Accountants & GDPR: the complete compliance guide

What does GDPR cover?

GDPR is the European framework for the protection of personal data, applicable since 25 May 2018 and enforced in France by the CNIL. It rests on several key principles: lawfulness (a legal basis for each processing activity), data minimisation (collecting only what is necessary), limitation of retention periods, security, and accountability (being able to demonstrate compliance).

It distinguishes between the data controller, who determines the purposes and means of processing, and the processor, who acts on the controller's instructions. An accounting firm is the typical example of an actor combining both roles.

Is the 'Chartered Accountants' sector affected?

Every firm is concerned, without any threshold: as soon as it processes personal data — which is the case 100% of the time (payroll, filings, executive records) — the obligations apply. The size of the firm never exempts it; it only modulates the expected level of organisation and whether or not a simplified register must be maintained.

The firm acts as data controller for the management of its own staff, its prospecting, and its invoicing. It acts as a data processor for processing carried out on behalf of its clients: payroll, accounting, and social and tax declarations. This distinction governs the contractual clauses that must be put in place.

Detailed obligations

Sanctions & risks

The GDPR provides for two tiers of fines: up to €10 million or 2% of global annual turnover for organisational infringements (register, security, sub-processing), and up to €20 million or 4% for infringements of core principles and individuals' rights, whichever amount is higher.

Beyond the fine, a leak of financial and social data constitutes a major reputational disaster for a firm whose business is built on trust. Breaches can also lead to public reprimands and injunctions backed by periodic penalty payments.

Common mistakes in the sector

• 1Role confusion. Failing to distinguish between controller and processor, leading to inadequate contractual clauses and an incomplete register.
• 2Missing DPA. Using payroll or hosting software without a compliant data processing agreement.
• 3Unlimited retention. Retaining old customer files indefinitely without a purge policy.
• 4No rights request procedure. Not knowing how to handle an access or erasure request within the one-month deadline.

Practical case

A firm of 15 employees manages payroll for 200 client companies via a SaaS application. A CNIL audit reveals the absence of a DPA with the software vendor, a register limited solely to the controller role, and unlogged access to client files. The firm remedies the situation by signing the DPA, completing the register to reflect its processor role, and activating access logging — three actions that, if taken proactively, would have prevented the formal notice.

Compliance roadmap

1. 1

   Map. Map all processing activities and tools used, including AI components, clearly distinguishing controller and processor roles.

2. 2

   Build the register. Drafting and maintaining the record of processing activities for both roles.

3. 3

   Regularise DPAs. Audit vendor and hosting provider contracts, and sign or update missing or incomplete DPAs.

4. 4

   Formalise security and retention. Write a security policy and a retention policy, and deploy a breach management procedure.

5. 5

   Appoint a DPO and train. Appoint an internal or outsourced DPO, train staff, and schedule an annual review.

Frequently asked questions