Where should my accounting data be stored under UK GDPR? Does it have to be in the UK?

Short answer

It does not have to be in the UK. UK GDPR only asks for a lawful basis when personal data leaves the UK, and UK law already treats every EU and EEA state as adequate (Data Protection Act 2018, Schedule 21, paragraph 5), so books hosted in Germany or Ireland need nothing beyond your normal DPA. Outside the UK and EEA (the US, for example) the provider needs a transfer mechanism. For a Ltd there is one more rule: if its accounting records are kept outside the UK, accounts and returns at least every six months must be kept at a place in the UK (Companies Act 2006, section 388).

The two rules side by side

Where the provider hosts	UK GDPR	Companies Act s388 (Ltd only)
United Kingdom	fine	fine
EU or EEA (Germany, Ireland, Finland)	fine: treated as adequate, Schedule 21 para 5	records outside the UK: keep six monthly accounts and returns in the UK
United States	needs a transfer mechanism: UK adequacy regulations for that provider, or the ICO's international data transfer agreement or addendum; check the provider's DPA	as above
Anywhere else	as for the US	as above

Section 388 says a company's records must be kept at its registered office or such other place as the directors think fit, open to its officers at all times. If kept outside the UK, the accounts and returns sent to the UK must show the financial position with reasonable accuracy at intervals of not more than six months. Sole traders and partnerships have no location rule; HMRC only asks that the records exist and can be shown. All read on legislation.gov.uk, 5 November 2026.

Worked example: Tom's Ltd, books hosted in Germany

Tom runs a web agency Ltd in Manchester, year end 31 March, books in cloud software hosted in Frankfurt.

Question	Answer for Tom
Does UK GDPR stop him?	No: Germany is in the EEA, treated as adequate. He keeps the provider's DPA on file (what to check in it)
Is a cloud server in Frankfurt "a place outside the United Kingdom"?	The section predates cloud software and does not say. Our reading: treat it as yes, because the fix is cheap
What does he do?	On 30 September and 31 March he downloads the profit and loss, the balance sheet and the trial balance as PDFs and saves them on the office drive in Manchester
Time	about ten minutes, twice a year

Those two dates match his half year and his year end, so the second export doubles as the pack for the accounts (UK tax deadlines calendar for the filing dates).

And your AI?

If Claude or ChatGPT reads your books, the books stay where your software keeps them, but what the AI reads goes to your AI provider, often processed in the US. That is a transfer under UK GDPR, covered (or not) by your plan with the provider: on Claude, only the business plans under the Commercial Terms include a DPA (seen 5 November 2026). Less personal data to the AI means less to transfer: is it GDPR compliant to put invoices into ChatGPT or Claude?

How Octobooks handles it

Your books are on Hetzner servers in Germany, with the second, encrypted backup in Finland: both EEA, so no transfer paperwork under UK GDPR. Every sub-processor with its location: list.
The DPA is part of our terms and covers every account.
Octobooks itself sends your books to no AI provider. You decide what your own AI sees: Standard, Careful (people as pseudonyms, contact and bank details left out) or Private (no personal data to the AI). How: Data protection and your AI.
Reports and the full export download at any time, so the six monthly copy for section 388 takes minutes.

How long to keep it all: how long must I keep accounting records? A general summary, not legal advice.

Sources

Updated 2026-11-05. General information, not tax advice for your own case.