Offshore accountants and UK GDPR: what your firm needs in place

Data protection is the question partners raise first when they consider offshore staff, and rightly so. Client records contain names, addresses, National Insurance numbers, bank details and income. The good news is that the rules are clear and the steps are manageable. Here is what to put in place.

Remote access counts as a transfer

A common misunderstanding is that no transfer happens if the data never leaves your cloud software. The ICO takes a different view. A restricted transfer covers sending personal information to a separate organisation outside the UK, and also making it accessible to one. The ICO’s own guidance uses the example of a UK business allowing an organisation in India to access personal data on its systems.

So if your offshore accountant is employed by a staffing provider overseas, or works as an overseas contractor, and logs in to your Xero or practice management system, you should treat that as a restricted transfer.

Is the country covered by adequacy regulations?

The UK government can decide that a country’s data protection law is adequate. Where it has, information can flow without extra safeguards. Pakistan is not covered by UK adequacy regulations, and neither are India or the Philippines. For all three, you need one of the safeguards set out in UK GDPR. Check the government’s current list before you rely on any country’s status, because it changes.

The safeguard: IDTA or the Addendum

For most practices, the practical safeguard is a contract in a form issued by the ICO:

• The International Data Transfer Agreement (IDTA). A standalone UK agreement between the exporter (your firm) and the importer (the overseas organisation).
• The International Data Transfer Addendum. An add-on to the EU’s standard contractual clauses, useful if you already use those.

If your accountant is employed by a staffing provider, the agreement is normally between your firm and that provider. A good provider will have a draft ready and help you complete it.

The transfer risk assessment

If you rely on a safeguard, the ICO says you must also complete a transfer risk assessment (TRA). In plain terms, you document:

• What data is involved and how sensitive it is.
• Who will access it, from where, and for what purpose.
• Whether the safeguard will work in practice in the destination country.
• What extra steps you are taking to reduce risk.

The ICO publishes a TRA tool you can follow. Keep the completed assessment on file and review it when something changes.

Practical controls that reduce the risk

The paperwork matters, but the day-to-day controls are what protect clients. These are the ones we consider the minimum:

• Named user accounts. One login per person, never shared, so every action is traceable.
• Role-based access. Only the clients and functions the role needs.
• Multi-factor authentication wherever your systems support it.
• No local storage. Work stays inside your cloud software. No downloads to personal devices, no client data in personal email.
• NDAs and confidentiality agreements signed before any client work begins.
• A leaver process. Access removed the same day someone stops working for you.

Update your own documents

Three internal documents usually need a line or two added:

• Your record of processing activities, to show the transfer and the safeguard used.
• Your privacy notice, to tell clients that information may be accessed from outside the UK and how it is protected.
• Your engagement letters, if they restrict where or by whom work is carried out. Check them, and check any contracts where you act as a processor for a client.

It is also sensible to tell your professional indemnity insurer and to check your professional body’s guidance on the use of subcontractors and offshore staff.

Who is responsible for what

Using offshore staff does not move your obligations. Your firm remains the controller for its own client data, or the processor where you act on a client’s instructions. The staffing provider is typically your processor. And the professional work itself stays under your control: offshore staff prepare, and your qualified staff review, sign off and make HMRC submissions.

A pre-start checklist

1. Confirm the destination country’s adequacy status.
2. Sign an IDTA (or Addendum) with the overseas organisation.
3. Complete and file a transfer risk assessment.
4. Create a named account with role-based access and MFA.
5. Confirm the no-local-storage rule in writing.
6. Have the NDA signed.
7. Update your processing record, privacy notice and engagement letters.
8. Notify your insurer.
9. Agree a leaver process.

How DigiHyre helps

Every DigiHyre accountant signs an NDA, uses named accounts with role-based access and works inside the client’s cloud software. Because Pakistan has no UK adequacy decision, we support clients with an IDTA and transfer risk assessment. We do not hold ISO 27001 or SOC 2 certification, and we say so. The full picture is on our Security & Compliance page.

For how this works with us in practice, read our security and UK GDPR controls, see how a Dedicated accountant works inside your systems, and check what an offshore accountant prepares for your review.