Accounting firms under the GDPR: processor or controller

A firm that keeps the books and runs payroll for other companies sees a lot of personal data: employees’ personal codes, salaries, bank accounts, sick-leave days, the names of buyers and suppliers on invoices. For the General Data Protection Regulation (GDPR), what matters is not how much data the firm sees, but who determines the purposes and means of processing it. Whoever determines them is the controller (Article 4(7) GDPR). Whoever processes data on the controller’s behalf is the processor (Article 4(8) GDPR).

An accounting firm can be both at once, for different purposes. It keeps the client’s accounts on the client’s behalf. But some duties are imposed on it by law, and it performs those in its own name. Below: what the GDPR, the Lithuanian Law on Financial Accounting (FAĮ) and the Lithuanian Law on the Prevention of Money Laundering and Terrorist Financing (PPTFPĮ) say, and what is at stake when the roles are confused.

The client’s accounts: the accounting firm is a processor

The FAĮ gives the organisation of accounting to the client’s manager. The manager selects the person who keeps the accounts, unless a law gives that right to another management body (Article 13(1)(1) FAĮ), and sets the procedure for recording and valuing business transactions (Article 13(1)(3) FAĮ). Where the accounts are kept under a contract by an accounting service provider, the provider may perform some of the manager’s tasks if the contract says so (Article 13(3) FAĮ).

In our assessment, it follows that the accounting firm processes the data of the client’s employees, buyers and suppliers on the client’s behalf, and so as a processor (Article 4(8) GDPR). The client remains the controller, because its manager is required to organise the accounting (Article 13(1) FAĮ) and the accounts are kept for the client’s purpose. Even where, under the contract, the accounting firm performs some of the manager’s tasks (Article 13(3) FAĮ), in our assessment it does so on the client’s behalf (Article 4(7) and (8) GDPR).

Four duties follow:

• A written contract. Processing by a processor is governed by a contract that sets out the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects and the obligations and rights of the controller (Article 28(3) GDPR). It must be in writing, including in electronic form (Article 28(9) GDPR). What the contract must contain is covered in Data processing agreement: when it is required.
• Only on instructions. The processor processes data only on the controller’s documented instructions, unless the law to which the processor is subject requires otherwise (Article 28(3)(a) and Article 29 GDPR).
• Sub-processors. A cloud accounting application or a data centre also processes the client’s data. The accounting firm may engage another processor only with the client’s prior specific or general written authorisation. Under a general authorisation, it must tell the client in advance of any intended addition or replacement of a sub-processor so that the client can object (Article 28(2) GDPR). The same data protection obligations are imposed on the sub-processor, and if it fails to meet them, the accounting firm remains fully liable to the client (Article 28(4) GDPR).
• Security. The security duty applies to the processor directly: it implements technical and organisational measures appropriate to the risk (Article 32(1) GDPR). The client’s internal control measures are set by its manager (Article 13(1)(4) FAĮ); they must also protect access to accounting information systems and registers (Article 2(21) FAĮ). An accounting service provider must set its own procedure for organising and controlling its services, and follow it (Article 14(4) FAĮ). What Article 32 requires is covered in GDPR security measures.

Where the accounting firm is a controller

Money laundering prevention. The PPTFPĮ classes legal persons providing financial accounting or tax advisory services, and persons providing these services independently, as other obliged entities (Article 2(10)(3) PPTFPĮ). They must identify and verify the identity of the client and the beneficial owner before entering into a business relationship (Article 9(1)(1) PPTFPĮ). Copies of the client’s identity documents and other data obtained when identifying the client are kept for eight years from the end of the transactions or business relationship with the client (Article 19(11) PPTFPĮ). On a reasoned instruction of a competent authority the period may be extended by up to two years (Article 19(16) PPTFPĮ). This data is processed in accordance with the GDPR (Article 24(1)(2) and Article 24(2) PPTFPĮ).

In our assessment, for this purpose the accounting firm is a controller. The duty is imposed on it by law, not by the client, so the legal basis is a legal obligation to which the firm itself is subject (Article 6(1)(c) GDPR). The firm itself, not the client, is then responsible for this processing complying with the GDPR principles, and must be able to demonstrate it (Article 5(2) GDPR).

Its own purposes. If a processor infringes the GDPR by determining the purposes and means of processing itself, it is considered a controller in respect of that processing (Article 28(10) GDPR). For example, if the accounting firm uses the contact details of the client’s employees for its own marketing, it answers for that processing as a controller.

In the future. Regulation (EU) 2024/1624 will apply from 10 July 2027 (Article 90 of Regulation (EU) 2024/1624). It lists external accountants, acting in the exercise of their professional activities, among obliged entities (Article 3, point (3)(a), of Regulation (EU) 2024/1624). This is future law. The edition of the PPTFPĮ in force from 1 January 2027 does not change the provisions discussed here.

Payroll and special categories of data

The GDPR prohibits processing data revealing trade union membership and data concerning health, unless an exception applies (Article 9(1) GDPR). Data concerning health is data related to physical or mental health that reveals information about a person’s health status (Article 4(15) GDPR). In our assessment, a period of sick leave provided for payroll reveals such information (Article 4(15) and recital 35 GDPR), and deductions for a trade union reveal membership of it (Article 9(1) GDPR).

One exception is processing necessary in the field of employment and social security law, but only in so far as Union or Member State law authorises it (Article 9(2)(b) GDPR). In our assessment, the client, as controller, relies on the exception, not the accounting firm, because the firm processes the data on the client’s behalf (Article 4(7) and (8) GDPR). When processing such data, the accounting firm must choose measures appropriate to its risk (Article 32(1) GDPR).

What can go wrong

A leak. A processor that becomes aware of a personal data breach notifies the controller without undue delay (Article 33(2) GDPR). The controller notifies the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless it is unlikely to result in a risk to people’s rights and freedoms (Article 33(1) GDPR). In Lithuania this is the State Data Protection Inspectorate (Article 7(1) of the Lithuanian Law on the Legal Protection of Personal Data (ADTAĮ)).

Damage. A person who has suffered material or non-material damage has the right to compensation from the controller or the processor (Article 82(1) GDPR). A processor is liable only where it has not complied with obligations specifically directed to processors, or has acted outside or contrary to the controller’s lawful instructions (Article 82(2) GDPR). Where both a controller and a processor are involved in the same processing and both are responsible, each is held liable for the entire damage (Article 82(4) GDPR). One that has paid full compensation may claim back from the other the part corresponding to the other’s share of responsibility (Article 82(5) GDPR).

Fines. For infringing the obligations of the controller and the processor under Articles 25 to 39, including Articles 28, 32 and 33, the fine can reach ten million euros or, for an undertaking, two per cent of its total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a) GDPR). For infringements of the PPTFPĮ, other obliged entities can be fined from half a per cent to five per cent of the annual income received from accounting or tax advisory activity (Article 40(1)(1) PPTFPĮ). If the firm infringes the law systematically, commits a single serious infringement, or infringes it again within one year of a sanction, the fine can reach up to twice the benefit gained from the infringement, where that benefit can be determined and twice its amount exceeds one million one hundred thousand euros; otherwise the fine is from two thousand to one million one hundred thousand euros (Article 40(1)(2) PPTFPĮ). In such cases a fine may also be imposed on a shareholder or a member of the management body of the firm (Article 40(2) PPTFPĮ).

A terminated contract. The data processing agreement must provide that, when the services end, the processor, at the client’s choice, deletes or returns all personal data and deletes existing copies, unless Union or Member State law requires storage (Article 28(3)(g) GDPR). The FAĮ requires that, when the person keeping the accounts changes, the accounting documents and registers are handed over in time to the client’s manager or a person the manager names (Article 14(1)(2) FAĮ). So after the contract ends, the accounting firm may keep copies of the client’s data only in so far as a law requires it, for example the client identification data and contract documents under the PPTFPĮ (Article 19(11) PPTFPĮ).

When to call a lawyer

• when there is no written data processing agreement with clients, or it does not cover sub-processors;
• when you change the accounting software or cloud provider that sees clients’ data;
• when data has leaked and you must decide what to tell clients, and when;
• when a client terminates the contract and you must separate what to return, what to delete and what to keep under the PPTFPĮ;
• when you want to use clients’ data for your own purposes, for example marketing or analysis.