Accountio / Templates / UK GDPR / Data protection policy

Data protection policy template (UK) for accountancy practices

Set out the rules everyone in your firm follows when handling personal information about clients, their staff and families, and your own team. This data protection policy template is one Word document in 13 short sections, written for tax, payroll and anti-money laundering work.

UK practices
$15
In the pack
UK GDPR pack for practices
Files
10, Word and Excel
Buy the pack · $15
Global library · 101 packs

Get this pack and 100 more for $129

UK GDPR for practices · this packAML complianceCharity accountsEstate administrationMTD for Income TaxP11D and payrollingUK SRS readinessCarbon reduction planCIS+ 92 more
$129$1,42191% off

You save $1,292 on buying them one by one

Buy the global library · $129

What the policy looks like

Data protection policy template
What the policy sets outSection in the policy
Who leads on data protection
✓
1. Who is responsibleController, data protection lead, an optional DPO line and your ICO registration number
The data protection principles
✓
2. The principles we followThe six principles in plain words, and keeping a record to show the ICO
What you use information for
✓
3. What we use personal information forClient work, AML checks, employing staff, running the firm and marketing, each with its lawful basis
Limits on AML data
✓
3. What we use personal information forIdentity check information used only to prevent money laundering, terrorist financing and proliferation financing
Privacy notices
✓
4. Telling peopleClients get the notice with the engagement letter, before you take them on
Security
✓
5. Keeping information secureEncryption, screen locks, multi-factor sign-in, secure sending, paper records, home working and backups
Software and other suppliers
✓
6. Software providers and other suppliersWritten contracts for every supplier that handles personal information, checked before use
Information sent abroad
✓
7. Information sent outside the UKAdequacy or an approved transfer agreement before you use a supplier
Requests from individuals
✓
8. People's rightsAccess, correction, deletion, objection and restriction, answered within one month
Breaches
✓
9. BreachesTell the data protection lead at once, report to the ICO within 72 hours where required
Complaints
✓
10. ComplaintsAcknowledged within 30 days, with the outcome given
AI tools
✓
11. AI toolsNo client or staff information in free or public tools, and every output checked
Training and review
✓
12. Training, 13. Reviewing this policyTraining on joining and every year, an annual review and a record of the last change

Why you need one

The UK GDPR says a firm must be able to show it handles personal information in line with the data protection principles. Article 24 says that, where proportionate, this includes having data protection policies.

  • Your professional body, insurer or a client asks to see your data protection policy
  • Staff need written rules on secure sending, home working and AI tools
  • You have filled in your record of processing and need the rules that sit behind it
  • You are bringing in new practice software or a client portal
  • Your policy doesn't yet cover the duty to handle data protection complaints, which applies from 19 June 2026

How to use the data protection policy template

  1. Name your lead. Fill in your data protection lead, any data protection officer and your ICO registration number.
  2. Match it to your record of processing. Check the activities and lawful bases in section 3 against your own record.
  3. Describe your own systems. Name your practice software, document storage, client portal and backup routine in section 5.
  4. Delete what doesn't apply. For example, the data protection officer line or the home working rules.
  5. Approve it and train staff. The approval line at the top is for a partner. Train staff on it and review it once a year.

Questions

Does a small business need a data protection policy?

The UK GDPR requires data protection policies where they are proportionate to what you do with personal information. An accountancy practice holds tax, payroll and identity records for every client, so a written policy is the clearest way to show you follow the principles.

What should a data protection policy include?

Who leads on data protection, the principles you follow, what you use information for and on what basis, how you keep it secure, how you choose suppliers, how you handle rights requests, breaches and complaints, and how staff are trained.

What is the difference between a data protection policy and a privacy notice?

The policy is for your own staff: the rules they follow. A privacy notice is for clients and other people: it tells them how you use their information and what their rights are.

Can accountants use AML identity checks for other purposes?

No. The Money Laundering Regulations say personal data collected for anti-money laundering checks can only be used to prevent money laundering, terrorist financing or proliferation financing, unless another law allows it or the person agrees.

Do software providers need a data protection contract?

Yes. Any supplier that handles personal information for you, such as accounting, payroll or cloud storage software, must be covered by a written contract with the terms the UK GDPR sets out, and must be able to show it protects the information properly.

Also in the UK GDPR pack for practices

Record of processing activitiesAppropriate policy documentRetention scheduleData breach procedureData protection logsSubject access request procedureData protection complaints procedureSoftware and supplier checklistStaff privacy notice

See the whole pack →

Who it's for

Accountancy practices that want written data protection rules their whole team can follow.

Last checked

Checked against the UK GDPR, the Data Protection Act 2018 and the Money Laundering Regulations in November 2026.