Outsourcing accounts to India: a UK GDPR checklist

Working with an offshore team can add capacity quickly, but it also means client personal data leaves the UK. Under UK GDPR that is perfectly possible - as long as the right steps are in place. Use this checklist before you start, and take legal advice for your own firm's circumstances.

1. Be clear on roles

In a typical outsourcing arrangement your firm remains the controller of client data and the outsourcing provider acts as your processor. That means you decide what is done with the data, and you need a written contract with the provider that covers the points required by Article 28 of UK GDPR - acting only on your instructions, confidentiality, security, sub-processors, assistance with data subject requests, deletion or return of data and audit rights.

2. Treat it as a restricted transfer

The UK has not made adequacy regulations for India, so sending or giving access to personal data there is a restricted transfer. In practice that usually means putting in place one of the ICO-approved transfer mechanisms - the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses - and carrying out a transfer risk assessment. The ICO's international transfers guidance sets out the steps.

3. Tell your clients

Your privacy notice should say that you use third-party processors, including outside the UK, and how the data is protected. Many firms also cover outsourcing in their engagement letters. Check your professional body's guidance on confidentiality and outsourcing, as some expect clients to be informed.

4. Keep data in your systems where you can

The safest set-up is for the offshore team to work inside your own practice software and your clients' cloud ledgers using individual log-ins, rather than downloading and storing copies. You keep one source of truth, an audit trail of who accessed what, and the ability to remove access in minutes.

5. Ask the right security questions

• Are all staff bound by confidentiality agreements and trained on data protection?
• Is access role-based, with multi-factor authentication and regular password changes?
• Are devices managed and protected, and is local saving of client files restricted?
• How are files transferred, backed up and deleted at the end of the engagement?
• How quickly will they tell you about a suspected breach, and who is the contact?
• Do they use any sub-processors, and where are those based?

6. Record it

Update your record of processing activities, keep copies of the contract, transfer mechanism and risk assessment, and review the arrangement at least once a year or when the scope changes.

How we work

At ZAH every team member is bound by strict confidentiality agreements, access to client data is controlled and we follow documented, GDPR-aligned procedures for handling it. We are happy to work inside your systems so your data stays where you can see it. Read more about why firms choose ZAH or ask us about our data handling.

This article is general information, not legal advice. Check the ICO's current guidance and take advice on your own arrangements.