Your firm holds financial records, tax returns, IDs, bank details and payroll for dozens of client businesses and their employees — some of the most sensitive data there is, concentrated in one place. Most of it flows through email inboxes and shared drives, which makes an accounting practice a high-value breach target.
The reality
None of this is malicious — it's just how the work flows. But each one is a real GDPR gap a client, a competitor or a disgruntled ex-collaborator can report.
Clients email payslips, IDs and bank details as attachments. They land in personal inboxes, get forwarded, sit in "sent" folders — with no encryption, access control or deletion.
A single Google Drive or network folder holds every client's files, accessible to all staff and freelancers with no per-client access levels.
Payslips and payroll runs — employee personal data — go back to clients by plain email, where one wrong recipient or a leaked inbox is a reportable breach.
Accounting and payroll software, client portals and cloud tools process client data with no data-processing agreement and no idea where it's stored.
Files for former clients and old engagements sit on the server far beyond the legal retention period — data you no longer need but are still responsible for.
Seasonal and freelance staff get full access to everything, and that access is never revoked when the engagement or tax season ends — no off-boarding.
It only takes one. A misdirected payroll email, a leaked inbox, a former freelancer who still has access, a client who asks "what data do you hold on us and why?" — any of these can turn into a complaint to the data protection authority. The fix is far cheaper than the incident.
The fix
We don't hand you a policy and leave. We change how data actually flows through your practice, with tools your team and your clients will actually use.
A simple, encrypted portal for clients to send and receive payslips, IDs and tax documents — replacing email attachments — that's easier for everyone, not harder.
Client data encrypted and organised with per-client access control: each member of staff sees only the clients they work on — no more one-drive-for-everyone.
A retention schedule aligned to fiscal and tax law, with automated deletion once the legal period lapses — so you stop holding data you no longer need.
Data-processing agreements and storage checks for your accounting, payroll and cloud providers and portals — so your supply chain is covered too.
A clear off-boarding process for staff and freelancers, with access revoked when an engagement ends, plus audit logs of who accessed what.
A short, practical staff briefing and a simple breach procedure (including "I emailed the wrong client"), plus the records an authority will ask for.
How we work
We follow real client data end-to-end: where the payslip, the ID and the tax return go, and on which device or tool.
We flag the non-compliant flows and the concrete risks — prioritised, in plain language, not a 90-page report.
We set up secure document exchange, encryption, per-client access, retention and the DPAs — and migrate you off email attachments and shared drives.
A short team briefing, a breach plan and the records of processing — so it stays compliant day to day.
FAQ
The questions firms ask us most.
Tell us how you take in and send client documents today. We'll show you the gaps and the fix — response within 4 working hours, no commitment.
EN
IT
ES