Do I need a data processing agreement (DPA) with my accounting software?
Short answer
Yes, almost always. Your books hold personal data (a sole trader customer, a supplier who is a person, your staff's pay), and a provider that stores it for you is a processor. UK GDPR Article 28 says the processor must be bound by a contract "in writing, including in electronic form" that covers eight points. Most cloud software puts that contract in its terms, so you sign nothing: you find it, check the eight points and keep a copy.
The eight points the contract must cover
Read on legislation.gov.uk, 5 November 2026. Article 28(3) says the contract sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the people concerned, and that the processor:
| The processor must | What to look for in a DPA | |
|---|---|---|
| a | process only on your documented instructions, including on transfers abroad | a clause called Instructions |
| b | bind its staff to confidentiality | Confidentiality |
| c | take the security measures of Article 32 | an annex with security measures |
| d | use sub-processors only with your authorisation and on the same terms | a sub-processor list and a notice period for changes |
| e | help you answer people's requests (access, erasure) | Rights requests |
| f | help with security, breach notices and impact assessments | Breaches, with a time limit |
| g | delete or return the data at the end | End of service |
| h | give you the information to show compliance and allow audits | Audits |
If one is missing, ask the provider before you load a year of books.
Worked example: checking one DPA in ten minutes
Sam runs a two person Ltd in Leeds with 140 customers, 30 of them sole traders, and one employee on payroll. Before moving the books, Sam checks the provider's DPA against the table. Here is the check done on our own Octobooks DPA, version of 9 October 2026:
| Point | Found | Where |
|---|---|---|
| Roles | You are the controller, Octobooks Ltd the processor | section 1 |
| Data and people | customers, suppliers, staff; names, bank details, salary and expense data | section 2 |
| a Instructions | your settings and the actions you or your connected AI take count as instructions | section 3 |
| b Confidentiality | everyone with access bound | section 3 |
| c Security | ISO 27001 data centre in Germany, encrypted backups | Annex 1 |
| d Sub-processors | named list, 30 days' notice by email, right to object and leave with a refund | section 3, list |
| e Rights requests | passed to you, tools to find, export, correct and delete | section 3 |
| f Breaches | without undue delay, aim within 48 hours | section 3 |
| g End | 90 days to export, then deleted; backups gone within 12 months | section 3 |
| h Audits | information on request, on site once a year with 30 days' notice | section 3 |
| Transfers | hosted in Germany; SCCs or the UK IDTA where a sub-processor is abroad | section 4 |
All eight are there, so Sam saves the page as a PDF with the date and moves on. Ten minutes, one file. Do the same for any provider, ours or not.
Who else in your books needs one?
| Who | Usually | DPA needed? |
|---|---|---|
| Accounting software in the cloud | processor | yes |
| Payroll bureau running your payroll | processor | yes; what your AI should see of payroll: can AI see my employees' payroll data? |
| Your AI provider, if it reads your books | processor on business plans | yes: on Claude for Work and the API, Anthropic's Commercial Terms incorporate its Data Processing Addendum (seen 5 November 2026); Free, Pro and Max run under consumer terms instead |
| Your bank | controller | no |
The AI line matters most. Your accounting software's DPA does not cover what your own AI reads: that goes to your AI provider under your plan with them. Which plans train on your data: is it safe and GDPR compliant to put my invoices into ChatGPT or Claude?
What if there is no contract?
Then both sides break Article 28. Under UK GDPR Article 83(4) that sits in the lower band of fines: up to £8.7 million or 2% of worldwide annual turnover, whichever is higher. A small firm is unlikely to meet that figure, but a missing DPA is the first thing an ICO complaint or a large customer's supplier check asks for. If a provider will not give you one, choose another.
How Octobooks handles it
- The DPA is part of our terms and covers every account; nothing to sign or request.
- Your books are hosted in Germany. Sub-processors: Hetzner (servers in Germany, second encrypted backup in Finland), Paddle (payments), Google Workspace (our email). Octobooks itself sends your books to no AI provider. Why that needs no UK paperwork, and the Companies Act six month rule: where should accounting data be stored?
- You decide what your own AI sees: Standard, Careful (people's names replaced by pseudonyms, their contact and bank details left out) or Private (no personal data reaches the AI), and you can close payroll or bank lines to it separately. How: Data protection and your AI.
How long you must keep the records, and when you may delete them: how long must I keep accounting records? A general summary, not legal advice.
More questions
- Can ChatGPT or Claude do my bookkeeping? One month worked through
- Is it safe and GDPR compliant to put my invoices and bank statements into ChatGPT or Claude?
- How long must I keep accounting records in the UK, and when can I delete them under GDPR?
- Does my accounting software use my data to train AI? How to check in ten minutes
- What does UK GDPR mean for a small company's accounting data? Fee, record and the one trap