GDPR considerations for tax advisors

When this article is for you

You're a tax advisor and want to understand the GDPR framing of the three-way relationship (client + TaxItEasy + you). Specifically: who is responsible for what, where does YOUR DPA come from, what happens if there's a breach involving your access, and how to handle subject-rights requests cleanly.

This article is a practical primer, not a substitute for legal advice from your jurisdiction's professional body. For client-side GDPR rights, see your GDPR rights as a user. For TaxItEasy's overall data residency and processor stance, see where is my data stored and our sub-processors. For the exact boundary of your access, see what your tax advisor can and cannot do.

The role triangle

Three parties and their roles under GDPR:

• Your client: the controller. They decide what personal data is collected and why. Every invoice in their TaxItEasy account is their data (about their suppliers, their customers, their team members where applicable, their own business). The controller's responsibilities are the central ones: legal basis for processing, transparency, response to subject-rights requests, breach notification to supervisory authorities.
• TaxItEasy: the processor. We process the data on the controller's behalf, strictly under their instructions, under our signed DPA with them. We do not decide what's collected or for what purpose; we provide the platform.
• You, the tax advisor: in most cases a controller in your own right. You decide how you process the client's data in your professional work, within your professional duties, rather than following the client's instructions. For tax advisors in Germany this is the law (§ 11(2) StBerG); elsewhere, your engagement and your professional rules decide, so check with your professional body. Your access to the client's data rests on the engagement contract between you and the client (typically a Mandatsvertrag in DACH, a contrat d'engagement in France, a lettera d'incarico in Italy, etc.). TaxItEasy provides the technical access but doesn't establish the legal basis between you and the client.

In simpler language: your client owns their data, TaxItEasy stores + processes it under contract with the client, and you access it as the client's external accountant under contract with them. Three contracts, three roles, three responsibilities.

What this means in practice

A few concrete implications:

• Your DPA with TaxItEasy comes with our Terms. When you process client data in TaxItEasy, our Terms (section 7.5) treat you as the controller and TaxItEasy as your processor, under our DPA, which the Terms incorporate. If your professional rules ask for more, such as a confidentiality commitment in text form from service providers (§ 62a StBerG in Germany), write to [email protected] to go through your DPA and these duties with us.
• Your engagement contract with the client matters most. It governs what you do with their data: keep, store, copy, share with whom, for how long, for what purposes, and what happens at engagement end.
• A breach in your own processing is yours to assess and report. If your laptop is stolen with bulk-exports on it, or a colleague at your firm leaks something, check your own notification duty as a controller (Article 33: your supervisory authority within 72 hours if the breach meets the threshold) and notify the client, who assesses theirs.
• Subject-rights requests about the client's account go to the client. When a data subject (e.g. one of the client's customers whose name appears on an invoice) asks for access or erasure (Articles 15–21) of the data in the client's TaxItEasy account, they ask the client, and the client routes the request to TaxItEasy's [email protected]. For the processing you do as a controller in your own right (your working papers, exports you keep), a request can come to you, and you answer it under your own duties.

What TaxItEasy enforces on the platform side

Independent of the contracts, the platform enforces guarantees you can cite to a client or a supervisory authority:

• Every advisor action is audit-logged. Approvals, flags, edits, categorisations, exports. Each write lands in an append-only audit log with your identity and role, and shows up in the client's activity feed. Comments cannot be edited or deleted afterwards.
• Access is encrypted per client and revocable. Your access to a client's documents runs through per-document decryption keys issued to you. When the client revokes access, those keys are deleted immediately. Revocation is technical, not just a UI switch.
• Cross-client isolation is hard. You only reach data of clients who invited you; a request touching another company is refused outright, including in search.
• Learning is per company. What the system learns from one company's decisions is used only for that company. The learned data is deleted when the client's company is deleted, and the matching and category memory also when the client, as the company's only owner, deletes their account. See how matching learns from you.

What data minimisation means for your work

GDPR's data-minimisation principle (Article 5(1)(c)) applies to your work. TaxItEasy's advisor scope already limits you: no billing details, no team management, no deletes, hard per-client isolation (see what your tax advisor can and cannot do).

On top of that, you apply minimisation in your own work:

• Don't keep client data in your own systems beyond what your engagement requires. Export for active period work, delete from your local storage when the period is closed and your retention obligations are met. Bulk-export ZIPs sitting in your Downloads folder for 2 years are a liability.
• Don't share client data with other advisors at your firm without authorisation from the client. Internal sharing for staff training (e.g. anonymous case study) is fine if the data is anonymised. Sharing identifiable data sideways needs the client's nod.
• Don't use client data for purposes outside the engagement. No benchmarking ("compare your tax burden to other clients in your sector"), no aggregated analytics unless contractually agreed, no marketing-list-building from invoice contact data.
• Take only what you need. If you only need Q1 data for a Q1 filing, don't export 5 years of history "just in case."

Retention when an engagement ends

When a client revokes your access (or you part ways amicably):

• Immediately: your TaxItEasy view of their data stops. Your per-document decryption keys for that client are deleted on revoke; they no longer appear in your client list.
• Any local copies you have are still in your possession: export ZIPs, screenshots, your own notes, downloaded original PDFs. Your engagement contract should specify retention.
• Statutory retention is jurisdiction-specific. For German Steuerberater, the BoSO retention rules typically apply (~6 years for general records, 10 years for tax-relevant ones; specific deadlines depend on the type of document). For French comptables, the relevant rules are in the CGI; for Italian commercialisti, the obblighi di conservazione; etc. Consult your jurisdiction's professional body for the exact obligations.
• A clean handover to the next advisor should include: any local exports you made (with the client's permission), your notes that have ongoing relevance, and a written summary of open questions and review conventions (so the new advisor can pick up cleanly).

After your retention period expires, you delete your local copies. This is your responsibility, not TaxItEasy's; we have no visibility into your local file system.

Cross-border clients (within and outside the EU)

Most TaxItEasy clients are EU-based, with EU-based tax advisors. A few less-common scenarios:

• Client in one EU country, you in another EU country: Same GDPR (it's an EU regulation, not national law). The client's role and ours stay the same; your own role follows the professional rules where you practise (for tax advisors in Germany, § 11(2) StBerG).
• Client in EU, you outside the EU (UK / CH / US): Your country's data-protection law applies to your local processing. UK GDPR (post-Brexit), Swiss DPA, US state-level laws if applicable. For data transfers from the EU to you, the engagement contract typically includes SCCs or equivalent. Your firm's compliance officer can advise on the specific clauses needed.
• Client outside EU, you in EU: Your client is the controller under their local law, and as a tax advisor established in the EU you have your own obligations under GDPR for the processing you do. Talk to your professional body.
• Both you and client outside the EU: GDPR may still apply if your client's data subjects include EU residents. For instance, if your US-based client invoices EU customers, those EU customers' personal data on the invoices brings GDPR into scope. Consult a privacy lawyer if this applies.

Breach scenarios

A few realistic breach scenarios specific to the advisor role:

Your firm laptop is stolen

If the laptop has bulk-export ZIPs of client data on it, that's a personal-data-breach event under Article 32. Steps:

1. Within 24 hours: assess what was on the laptop. If full-disk encryption was active + the device was off (or encryption-at-rest is real), the breach risk is low. If not, treat as full exposure.
2. Notify the client immediately (within hours, not days), and assess your own notification duty as a controller. The client decides whether to notify their supervisory authority + affected data subjects.
3. Internally: rotate any credentials that were on the laptop (TaxItEasy login, password manager). Revoke active sessions from your Settings → Security → Active sessions → Revoke all. You can do this from any device with the password.

Bulk-export sent to wrong recipient

You meant to email the export to a junior colleague at your firm, but auto-complete sent it to a client of a different firm. Personal-data-breach event. Notify your client, ask the unintended recipient to delete (in writing), assess your own notification duty, and document everything for any supervisory-authority notification.

Colleague accesses a client they shouldn't

Each tax advisor needs their own invite from the client. If a colleague accessed a client outside the scope of their work via your login, that's both a breach (unauthorised processing) AND a firm-internal access-control failure. Notify the client; investigate internally; consider whether the colleague's TaxItEasy access needs to be revoked.

TaxItEasy-side breach

If a security incident at TaxItEasy affects one of your clients, we notify the client, as the controller of the data in their account, with the details (what data was exposed, when, mitigation steps). If it also touches the processing you do as a controller, check your own notification duties. In practice the client often asks you to handle the operational follow-up.

Tax-authority requests

A specific kind of "third party asks for data" event for advisors:

• Tax authority asks YOU for client data: standard work. Your engagement contract + your jurisdiction's professional duty rules apply. TaxItEasy's role doesn't change anything; you're the one being asked, not us. Provide what's lawfully required, no more.
• Tax authority asks TaxItEasy for client data: rare, but possible. Our DPA with the client says we comply with lawfully-binding orders. We notify the client (the controller) where legally permissible before responding. The order would route through our DPO at [email protected].

Edge cases

"Client asks me for a copy of their TaxItEasy data." Two ways: they self-export from their Settings → Details → Data Export, or you generate a bulk export for them. Either satisfies their Article 20 (portability) right. The self-export is faster and doesn't involve you.

"Share an invoice with a lawyer or auditor?" Get written authorisation from the client first. The sharing happens off-platform. Download the document and send it via your normal secure channels (encrypted email, secure file-share). TaxItEasy doesn't have a built-in "share with third party" for the advisor role; not adding it is intentional (forces the explicit-authorisation step).

"Client has died or company has dissolved. What about their data?" Talk to the estate / liquidator. The TaxItEasy account is theirs (or their estate's) to close. We respond to dissolution-of-business requests via [email protected] with appropriate verification (death certificate / dissolution paperwork / probate authority). Your role: provide whatever the engagement-contract retention rules require, then close your local copies per your retention schedule.

"Tax authority subpoenas me for client data?" Same as any client-related authority request. Your engagement contract + your jurisdiction's professional duty rules apply. Inform the client where legally permitted (some subpoenas come with gag orders; some don't). TaxItEasy's role doesn't change anything. You're the one being asked.

"I want a copy of TaxItEasy's DPA." Available on request to [email protected] or via /dpa.html. Our Terms (section 7.5) apply it to you too when you process client data in TaxItEasy.

"Several advisors on one client, one invite each?" Yes. One invite per advisor per client. The audit log attributes actions to individual advisors; sharing one login conflates attribution and creates compliance ambiguity ("who actually approved this invoice?").

"What happens if access is revoked mid-flag?" Your access ends; the flag stays in the audit log. The next-assigned advisor (or the client themselves) sees the flag and decides how to proceed. Your contribution is preserved as historical record.

"Anonymised aggregate data for staff training, is that OK?" Generally OK if true anonymisation (not pseudonymisation). Test: would a reasonable person be able to re-identify the client or their suppliers from the data? If no, you're fine. If yes (e.g. small market, recognisable vendor name), you need pseudonymisation + client consent.

"Cross-firm referral with another advisor, can I share data?" Get explicit client consent. The other advisor needs their own invite from the client; you don't proxy the data to them.

Related

• What your tax advisor can and cannot do (the data-access boundary)
• Our sub-processors at a glance (TaxItEasy's processor chain)
• Where is my data stored? (EU residency + encryption context)
• Your GDPR rights as a user (the controller-side view of the same triangle)
• How matching learns from you (per-company learning + erasure behaviour)