Disclaimer: The information provided in this blog is for general informational purposes only and does not constitute legal, tax, or accounting advice. Nothing on this site should be relied upon as a substitute for professional advice from a licensed attorney, CPA, or financial advisor. Please consult a qualified professional before making any financial or legal decisions.
GDPR does not stop you from keeping financial records. It requires you to keep only the personal data you need, for a justified period, and to protect it while you hold it. Accounting law and data protection law pull in the same direction once you see how they fit together. This article covers the legal bases for holding financial data, how retention periods work, what happens to data subject rights when records must stay, security duties, and a practical setup for small businesses and bookkeepers. Good GDPR financial record keeping comes down to a handful of documented decisions, not a wholesale change in how you do your books.
Why GDPR Applies to Your Books and Ledgers
Financial records are full of personal data. An invoice to a sole trader, a payroll file, an expense claim, a supplier's bank details, and a customer's payment history all identify a living person. If a record can be linked to a specific individual, directly or indirectly, GDPR covers it.
Key terms
- Personal data: any information relating to an identified or identifiable individual, such as a name, address, bank account number, or tax ID.
- Processing: almost anything you do with that data, including collecting, storing, sharing, and deleting it.
- Controller: the party that decides why and how the data is processed. Your business is the controller of its own customer and employee data.
- Processor: a party that processes data on the controller's instructions. An outsourced bookkeeper running your ledgers is often a processor. An accountant who files returns under their own professional obligations and decides how to handle the data may be a controller in their own right. The arrangement determines the label, not the job title.
Which regime applies
Article 3 sets the scope. GDPR applies to organisations established in the EU or EEA, and to organisations outside it that offer goods or services to people in the EU or monitor their behaviour. UK businesses fall under UK GDPR and the Data Protection Act 2018, which closely mirror the EU rules, though they are separate legal texts that can diverge over time. A business with operations or customers in both places may need to meet both. Verify which regime covers you before building your processes.
The B2B misconception
Many finance teams assume business-to-business records are exempt. They are not. GDPR protects individuals, and an invoice addressed to a named accounts payable contact, a director's personal guarantee, or a sole trader's bank details is personal data even though the transaction is commercial. Only data about a company with no identifiable individual in it falls outside the rules.
The Legal Bases That Justify Keeping Financial Records
Article 6 requires a lawful basis for every processing activity. For financial records, three bases do most of the work.
- Legal obligation, Article 6(1)(c): the main basis for statutory bookkeeping, tax filings, and payroll records. If a tax or company law requires you to keep it, this is your basis.
- Contract, Article 6(1)(b): covers processing needed to perform a contract with the person, such as issuing invoices, taking payment, and paying employees or contractors.
- Legitimate interests, Article 6(1)(f): can cover fraud prevention, credit control, or debt recovery where no statute or contract directly requires the processing. You need a documented balancing test showing your interest is not overridden by the individual's rights and expectations.
Why consent is usually the wrong choice
Many businesses assume they need consent for accounting records. They generally do not, and relying on it creates problems. Consent can be withdrawn at any time, but the law may still require you to keep the record. If your stated basis disappears on request while your retention duty continues, your documentation contradicts your practice. Use consent for things that are genuinely optional, such as marketing emails, and use legal obligation or contract for the ledgers.
A worked example
Suppose a former customer, a freelance designer, asks you to delete everything you hold about them. You hold their contact details, a marketing subscription, and three years of invoices. The invoices are part of your statutory accounting records, so you keep them under legal obligation. The marketing subscription has no such requirement, so you delete it and stop sending messages. You then reply in writing explaining what was deleted, what was kept, and why.
Documenting your choices
Article 30 requires most controllers to maintain a record of processing activities, and it is the natural place to log the basis for each data category. A simple spreadsheet works: payroll data, supplier bank details, customer invoices, expense claims, each with its purpose, lawful basis, retention period, and recipients. Small organisations have a limited exemption from Article 30, but it does not apply where processing is regular or involves certain sensitive data, and payroll is regular processing, so most businesses should keep the record anyway.
How to Set Retention Periods for Financial Records
GDPR does not name a retention period for any record. Article 5(1)(e), storage limitation, says personal data must be kept in identifiable form no longer than necessary for the purpose. Article 5(1)(c), data minimisation, says you should hold only what is adequate and relevant. For accounting data, the "necessary" period comes from national tax, company, and accounting law, so it differs by country and by record type.
As an illustration only, HMRC guidance in the UK has generally expected businesses to keep records for at least six years for self assessment and company tax purposes. Treat that as a pointer, not a rule for your case: it varies by situation, other countries set different periods, and rules change. As of 2026, confirm the current figure for each record type against your own tax authority's published guidance before relying on it.
Build a retention schedule
A retention schedule turns legal requirements into something your team can follow. For each record type, list:
- The record type, such as sales invoices, payroll records, or bank statements.
- The legal source requiring retention, such as a specific tax or company law provision.
- The retention period.
- The trigger date that starts the clock, commonly the end of the financial year or the end of employment.
- The disposal method, such as secure deletion, anonymisation, or shredding.
Avoid a single blanket period
Different records run on different clocks. Payroll files, VAT or sales tax records, contracts, and company filings can each carry their own period under different laws, and the trigger dates differ too. A contract may need to be kept until limitation periods for claims expire, which is a separate question from tax retention. Applying the longest period to everything feels safe but breaches the storage limitation principle. Applying the shortest risks breaching accounting law.
Where no law sets a period, you must decide one and be able to justify it. Write down the reasoning, such as the typical window for disputes or audits in your sector, so the figure is defensible if a regulator asks.
Data Subject Rights When the Records Must Stay
Individuals keep their rights even when you must retain their data. The task is to apply each right accurately and explain your decision, not to refuse by default.
Erasure
Article 17 gives a right to erasure, but Article 17(3) lists exceptions. Article 17(3)(b) covers processing needed to comply with a legal obligation, and 17(3)(e) covers the establishment, exercise, or defence of legal claims. So erasure does not automatically override retention. Respond in writing within the standard one-month deadline, state which data you are deleting, which you are keeping, the specific legal reason, and when the retained data will be deleted. Delete everything that falls outside the exception.
Access
Article 15 lets individuals request a copy of their personal data. This applies to financial records too. You generally have one month to respond, extendable in some cases where requests are complex or numerous. Before sending, check documents for other people's data, such as a joint invoice or a payroll summary listing colleagues, and redact where needed.
Rectification
If a customer's address or bank details are wrong, they can ask you to correct them. In accounting, you cannot simply overwrite history, because the audit trail matters. Use an adjusting entry, a credit note and reissue, or a logged amendment that preserves the original entry and shows what changed, when, and by whom. Update the master contact record going forward, while the historic transaction stays as it was.
Restriction
Article 18 offers a middle path. If someone contests the accuracy of data, or you need the records for a pending dispute, you can flag them as restricted instead of deleting. Restricted data stays in storage but is not used for anything else without justification. A clear flag in your system and a note of who may access restricted records keeps this workable.
Securing Financial Data and Managing Accountants, Software, and Cloud Vendors
Holding records lawfully is only half the job. Article 32 requires appropriate technical and organisational measures, scaled to the risk. Financial data includes bank details and tax identifiers, so the risk is real.
Baseline security measures
- Role-based access, so staff see only the records their job requires.
- Encryption for data at rest and in transit, including laptops and backups.
- Multi-factor authentication on accounting software, email, and banking portals.
- Regular, tested backups stored separately from live systems.
- Logging of who accessed or changed records, so unusual activity is visible.
Agreements with outside parties
Article 28 requires a written data processing agreement whenever a processor handles personal data for you. That covers outsourced bookkeepers, payroll bureaux, and cloud accounting vendors. The agreement must set out the instructions, confidentiality, security, sub-processor rules, assistance with data subject requests, and deletion or return of data at the end. Most established software vendors publish standard terms, so check that you have accepted them and that they match your actual use. Also ask where the data is hosted.
International transfers
If a vendor or its sub-processors handle data outside the EU or EEA (or outside the UK, under UK GDPR), you need a valid transfer mechanism. Common options are an adequacy decision or standard contractual clauses. Adequacy arrangements can be challenged or revised, so verify the current status of any framework a vendor relies on instead of assuming it still holds.
Breach response
Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in risk to individuals. Prepare an incident procedure before you need one. It should cover lost laptops, phishing compromises, and a misdirected invoice sent to the wrong client, and it should name who decides whether to notify, how the decision is recorded, and who contacts affected individuals if the risk is high.
A Practical Compliance Checklist and Secure Disposal Routine
A workable programme for a small business follows a clear sequence:
- Inventory the financial data you hold, including where it lives: software, email, shared drives, paper files, and personal devices.
- Map each category to a lawful basis and record it in your Article 30 record.
- Set the retention schedule, verifying each period against official guidance.
- Sign processing agreements with every vendor and outside accountant that handles the data.
- Restrict access by role and enable multi-factor authentication.
- Schedule an annual review to catch new systems, new vendors, and changes in law.
Disposal
Retention schedules mean little without disposal. Once a period expires, delete or anonymise electronic records on a schedule, shred paper, and use certified wiping for retired drives. Remember backups: records deleted from live systems can persist in copies, so set a backup rotation that ages them out on a defined cycle. Keep a log of what was destroyed, when, and by whom, without retaining the personal data itself.
Common mistakes
- Keeping everything forever because deletion feels risky.
- Emailing spreadsheets that contain bank details or tax IDs.
- Handling company finances on personal devices.
- Retaining scanned identity documents after verification is complete.
When to get specialist help
Bring in a qualified data protection officer, lawyer, or CPA when you operate across borders, handle large volumes of payroll or sensitive data, face a regulator inquiry, or cannot tell which retention rule governs a record. Conflicting national rules are exactly where advice pays for itself.
Keep What the Law Requires, For as Long as It Requires, Securely
GDPR and accounting law work together when you hold the records the law demands, keep them only as long as it demands, and protect them while you do. The checklist above gives you the order of work: inventory, basis, schedule, agreements, access, review, and disposal. Before you finalise your retention schedule, confirm the local periods for each record type with a qualified professional in your jurisdiction.
Schedule a call and discover how we can help your business grow.