relating to an identified or identifiable natural person.
“Processing” means any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.
“Sub-Processor” means any third party engaged by Your Accountant Ltd to assist in processing Personal Data.
“Data Protection Legislation” means all applicable privacy and data-protection laws in the UK, including the UK GDPR and Data Protection Act 2018.
3. Processing Activities
3.1 Nature and purpose of processing: to provide accounting, bookkeeping, payroll, and tax-filing services to the Client.
3.2 Categories of data subjects: Client employees, directors, suppliers, customers, and other individuals whose information appears in the Client’s financial records.
3.3 Types of personal data: names, contact details, identification numbers, payroll data, financial transactions, and other information required for statutory compliance.
3.4 Duration: for the term of the Principal Agreement and any legal retention period thereafter.
4. Processor Obligations
Your Accountant shall:
a) Process Personal Data only on documented instructions from the Client.
b) Ensure personnel authorised to process data are bound by confidentiality obligations.
c) Implement appropriate technical and organisational measures to protect data (see Section 7).
d) Assist the Client in fulfilling obligations regarding data-subject rights, security, and breach notification.
e) Delete or return all Personal Data after termination, unless retention is required by law.
f) Maintain written records of all categories of processing carried out on behalf of the Client.
5. Controller Obligations
The Client shall:
a) Ensure it has a lawful basis for sharing Personal Data with Your Accountant Ltd.
b) Provide accurate and up-to-date information.
c) Comply with all relevant Data Protection Legislation.
d) Inform individuals, where required, that their data may be processed by Your Accountant Ltd for accounting and compliance purposes.
6. Sub-Processors
6.1 Your Accountant may engage approved Sub-Processors for cloud hosting, accounting software, and communication tools, including but not limited to:
Microsoft 365 / Google Workspace (email and storage)
Xero / QuickBooks Online (accounting software)
Shopify, Amazon, Etsy, eBay (e-commerce integrations)
ActiveCampaign / Meta / Google Analytics (marketing and reporting)
6.2 Your Accountant shall ensure each Sub-Processor is bound by equivalent data-protection obligations through written contracts.
6.3 A list of current Sub-Processors can be requested at any time via info@youraccountant.co.uk.
7. Security Measures
Your Accountant employs proportionate technical and organisational safeguards, including:
SSL/TLS encryption for data in transit;
Encrypted cloud storage and restricted access;
Multi-factor authentication;
Regular system updates and access audits;
Secure disposal of data and media;
Staff training on data protection and confidentiality.
8. Data Subject Rights
Your Accountant shall promptly inform the Client of any request received from a data subject (e.g. access, rectification, or deletion) and shall not respond directly unless authorised to do so by the Client.
