X
Facebook
LinkedIn
WhatsApp
Mail
Copy linkData security and confidentiality in accountancy outsourcing
Updated 13th November 2026 | 11 min read Published 13th November 2026
When an accountancy practice outsources some work, the first thing that crosses the partner’s mind is often: “What happens to client data, and am I still responsible for it?”
To answer both parts of that question, this blog looks at your data security and responsibilities when outsourcing. That way you can put vendors through their paces and make the right decisions.
How IRIS helps
If you want your security questions answered before you even ask them, IRIS Outsourcing is the solution for you. Delivered by over 600+ qualified accountancy and payroll professionals with more than 20 years of UK accountancy experience, the service holds ISO 27001, ISO 27701 and ISO 9001 certifications, adheres fully to UK GDPR, and runs a paperless policy on secure, cloud-based systems. Your data is exchanged through a secure shared portal rather than email, and can stay hosted in the UK even though delivery is based in Chennai. The service is confidential and software-agnostic, working with your existing systems including CCH, TaxCalc, Digita, Xero and QuickBooks, FreeAgent, IRIS Elements and IRIS Accountancy Suite, so you add capacity without handing over control of your clients’ data.
Key takeaways on outsourcing, data security, and confidentiality from this blog
- Under UK GDPR, your firm is the data controller and your outsourcing provider is the data processor, regardless of where the work is performed.
- If a data breach occurs, your firm carries primary accountability to clients and to the Information Commissioner’s Office (ICO) as the controller.
- Where the work is delivered and where your client data is actually stored are two separate questions, and work can be performed offshore while data remains hosted in the UK.
- Before signing any outsourcing agreement, verify that the provider holds a written Article 28 data processing agreement, ISO 27001 and ISO 27701 certifications, role-based access controls, and a defined breach notification SLA.
Who is the data controller when you outsource?
Under UK GDPR, your accountancy practice is the data controller and your outsourcing provider is the data processor. The controller decides why and how client data is processed and keeps legal accountability; the processor may only act on the controller’s documented instructions.
- Accountability stays with you. You decide what data is shared, for what purpose, and for how long, and responsibility for lawful processing never transfers to the provider.
- The provider is bound to your instructions. A processor cannot repurpose your clients’ data, involve another party, or change how it handles the information without your authority.
- You are the one your clients and the regulator will look to. If something goes wrong, the ICO holds the controller accountable first, which is why the contract and controls below are not a formality.
Outsourcing data security checklist: what to verify before you sign an agreement
Use this as a scannable pre-signing checklist. Every item below is something a serious provider should be able to evidence without hesitation.
| Control | What to confirm before signing |
| Data processing agreement (DPA) | A written contract that meets Article 28 of UK GDPR, setting out roles, responsibilities, the scope and purpose of processing, and each party’s obligations. |
| Data residency | Confirmation of the country your client data is stored and processed in, and whether UK-hosted options are available. |
| Encryption standard | Data encrypted both in transit and at rest, with transfer through a secure portal rather than email. |
| Access and authentication | Role-based access controls and multi-factor authentication, so only named individuals can reach your data. |
| Staff vetting and training | Background checks on staff who handle your data and ongoing data-protection and security training. |
| Sub-processor disclosure | A current list of any sub-processors, with a commitment to notify you before adding or changing one. |
| Audit rights | A contractual right to monitor, request evidence, and audit the provider’s controls during the engagement. |
| Breach notification SLA | A defined timeframe within which the provider must notify you of any suspected or confirmed breach, so you can meet your own reporting duties. |
| Data return and deletion on exit | A documented process for returning your data and securely deleting it, including from backups, when the engagement ends. |
Is my accounts data safe if it is processed offshore?
Much accountancy outsourcing is delivered offshore. IRIS Outsourcing, for example, operates from a dedicated Centre of Excellence in Chennai, India, and where the work is done and where the data sits are two separate questions.
Skilled professionals can deliver work from an offshore centre while client data remains hosted in UK infrastructure, accessed through a controlled, secure environment. IRIS Outsourcing supports this through UK data hosting: existing IRIS hosting customers who also take IRIS Outsourcing can be issued free virtual desktop licences, so data stays on UK shores without paying separately for additional hosting licences. IRIS Outsourcing also operates a paperless policy using secure, cloud-based systems and holds the highest data-security accreditations, including full UK GDPR adherence.
Remember: If you’re working with a vendor where a transfer of personal data to a country not covered by UK adequacy regulations is involved, firms should confirm the provider supports the ICO’s International Data Transfer Agreement (IDTA) and carry out a Transfer Risk Assessment (TRA).
Confidentiality beyond GDPR: NDAs, data segregation and staff controls
GDPR compliance is the baseline, not the finish line. Client confidentiality in an accountancy practice depends on operational controls that go beyond data-protection law.
- Non-disclosure agreements. A confidentiality agreement covering the provider and its staff protects commercially sensitive information that is not personal data and reinforces the duty of confidence your clients expect.
- Segregation of duties and data. Your clients’ information should be logically separated from that of the provider’s other customers, with access restricted to the team assigned to your work.
- Staff controls and stability. Vetting is the start, but retention matters too: long-serving, well-treated teams are a strong indicator of a stable, professional operation.
- A single, accountable point of contact. For example, IRIS Outsourcing provides a confidential service, works to your brand and service levels where you want white-labelled delivery, and never contacts your clients directly unless you ask it to.
A dedicated relationship manager keeps coordination tight and gives you a named person accountable for how your work and your data are handled.
How do you run due diligence on an outsourcing provider’s data security?
Turn the checklist above into a short, repeatable process. Five steps are enough to separate a credible provider from a risky one.
- Confirm the accreditations. Ask for current certificates for ISO 27001 (information security management), ISO 27701 (privacy information management), and ISO 9001 (quality management), not lapsed ones.
- Review the contract against Article 28. Check that the DPA covers roles, breach notification, sub-processors, audit rights, and data return and deletion, using the ICO’s controller-processor checklist as your measure.
- Test the data flow. Establish exactly how data will move, where it will be hosted, how it is encrypted, and insist on a secure shared portal for upload and receipt rather than email; a strong provider onboards through a secure shared portal and structured process, for example IRIS Outsourcing uses a secure shared portal and Job Checklist as part of a 4-step implementation.
- Assess the supply chain. Following NCSC supply-chain security principles, ask for evidence of vulnerability scanning, incident-response arrangements, and a full list of sub-processors.
- Start small, then scale. Trial the provider on lower-risk work before committing sensitive or high-volume tasks; a short pilot tells you more about security discipline than any questionnaire.
Keep an evidence trail throughout: ICAEW guidance is clear that members remain professionally responsible for client data regardless of delivery model, so document your lawful basis for processing and complete a Data Protection Impact Assessment where needed. Retain the records that demonstrate you carried out due diligence before and during the engagement.
How IRIS Outsourcing keeps your data secure
IRIS Outsourcing is built around the controls that matter most to UK accountancy firms.
- ISO 9001:2015 Quality Management System
- ISO 27001:2019 Information Security Management System
- ISO 27701:2019 Privacy Information Management System
- Full UK GDPR adherence
- Paperless policy using secure, cloud-based systems
- A secure shared portal for data exchange, set up through a 4-step implementation process
- Software-agnostic delivery that works with your existing systems, including CCH, TaxCalc, Digita, Xero, QuickBooks, FreeAgent, IRIS Elements, and IRIS Accountancy Suite.
- A confidential service delivered by over 600+ qualified professionals with more than 20 years of UK accountancy experience
If you remember one thing about accountancy outsourcing, remember this…
Outsourcing does not transfer responsibility for your clients’ data, and a good provider never pretends it does. It gives you the controlled environment that lets you meet your obligations with confidence, so you can add capacity without adding risk.
IRIS Outsourcing is delivered by over 600+ qualified accountancy and payroll professionals, operates to recognised data-security accreditations and UK GDPR standards, and supports UK data hosting so client information stays on UK shores. Talk to an IRIS Outsourcing expert about your requirements.
Frequently asked questions
-
Yes, it can be. Outsourced accounts fully complies with UK GDPR when your firm stays the data controller and the provider acts as processor under a written Article 28 data processing agreement covering roles, breach notification, and data return on exit. Also confirm the provider holds recognised certifications such as ISO 27001, ISO 27701 and ISO 9001, and that any international transfer is covered by a mechanism such as the ICO’s International Data Transfer Agreement.
-
Where the work is delivered and where your data is stored are two separate questions, and data can remain hosted in UK infrastructure even when the delivery team is offshore. Confirm the specific country of data storage, that encryption is applied in transit and at rest, and that all transfer happens through a secure portal rather than email.
-
Your data processing agreement should set out data return and secure deletion before you sign. Under a properly structured Article 28 agreement, the provider must return your data in a usable format and then securely delete it from all systems, including backups, within a defined timeframe.
-
As the data controller, your firm carries primary accountability to clients and to the ICO, so the processor contract, breach notification SLA, and security controls exist to help you respond quickly. Under UK GDPR a breach that risks individuals’ rights must be reported to the ICO within 72 hours, so a good contract commits the provider to notifying you within a defined window.
