What does UK GDPR mean for a small company's accounting data? Fee, record and the one trap
Short answer
Keeping your books is lawful without consent (it is a legal duty), and on its own it is exempt from the data protection fee; but the fee is due as soon as any of your processing is not exempt, and because bookkeeping runs every month, the under 250 staff exemption from keeping a record of processing does not help. Since 30 September 2026 the regulator is called the Information Commission (formerly the ICO). Tier 1 fee: GBP 52 a year, GBP 47 by direct debit (Data Protection (Charges and Information) Regulations 2018, reg. 3).
The four duties in one table
| Duty | What it means for your books | Where it stands |
|---|---|---|
| Lawful basis | keeping accounts and records is a legal obligation (Companies Act, HMRC record rules) | UK GDPR Article 6(1)(c) |
| Data protection fee | exempt only if all your processing is exempt: accounts and records, staff administration, advertising your own business | Schedule, para 2 |
| Record of processing | a written list: purposes, people, data, recipients, transfers, deletion times, security | Article 30(1) |
| Processor contract | your accounting software, payroll bureau and cloud storage each need a DPA | Article 28 |
The fee exemption covers processing "for the purposes of keeping accounts, or records of purchases, sales or other transactions", deciding whether to accept a customer or supplier, and financial forecasts (Schedule para 2(2)(f)); data from a credit reference agency is excluded (para 2(4)). All read on legislation.gov.uk on 5 November 2026.
Worked case: Tom's shop pays, Mia does not
Tom runs a bike repair Ltd: 3 staff, turnover GBP 180,000, books in accounting software, payroll, a newsletter to his own customers, and one CCTV camera over the till.
| Processing | Exempt from the fee? |
|---|---|
| invoices, bank statements, supplier bills | yes, accounts and records |
| payroll and staff files | yes, staff administration (para 2(2)(d)) |
| newsletter about his own shop | yes, advertising his own business (para 2(2)(e)) |
| CCTV for crime prevention | no, not on the list |
One processing outside the list, so Tom pays. With 10 staff or fewer, or turnover up to GBP 632,000, he is tier 1: GBP 52, or GBP 47 by direct debit (reg. 3(1)(a), 3(2), 3(5)). Not paying can bring a fixed penalty of up to 150% of the top tier charge (Data Protection Act 2018, s.158).
Mia is a sole trader designer: no staff, no camera, books and invoices only, a mailing list of her own clients. Everything she does is on the exempt list, so she pays no fee. She still owes the other three duties.
Why a small company still needs a record of processing
Article 30(5) lifts the record duty for organisations under 250 people unless the processing is likely to risk people's rights, is not occasional, or includes special category data. Bookkeeping and payroll run every month, so on our reading of the text they are not occasional, and payroll often holds special category data (sick pay, trade union subscriptions). So write the record. For books it fits on half a page:
| Article 30(1) item | Mia's entry |
|---|---|
| (a) controller | Mia, sole trader, business address, email |
| (b) purposes | bookkeeping, invoicing, tax returns |
| (c) people and data | clients and suppliers: names, addresses, bank details, invoice lines |
| (d) recipients | HMRC, her accounting software (processor) |
| (e) transfers | books hosted in Germany, encrypted backup in Finland (both EEA, treated as adequate under UK rules) |
| (f) deletion | 5 years after the 31 January deadline of the tax year (sole trader), then delete; a limited company keeps 6 years from its year end (how long to keep records) |
| (g) security | two factor sign in, DPA with the software, AI set to Careful |
How Octobooks handles it
Octobooks is your processor under a DPA you accept at sign up, and your books are hosted in Germany (where accounting data may be stored). If you let Claude or another AI read your books, you choose what it sees: Standard, Careful (people as pseudonyms, contact and bank details left out) or Private (no personal data to the AI). How to set it: data protection and your AI. What else the DPA must say: do I need a data processing agreement? A general summary, not legal advice.
More questions
- How long must I keep accounting records in the UK, and when can I delete them under GDPR?
- Do I need a data processing agreement (DPA) with my accounting software?
- Can AI see my employees' payroll data, and should it?
- Where should my accounting data be stored under UK GDPR? Does it have to be in the UK?
Sources
- Data Protection (Charges and Information) Regulations 2018, reg. 3 (charges as amended by SI 2025/63), seen 5 November 2026
- Same regulations, Schedule: exempt processing, seen 5 November 2026
- UK GDPR Article 30: records of processing activities, seen 5 November 2026
- Data Protection Act 2018, s.158: fixed penalties for not paying the charge, seen 5 November 2026