Data Protection Policy
Last updated: October 2025
1. Introduction
Your Accountant (“we”, “us”, “our”) is committed to protecting the privacy, confidentiality, and security of all personal data we handle.
We recognise that the lawful and correct treatment of personal data is essential to maintaining the trust of our clients, partners, and employees.
This Policy outlines how Your Accountant complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and related privacy laws.
2. Purpose
The purpose of this Policy is to:
Ensure personal data is processed lawfully, fairly, and transparently;
Define responsibilities for data protection across the organisation;
Demonstrate accountability to clients, regulators, and the public;
Protect the rights and freedoms of all individuals whose data we handle.
3. Scope
This Policy applies to:
All personal data processed by Your Accountant;
All employees, contractors, and partners handling data on our behalf;
All systems, networks, and third-party services used for data processing.
It covers both client data (processed as a Data Processor) and internal data (processed as a Data Controller).
4. Our Data Protection Principles
Your Accountant adheres to the seven principles of UK GDPR:
Lawfulness, Fairness, and Transparency — We process data lawfully, fairly, and clearly.
Purpose Limitation — We only use data for legitimate business or legal purposes.
Data Minimisation — We collect only the data we need.
Accuracy — We keep data accurate and up to date.
Storage Limitation — We retain data only as long as necessary.
Integrity and Confidentiality — We protect data against unauthorised or unlawful processing, loss, or damage.
Accountability — We take responsibility for demonstrating compliance with these principles.
5. Lawful Bases for Processing
We process personal data under the following lawful bases:
Contractual necessity — to perform agreed services (e.g. accounting, payroll, tax filings).
Legal obligation — to comply with UK laws such as HMRC regulations.
Legitimate interests — to operate our business efficiently and improve services.
Consent — for marketing communications and optional cookies.
6. Data Categories
The types of personal data we handle may include:
Names, addresses, and contact details;
National Insurance numbers, payroll, and financial records;
Business registration details;
Banking, tax, and VAT information;
IP addresses, email communications, and website usage data (cookies).
We do not intentionally collect special category data (e.g. health, ethnicity, political beliefs) unless required for legal compliance or HR purposes.
7. Roles and Responsibilities
Directors — ultimate accountability for data protection and compliance.
Data Protection Officer (DPO) — oversees policy implementation and liaises with the ICO.
All Staff — must handle personal data in line with this Policy and receive regular training.
DPO contact: info@youraccountant.co.uk
8. Security of Personal Data
We implement appropriate technical and organisational measures to safeguard personal data, including:
SSL/TLS encryption and secure servers;
Encrypted storage and backup systems;
Role-based access control;
Multi-factor authentication;
Regular software updates and vulnerability checks;
Physical security measures at offices and data centres;
Secure disposal and deletion procedures.
9. Data Sharing and Sub-Processors
We may share data with third-party service providers strictly as needed to deliver our services, including:
Accounting platforms (e.g. Xero, QuickBooks);
E-commerce platforms (e.g. Shopify, Amazon, eBay, Etsy);
Payment processors;
Cloud hosting, CRM, and email providers.
All third-party providers are bound by data-processing agreements ensuring compliance with UK GDPR.
We never sell or rent personal data.
10. International Transfers
If personal data is transferred outside the UK or EEA, Your Accountant ensures that adequate safeguards are in place, such as:
Transfers to countries with adequacy decisions; or
Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office (ICO).
11. Data Retention
We retain personal data only for as long as necessary for:
Contractual or legal obligations (e.g. 7 years for HMRC compliance);
Business record-keeping and auditing purposes;
Marketing consent until withdrawal.
Data is securely deleted or anonymised when no longer required.
12. Data Subject Rights
Under UK GDPR, individuals have the right to:
Access their personal data;
Request correction or deletion;
Object to processing or restrict it;
Withdraw consent (where applicable);
Request data portability;
Lodge a complaint with the ICO (Information Commissioner’s Office).
Requests can be submitted via info@youraccountant.co.uk.
We respond within one calendar month of receipt.
13. Data Breach Management
In the event of a suspected or confirmed data breach:
The DPO will assess the risk to individuals and the business;
High-risk breaches will be reported to the ICO within 72 hours;
Affected individuals will be notified without undue delay;
Corrective and preventive measures will be documented and implemented.
14. Training and Awareness
All employees and contractors receive regular training on:
Data protection principles;
Secure handling of client and financial data;
Recognising phishing and social-engineering threats;
Reporting data incidents promptly.
15. Monitoring and Review
This Policy is reviewed annually, or sooner if significant legal or operational changes occur.
Updates will be approved by management and communicated to all staff.
