Most outsourcing conversations start with rates. The firms that regret the decision are rarely the ones that paid too much — they are the ones that did not settle data protection, disclosure and review before the first file moved.
Before a UK firm sends client data offshore it needs four things settled: a UK GDPR Article 28 processor contract, a lawful transfer mechanism for sending personal data outside the UK, a decision on what clients are told and where that appears, and a documented review step. Responsibility for the work stays with the UK firm in every case — outsourcing moves the task, never the accountability.
Weighing up an offshore team and want the questions written down? WhatsApp us and we will send the checklist as a document.
Quick Summary
| Area | What to settle before you start |
| Data protection role | You are controller or processor; the provider is a processor or sub-processor |
| Contract | UK GDPR Article 28 terms in writing, not a general NDA |
| International transfer | IDTA, or the UK Addendum to the EU SCCs, plus a transfer risk assessment |
| Client disclosure | What you tell clients, and whether it sits in the engagement letter or privacy notice |
| Review | Who reviews, at what level, and what is evidenced |
| Responsibility | Stays with your firm — confirm your PII covers outsourced work |
| Access | Named individuals, your software, your permissions, logged |
| Exit | Notice period, data return and deletion, file handover format |
💡 TaxKitab Tip Run a single non-urgent client through the whole process before you sign anything long-term — one month, one set of books, start to finish including review and query handling. You will learn more from that than from any proposal, because what separates providers is not whether they can do the work. It is how they handle the fourth query, the missing document and the thing that was not in the scope. Ask to pay for that month at normal rates rather than taking a free trial; free trials are staffed differently.
1. Settle the Data Protection Position First
Under UK GDPR, your firm is almost always the controller of your clients’ personal data, and the offshore provider is a processor acting on your instructions. Where your client is itself the controller and you are the processor, your provider becomes a sub-processor — and that usually requires your client’s authorisation under your own processor contract. Check which of the two you are before anything else, because the obligations differ.
The processor contract must meet Article 28 requirements in writing — a general confidentiality agreement does not satisfy it. It needs to cover subject matter and duration, nature and purpose, types of personal data and categories of data subject, and the processor’s obligations on security, sub-processing, assistance, deletion and audit.
2. Get the Transfer Mechanism Right
India does not have a UK adequacy decision, so sending personal data there needs an appropriate safeguard. In practice that means either the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, both issued by the ICO.
Alongside it you need a transfer risk assessment — a documented view of whether the protection travels with the data in the destination country. This is the step most firms skip and the one a regulator would ask to see first. Keep both on file with the engagement: the question is never whether you had a lawful basis, it is whether you can produce the paperwork.
3. Decide What Clients Are Told
There are two separate questions here and firms often answer only one.
Transparency. Your privacy notice should reflect that personal data may be processed by third parties outside the UK. That is a data protection obligation, not optional.
Engagement terms. Whether your engagement letter says you may use third parties, and whether it names them, is a commercial and professional judgment rather than one prescribed rule. Many firms include a general clause; larger clients and anyone in a regulated sector will often require naming and prior approval.
The practical test: if a client found out from someone else that their records are worked on in India, would they feel they had been told? If the honest answer is no, the disclosure is not sufficient, whatever the contract says.
4. Pin Down Review and Quality
Outsourcing moves preparation. It does not move responsibility — your firm remains responsible for the work and must direct, supervise and review it as if a member of your own staff had done it.
So settle: who reviews and at what seniority; what review means — a tick, or a documented check against a defined standard; what is evidenced and where it lives; how a query reaches you, how fast and in what format; and what happens when something is wrong, including who bears the rework.
Ask to see a completed file from another client with identifying details removed, review notes included. A provider who cannot produce one is telling you something.
5. Control Access
The safest arrangement is that the provider works in your systems, on your licences, under named user accounts with role-based permissions and logging. No shared logins. No data leaving your environment to be worked on locally and sent back.
Settle how access is granted and revoked, how long it lasts, and who at your firm owns the list. Accountant and adviser roles in the major platforms are designed for this, and the permission levels matter — the differences are in adding an accountant in QuickBooks and Xero.
Also check: background checks on staff, a confidentiality undertaking signed by the individuals rather than only the company, physical security of the working site, and whether staff can remove data on personal devices.
6. Agree the Exit Before You Start
Notice period on both sides. Return of data in a usable format. Documented deletion afterwards, with confirmation. Handover of working papers and open queries. An exit clause written at the start costs nothing; written at the end under pressure it costs a great deal — the dynamics are much the same as any mid-year handover.
7. Check Your Own Cover
Confirm with your professional indemnity insurer that cover extends to work prepared by an offshore provider. Most policies do, but it is a short email and a bad thing to discover late.
How to Use This
Send the eight rows of the Quick Summary to any provider you are considering and ask for written answers. The answers matter less than whether they come back quickly, in writing, without three follow-ups — that response is a sample of the working relationship.
What the arrangement looks like once running is in the first 30 days of an offshore engagement, the commercial comparison in what outsourced bookkeeping actually costs, and the security framework in data security when outsourcing to India.
Frequently Asked Questions
Do I need client consent to outsource? Consent in the UK GDPR sense is usually not the lawful basis you are relying on — your processing basis is normally contract or legitimate interests. What you need is transparency in the privacy notice, an Article 28 contract, and a valid transfer mechanism. Whether you additionally need client agreement under your engagement terms depends on those terms and on the client.
Is an NDA enough? No. An NDA covers confidentiality. Article 28 requires specific processor terms beyond confidentiality, and an NDA provides no transfer safeguard at all.
Which transfer mechanism should we use? The IDTA is a standalone UK agreement. The UK Addendum bolts onto EU Standard Contractual Clauses and is simpler where the provider already has SCCs in place. Either is acceptable; both need a transfer risk assessment.
Who is liable if the offshore team makes an error? Your firm, as far as the client is concerned. The provider contract governs recovery between you and the provider; it does not change your position with the client.
Does TaxKitab prepare UK tax returns? No. Our overseas scope is accounting and bookkeeping — records, reconciliation, management reporting and year-end preparation support. Tax filing is done by the UK firm or the client’s own agent.
References
- UK GDPR Article 28 — requirements for processor contracts
- ICO International Data Transfer Agreement (IDTA) and the UK Addendum to the EU Standard Contractual Clauses, in force since 21 March 2022, with ICO guidance on transfer risk assessments
- ICAEW and ACCA practice guidance on outsourcing and data protection for member firms
⚠️ Data protection requirements change, and UK transfer rules have been under review. Confirm the current ICO position and your own professional body’s guidance before finalising any arrangement, and take legal advice on the contract itself.
Call or WhatsApp: +91 7448200422 | Email: info@taxkitab.com
See our Outsourced Accounting service and the UK page, or Global Desk if you are a practice rather than a business. Get in touch.
