UK GDPR pack for accountancy practices
The data protection records, policies and procedures a practice needs, written for client tax, payroll and anti-money laundering work. Up to date with the Data (Use and Access) Act 2025.
UK practicesWhat the law expects of your firmDocument in the pack
A written record of how you use personal informationArticle 30
✓Record of processingFilled in for a typical practice
A policy for special category and criminal offence dataDPA 2018 Schedule 1
✓Appropriate policy documentNeeded for anti-money laundering checks
Keeping information no longer than neededArticle 5
✓Retention schedulePeriods for each type of record
Reporting serious breaches within 72 hoursArticles 33 and 34
✓Breach procedure and logDeadlines worked out for you
Answering requests for personal informationArticle 15
✓Subject access procedure and logWith response letter
Handling data protection complaintsin force since 19 June 2026
✓Complaints procedure and logAcknowledge within 30 days
Contracts with software providersArticle 28
✓Supplier checklist
Telling staff how you use their dataArticle 13
✓Staff privacy notice
Who it's for
Sole practitioners and small firms that hold client, payroll and anti-money laundering records.
Last checked
Checked against the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
