Handing your bank feeds, payroll data, and revenue correspondence to a team you’ve never met in person feels risky, and most of what’s written about it doesn’t help much. The usual advice is \u201cmake sure they’re GDPR compliant”, as if that’s a box a provider ticks rather than a legal relationship with specific obligations attached. If you’re an Irish SME director, sole trader or in-house bookkeeper weighing up an outsourced provider, here’s what actually matters: who’s legally responsible for your data, what Irish law requires alongside GDPR, and the concrete questions to ask before you sign anything.
<\/p>\n\n\n\n
Under GDPR, a \u201ccontroller\u201d is whoever decides why and how personal data is processed. A \u201cprocessor\u201d carries out that processing on the controller’s instructions. In almost every outsourced bookkeeping, payroll or accounts arrangement, your business \u2014 or your accountant, if they’re the one instructing the outsourcing partner \u2014 is the controller. The outsourcing provider is the processor.<\/p>\n\n\n\n
This isn’t a technicality. It means legal responsibility for how the data is protected doesn’t transfer to the provider just because they’re the ones physically handling it. Engaging a processor requires a written contract \u2014 usually called a ‘data processing agreement’ (DPA)<\/a> \u2014 setting out things like what the processor is allowed to do with the data and for how long; a confidentiality commitment covering everyone with access to it; whether the processor can bring in sub-processors (and a requirement to disclose that); how quickly the processor has to notify you if something goes wrong; and what happens to the data when the engagement ends \u2014 deletion or return, on your instruction.<\/p>\n\n\n\n If a provider can’t produce a data processing agreement or treats the request for one as unusual, that’s worth pausing on. You can’t outsource the underlying accountability for the data \u2014 only its day-to-day handling. This is the point every \u201cwe’re GDPR compliant\u201d badge on a website skips over.<\/p>\n\n\n\n A quick way to see why this distinction matters: say an outsourced bookkeeping team accidentally emails your payroll file to the wrong client. Under GDPR, it’s still your business \u2014 the controller \u2014 that’s ultimately accountable to the affected employees and, if it’s serious enough, to the DPC. That’s exactly why the data processing agreement matters so much: it’s what obliges the processor to tell you quickly, cooperate with any investigation, and take responsibility for its own part in what went wrong, rather than leaving you to find out some other way.<\/p>\n\n\n\n \u201cGDPR compliant\u201d isn’t a certification anyone hands out \u2014 the regulation names one specific enforcing body. In Ireland, that’s the Data Protection Commission (DPC). It’s worth knowing this because the DPC is who you’d approach, or who would investigate, if something went wrong with how your data was handled \u2014 not some abstract \u201cGDPR authority”.<\/p>\n\n\n\n But GDPR isn’t the only law shaping how an outsourced accounting provider<\/a> should handle your records, and this is where the Irish-specific detail actually matters.<\/p>\n\n\n\n Accountants and bookkeepers in Ireland are \u201cdesignated persons\u201d under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010. When your provider carries out customer due diligence on your business \u2014 verifying who you are and who owns and controls the company \u2014 they’re required to keep records evidencing that process, along with records of the services and transactions carried out for you, for five years. That’s a separate legal clock from anything GDPR sets, tied specifically to the AML obligations that apply to anyone providing accountancy services in Ireland.<\/p>\n\n\n\n This is easy to miss because it doesn’t appear in most GDPR checklists at all \u2014 it’s a distinct obligation that sits alongside data protection law, not a subset of it. In practice, it means your provider should be able to tell you, plainly, how they store the identity and beneficial-ownership documents they collected when they onboarded you and for how long they’ll hold onto them after the engagement ends. A provider who’s never had to think about this hasn’t fully reckoned with what \u201cdesignated person\u201d status actually requires.<\/p>\n\n\n\n Separately, your own accounting records \u2014 the ones your outsourced provider is compiling, filing or storing on your behalf \u2014 need to be kept for six years after the end of the financial year they relate to, under Section 285 of the Companies Act 2014<\/a>. Failing to keep adequate accounting records is a criminal offence, and directors can be held personally liable in some circumstances, so this isn’t a minor administrative point. It’s worth asking your provider directly how and where these six-year records are stored, not just how long they’re kept.<\/p>\n\n\n\n If your outsourced provider is filing your CT1 corporation tax return or your Form 11 self-assessment<\/a>, they need to be linked to you as your registered agent on Revenue’s systems. Revenue changed how this works in 2025: instead of a paper authorisation form, agent-linking now runs through an e-linking process, where the agent submits the link request through ROS, and you approve it separately through ROS or myAccount within 30 days. It’s a small operational detail, but it means you keep direct, visible control over who’s authorised to file on your behalf with Revenue \u2014 and it’s worth confirming that any provider you’re evaluating is using this current process rather than an outdated paper form.<\/p>\n\n\n\n Many outsourced accounting providers <\/a>deliver at least some of their work from outside Ireland and the EEA. That’s not automatically a problem, but it does trigger specific requirements under GDPR’s rules on international transfers, and it’s worth being direct about rather than skating past.<\/p>\n\n\n\n Where personal data is transferred outside the EEA to a country that doesn’t have an adequacy decision from the European Commission, the transfer needs a safeguard \u2014 most commonly, Standard Contractual Clauses (SCCs)<\/a> built into the contract between you (or your accountant) and the provider. A properly run provider should also be able to speak to a transfer impact assessment: essentially, whether the destination country’s laws could undermine the protections the SCCs are meant to provide.<\/p>\n\n\n\n This isn’t a purely theoretical requirement \u2014 European courts have taken a much closer look at international data transfers in recent years, and regulators, including the DPC, have shown they’re willing to act where safeguards are missing or inadequate. None of that means outsourcing outside the EEA is off the table; it means the safeguard must actually exist and be something a provider can point to, rather than being assumed to be fine because \u201ceveryone does it this way”.<\/p>\n\n\n\n You don’t need to become a GDPR transfer specialist to evaluate this. Three questions do most of the work in a call with a prospective provider:<\/p>\n\n\n\n A provider that answers these plainly, rather than deflecting to a general compliance statement, is telling you something useful about how seriously they take the rest of this.<\/p>\n\n\n\n Most of what’s written about data breaches focuses on prevention. Worth spending a moment on what actually happens if something does go wrong, because it’s where the controller\/processor split covered earlier stops being theoretical and starts having a clock attached to it.<\/p>\n\n\n\n Under GDPR, if your business is the controller, you \u2014 not your outsourced provider \u2014 are the one legally required to notify the Data Protection Commission, and you have to do it within 72 hours of becoming aware of the breach, where feasible. That 72-hour clock starts the moment there’s reasonable certainty a breach has occurred, not once an investigation is finished. If the breach is likely to pose a high risk to the people whose data was involved \u2014 employees on a payroll file, for instance \u2014 you may also need to notify them directly, without undue delay.<\/p>\n\n\n\n This is exactly why the processor’s breach notification obligation matters so much in the outsourcing context. Under GDPR, a processor is required to notify the controller without undue delay once it becomes aware of a breach \u2014 and your data processing agreement should say specifically how quickly that has to happen and what information it needs to include, rather than leaving “without undue delay” undefined. If your outsourced provider only tells you about an incident once they’ve completed their own internal review, you could already be behind on a deadline you didn’t know was running. The practical ask, then, isn’t “Do you have a security policy?” \u2014 it’s “How many hours after you notice something do we hear about it, and in what format?”<\/p>\n\n\n\n It’s also worth knowing that not every incident needs to be reported to the DPC\u2014a low-risk incident, like a password reset triggered by a suspicious login with no actual data accessed, generally doesn’t. But every incident, reportable or not, needs to be logged in a breach register, recording what happened, its effects, and what was done about it. Ask your provider whether they maintain this kind of record even for incidents they judge don’t meet the reporting threshold \u2014 it’s a good indicator of whether breach handling is a genuine internal process or something improvised only when it’s unavoidable.<\/p>\n\n\n\n None of the above works without decent technical hygiene sitting underneath it, so it’s worth naming briefly: data encrypted both in transit and at rest, access limited to the specific people actually working on your file rather than the whole organisation, multi-factor authentication on any client portal or shared drive, and an audit trail showing who accessed what and when. These are table stakes at this point\u2014any provider handling financial data should already have them without being asked, and most competent providers will happily describe them in some detail.<\/p>\n\n\n\n The real differentiator isn’t whether a provider has encryption; it’s whether they can also show you the legal and regulatory pieces covered above \u2014 the data processing agreement, the AML and Companies Act retention practices, and, if relevant, the cross-border safeguard. A provider that leads with certifications and struggles with the rest hasn’t necessarily done anything wrong, but it’s a sign the conversation needs to go further before you sign.<\/p>\n\n\n\n Everything covered above translates into a short, practical list. You don’t need to memorise the legislation behind each point\u2014you just need a straight answer to each question below before you sign anything:<\/p>\n\n\n\n At Aone, this plays out across bookkeeping, corporation tax (CT1)<\/a> filing, self-assessment (Form 11), and year-end accounts finalisation<\/a> for Irish clients. In practice, the client \u2013 or their accountant \u2013 remains the data controller, and Aone operates as the processor under a written data processing agreement. Access to a client’s records is limited to the specific team working on that file, not the wider organisation. <\/p>\n\n\n\n Where CT1 or Form 11 filings are involved, Aone is linked to the client through Revenue’s current ROS agent-linking process, which means the client approves that access directly rather than it happening behind the scenes.<\/p>\n\n\n\n Onboarding follows the same logic: customer due diligence documents collected at the start of an engagement are retained in line with the five-year AML requirement, separately from the six-year retention that applies to the accounting records themselves, so the two don’t get conflated or handled on the same schedule by mistake. None of this removes the questions worth asking of any provider you’re evaluating \u2014 it’s simply what a properly structured engagement looks like when those questions have already been answered, rather than something being worked out for the first time after a problem comes up.<\/p>\n\n\n\n Security in outsourced accounting isn’t a certificate displayed on a website \u2014 it’s a clearly defined legal relationship, backed by a handful of concrete questions answered honestly. If a provider can tell you who the controller is, who the processor is, where your data physically sits, and how long different records need to be kept under Irish law, you’re in a good position to make a decision. <\/p>\n\n\n\nThe Irish Regulatory Layer (Not Just \u201cGDPR Compliant\u201d)<\/h2>\n\n\n\n
Anti-money laundering recordkeeping<\/strong><\/h3>\n\n\n\n
Companies Act 2014 retention<\/strong><\/h3>\n\n\n\n
ROS agent-linking<\/strong><\/h3>\n\n\n\n
If the Work Crosses Borders \u2014 What to Ask About International Transfers<\/h2>\n\n\n\n
\n
If Something Goes Wrong: What Breach Notification Actually Looks Like\u00a0<\/h2>\n\n\n\n
The Technical and Operational Controls That Should Back All of This Up<\/h2>\n\n\n\n
A Due-Diligence Checklist Before You Sign<\/h2>\n\n\n\n
\n
What This Looks Like in Practice<\/h2>\n\n\n\n
Conclusion<\/h2>\n\n\n\n