Ledgery
← BlogGDPR ACCOUNTING SOFTWARE

GDPR Accounting Software: What UK Data Protection Law Requires

GDPR Accounting Software: What UK Data Protection Law Requires ! Abstract safeguards surrounding accounting records In the UK, accounting software is covered by the UK GDPR and the Data Protection Act 2018, not by the EU version of the regulation.

14 MIN READ

GDPR Accounting Software: What UK Data Protection Law Requires

Abstract safeguards surrounding accounting records

In the UK, accounting software is covered by the UK GDPR and the Data Protection Act 2018, not by the EU version of the regulation. Any software that stores names, addresses, bank transactions or invoices of identifiable people holds personal data. The business using the software and the company providing it each have duties. Choosing well means checking where data is stored, who can access it, what the contract says and how the provider handles breaches and requests.

Ledgery
Simplify tax record keeping
Ledgery scans receipts and organizes them into quarterly HMRC updates, helping self-employed people and property owners spend less time on tax admin.

TL;DR

  • UK data protection rests on the UK GDPR and the Data Protection Act 2018, and it applies to anyone responsible for using personal data.
  • The user of the software is usually the controller. The software provider is usually a processor. The controller keeps its obligations when a processor is involved.
  • A written data processing agreement is mandatory when a processor handles personal data on a controller’s behalf.
  • Useful checks cover data location, access, encryption, multi-factor authentication, logging, breach response, retention and exit terms.
  • Sole traders and landlords hold less client data than firms, but receipts, invoices, tenant details and bank feeds still contain personal data.

Table of Contents

Does GDPR apply in the UK?

The UK has its own version. According to GOV.UK, data protection in the UK is governed by the UK General Data Protection Regulation and the Data Protection Act 2018. The rules apply to everyone responsible for using personal data, unless an exemption applies.

The ICO explains that the UK GDPR covers processing by organisations operating in the UK. It also covers organisations outside the UK that offer goods or services to individuals in the UK. A software company based abroad that sells to UK sole traders therefore falls within scope.

In practice, the phrase “GDPR accounting software” is shorthand. No product is certified as GDPR compliant by law. What exists is software that helps its users meet their obligations, and a provider that meets its own obligations as a processor.

Why accounting records count as personal data

Accounting records contain more personal data than many users expect. A sole trader’s ledger can include customer names, home addresses, email addresses, payment details and notes on invoices. A landlord’s records can include tenant names, rent payments and repair costs linked to a named property. Receipts may show a name, a card fragment or a location.

The ICAEW guidance for accountants states that accountancy firms typically process client data and firm data, and both can be personal data relating to identifiable living individuals. The same logic applies to a self-employed person who keeps customer records, and to an accountant who is invited into a client’s software.

Two points follow. First, the data about the sole trader personally is also personal data, so a tax record is not exempt just because it is financial. Second, the data should be limited to what the tax return needs. Collecting less reduces the risk if something goes wrong.

Controller and processor: who is responsible

The UK GDPR separates two roles. A controller decides the purposes and means of processing. A processor processes personal data on the controller’s behalf. The ICO’s guidance adds that processors have specific obligations of their own, and that controllers are not relieved of their obligations when a processor is involved.

For most accounting software the split looks like this:

Party Usual role Typical responsibilities
Sole trader or landlord using the software Controller Decides what data goes in, keeps it accurate, uses it lawfully, responds to requests from customers or tenants
Software provider Processor Stores and processes data on instruction, secures the platform, assists with requests and breaches
Accountant with access Often a controller for their own work, or a processor, depending on the arrangement Protects client data, follows the engagement terms

The ICAEW notes that processors have legal obligations, including keeping records of processing activities and telling the controller about a breach. Processors can also be held responsible for breaches. The shared duty is why the choice of software matters to the user as well as to the provider.

Checks to make before choosing accounting software

The ICAEW’s data mapping helpsheet sets out a method that works for a firm and scales down to a one-person business. It asks users to identify the personal data held and where it is stored, who has access and which software providers can see it. It also asks for a review of retention, security, data sharing and transfers.

Applied to software selection, that becomes a short list of questions:

  1. What personal data will go into the system: customer details, tenant details, bank transactions, receipts?
  2. Where is the data stored, and in which country?
  3. Who can see it: the user, an accountant, provider staff, sub-processors?
  4. How long is data kept, and what happens when the account closes?
  5. Is there a written data processing agreement?
  6. What happens in a breach, and how quickly is the user told?
  7. Can the data be exported in a usable format?

The answers should be written down. Documentation is part of showing that the controller has thought about its processors.

Security controls worth looking for

The UK GDPR does not name a fixed list of tools. The text of the regulation, as held on legislation.gov.uk, requires appropriate technical and organisational measures for security that match the risk. Examples it gives include pseudonymisation and encryption, keeping systems confidential, intact, available and resilient, restoring availability after an incident, and regularly testing the measures.

The ACCA’s data protection guidance turns this into a practical list for choosing a provider:

  • Encryption in transit and at rest.
  • Role-based access and multi-factor authentication.
  • Logging and monitoring.
  • Penetration testing and a plan for handling vulnerabilities.
  • An incident response plan.

The ACCA also says that ISO 27001 evidence can be a strong indicator of a provider’s security practice. Providers usually publish their security information on a trust or security page, and that page is the first place to read.

Security covers the user’s side too. A strong provider cannot offset a shared password or an unlocked phone. The ICAEW helpsheet asks whether an IT security policy covers staff devices, including mobiles and tablets, and whether backup policies exist. A sole trader can apply the same questions to a phone used for scanning receipts: a screen lock, an updated operating system and a unique password for the accounting account.

Data location and cloud storage

Cloud software stores data on servers somewhere. The ICAEW client files helpsheet says that where cloud storage is used, the user should establish where the data is located geographically. It also says firms should assess the personal data they hold and where it is stored, including emails and portable storage media.

The same helpsheet reminds readers that one principle of UK GDPR requires processing in a way that ensures appropriate security. That includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, for both electronic and paper files.

For receipts, this has a practical side. A paper receipt photographed and uploaded becomes a digital record. The paper copy can then be filed or disposed of in line with the user’s own retention policy, so there are fewer loose copies in drawers, bags and email attachments. Keeping receipts in one system also makes it easier to know where personal data sits. More on that in receipt scanning for UK tax records.

Data location and cloud storage

The data processing agreement

A written contract is not optional. The ACCA states that when a processor is used for accounting software, a written data processing agreement is mandatory under Article 28 of the UK GDPR. It lists the minimum content:

  • Processing only on the controller’s instructions.
  • A duty of confidence on staff.
  • Security measures.
  • Rules on sub-processors.
  • Help with data subject rights.
  • Provisions for the end of the contract.
  • Audits and inspections.

Most reputable providers include a data processing agreement in their terms or offer one on request. The user’s task is to find it, read it against that list, and keep a copy with the business records. A user who cannot find one should ask the provider before loading customer or tenant data into the system.

Requests, breaches, retention and deletion

Three situations test whether software fits the legal duties.

Access and deletion requests. A customer or tenant can ask what data a business holds on them, or ask for it to be corrected or deleted. The business as controller must respond. Software helps when records can be searched by person, exported and edited. Sprintlaw’s guidance on sub-processor obligations recommends ensuring that processors can assist with access, deletion and portability within the legal timelines, and that contracts and service levels line up with those timelines.

Personal data breaches. The ICAEW’s breach guidance describes the reporting timeline as without undue delay and, where feasible, no later than 72 hours after becoming aware. The clock starts when the controller is aware that personal data has been compromised. When a breach must be reported to the ICO, the notice covers the nature of the breach, the categories and numbers of people affected, a contact point, the likely consequences and the measures taken. A provider that tells its users quickly gives them the best chance of meeting that window.

Retention. Personal data should not be kept longer than needed, but tax records must be kept for the periods HMRC sets. The retention period for each type of record should be fixed by reference to HMRC’s record-keeping rules and written in the business’s data map. Software that lets the user export records before closing an account supports both goals.

Three key data handling duties

Switching software without creating a data problem

Moving between tools is a data transfer. Wise’s guide to switching accounting software advises making sure transfers to a new system comply with UK GDPR and are documented. It adds that any third-party migration service should act as a processor under a formal agreement, so responsibilities stay clear.

A simple switching routine:

  1. Export a full copy of records from the old system before closing it.
  2. Note what was moved, when and by whom.
  3. Confirm any migration helper has a written processor agreement.
  4. Check that the new provider’s agreement is in place before importing.
  5. Delete or archive the old data in line with the retention plan.

Our perspective

Tax software handles some of the most sensitive records a self-employed person owns. We think the right approach is to keep as much of the work as possible in one place, with clear control over who sees it.

Ledgery brings receipt scanning, Open Banking feeds, bookkeeping and HMRC filing for self-employment and property income into one platform. Fewer separate tools mean fewer places where receipts, invoices and bank data are copied, emailed or forgotten. A single record is easier to map, easier to export and easier to explain to a customer or an accountant.

Filing stays under the user’s control. Nothing goes to HMRC without the user submitting it. Accountant access lets a bookkeeper or accountant work on the same records without files travelling by email, and records can be exported when needed.

We built Ledgery for sole traders and property owners who want to meet Making Tax Digital requirements with less admin. Good data handling is part of that: capture a receipt once, keep it with the right transaction and know where it is.

The Ledgery Team

Ledgery for sole traders and landlords

Ledgery is income tax software for UK self-employed individuals and property owners. It scans receipts with AI, turns records into quarterly HMRC updates, stores income and expense records, creates invoices, sends deadline reminders and exports data. The first quarter is free, and it is available in Simple, Grow and Pro plans. It supports sole trader and property income. It does not cover limited companies or VAT.

Ledgery

The plans and sign-up are on the Ledgery site. Related reading on keeping records in order includes bank charges and what can be claimed and whether a sole trader needs a separate bank account, since a clean separation of business and personal transactions also limits how much personal data enters the accounting record.

Guidance for accountants and bookkeepers

Accountants who are invited into a client’s software take on duties of their own. The ICAEW’s data mapping questions apply directly: who has access to client files, whether engagement letters and privacy notices have been updated, and whether backups exist. The engagement letter should say whether the accountant acts as controller or processor for the work, and which system holds the records.

The accountant should also record which software providers can access client data, since that information belongs in the practice’s data map. Where clients use their own software, the agreement between the client and the provider sits alongside the accountant’s own terms, and the two should not conflict.

FAQ

Is there GDPR-compliant accounting software?

Compliance depends on how the software is used as well as how it is built. A provider can supply security measures, a data processing agreement and support for rights requests. The user, as controller, still has to use the tool lawfully and keep documentation. The sensible test is whether the provider’s terms and security features match the checks listed above.

Does the UK still follow GDPR after Brexit?

The UK has its own version, the UK GDPR, which sits alongside the Data Protection Act 2018. GOV.UK confirms that these two laws govern data protection in the UK. Organisations outside the UK that offer goods or services to people in the UK are also covered, according to the ICO.

Does a sole trader need a data processing agreement with an accounting software provider?

The ACCA states that a written data processing agreement is mandatory under Article 28 when a processor handles personal data for a controller. A sole trader who holds customer data in the software is a controller in that sense. Most providers include the agreement in their standard terms, so the first step is to find it and keep a copy.

How quickly must a data breach be reported?

The ICAEW describes the ICO reporting timeline as without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. Not every breach needs reporting, and the ICO’s own guidance decides which ones do. A provider acting as processor must inform the controller of a breach so the controller can act in time.

What should be checked when switching accounting software?

The transfer should be documented and should comply with UK GDPR. Any migration helper should work under a written processor agreement. A full export from the old system, a dated note of what moved and a deletion or archive step for the old copy cover the main points.

Sources

LAUNCHING APRIL 2027
Ledgery does the four updates and the final declaration. £3 a month.

Self-employment and property income in one subscription, 30 days free to start. Join the early access list and we’ll email you once, when it opens.

Join early access
gdpr accounting software

This article is general information about Making Tax Digital, not tax advice for your situation. Rules and dates come from HMRC guidance current at the date of publication — check the latest position before acting, or speak to an accountant.