Legal

Data Processing Agreement.

Last updated: 12 May 2026

This Data Processing Agreement ("DPA") forms part of the agreement between the Customer (the accountancy practice, "Controller") and FirmBooks ("Processor") and applies whenever FirmBooks processes personal data on behalf of the Controller.

1. Roles

The Controller determines the purposes and means of processing. FirmBooks acts as Processor and processes personal data only on the documented instructions of the Controller.

2. Subject matter & duration

Subject matter: bookkeeping, VAT returns, MTD submissions and year-end accounts services.
Duration: for the term of the services plus the retention period set out in our Privacy Policy.

3. Nature & purpose

Processing of accounting source data to produce deliverables instructed by the Controller.

4. Categories of data subjects & data

Subjects: the Controller's clients, their employees, suppliers and customers.
Data: name, address, contact details, bank/transaction data, payroll data where supplied, and any further personal data within the source documents uploaded.

5. Processor obligations

  • Process personal data only on documented instructions.
  • Ensure persons processing the data are bound by confidentiality.
  • Implement appropriate technical and organisational measures (encryption in transit and at rest, access controls, audit logging).
  • Assist the Controller in responding to data subject requests and security incidents.
  • Notify the Controller without undue delay (and within 72 hours) of becoming aware of a personal data breach.
  • Delete or return personal data at the end of the services, subject to legal retention requirements.

6. Sub-processors

The Controller authorises FirmBooks to engage sub-processors listed in our Privacy Policy. FirmBooks will impose equivalent data protection obligations on each sub-processor and remains liable for their performance.

7. International transfers

All accounting work is delivered by FirmBooks' in-house, UK-based team. Where any personal data is transferred outside the UK/EEA via a sub-processor (e.g. cloud infrastructure), FirmBooks will rely on the UK IDTA and/or EU Standard Contractual Clauses, together with supplementary measures.

8. Audit

FirmBooks will make available to the Controller all information necessary to demonstrate compliance and allow for audits, including inspections, on reasonable notice.

9. Liability & governing law

This DPA is governed by the laws of England and Wales. Liability is as set out in the main services agreement.

For a counter-signed copy of this DPA, email hello@firmbooks.co.uk.