Key takeaways

  • Your website collects personal data through forms, cookies, analytics, chat and newsletters, so UK GDPR and PECR apply.
  • Publish a clear privacy notice and only collect what you need to respond to an enquiry.
  • Marketing emails need consent in most cases; never pre-tick boxes.
  • Use secure forms and HTTPS, and do not collect identity documents or tax records through your website.
  • Have contracts with processors such as your web host, form tools and email platform, and set retention periods.

Accounting firms handle highly sensitive client information, and their websites are often the first point at which personal data is collected. Getting the website right is part of complying with UK GDPR and the Privacy and Electronic Communications Regulations (PECR), and it shows prospective clients you take data seriously.

The checklist

1. Registration and accountability

  • Your firm has paid the ICO data protection fee (most firms that process personal data must, unless exempt)
  • You know who is responsible for data protection in the firm
  • Your website data flows are recorded in your records of processing

2. Privacy notice

  • A privacy notice is linked from every page footer and from every form
  • It explains who you are, what data you collect through the website, why, your lawful basis, who you share it with, how long you keep it, and people’s rights
  • It covers enquiry forms, bookings, newsletters, analytics and any chat tool

See privacy policy set-up.

3. Forms

  • Forms collect only what you need to respond (data minimisation)
  • Forms are served over HTTPS and submissions are sent and stored securely
  • No requests for sensitive information, such as National Insurance numbers, UTRs, bank details or identity documents, through general website forms
  • Enquiry data is deleted or moved into your practice systems and not left indefinitely in website databases or inboxes
  • Newsletter sign-ups use clear, unticked opt-ins, separate from enquiry forms
  • You record when and how consent was given
  • Every marketing email has an easy unsubscribe
  • You do not add enquirers to marketing lists without consent, unless the soft opt-in for existing clients clearly applies

5. Cookies

  • Non-essential cookies, especially advertising pixels, only load after consent
  • Reject is as easy as accept
  • Any analytics relying on the statistics exception are genuinely limited to statistics, explained clearly, with a simple way to object

See cookie consent.

6. Third parties and processors

  • You have data processing terms with your web host, form tool, booking system, email platform, chat provider and agency
  • You know where data is stored, and any international transfers have appropriate safeguards
  • Your agency or developer only has the access they need

7. Security

  • HTTPS everywhere; see HTTPS and SSL
  • Website software, plugins and themes are kept updated
  • Administrator accounts use strong passwords and two-factor authentication
  • Regular backups, and a plan for responding to a breach

8. Rights and retention

  • You can respond to subject access requests and deletion requests within one month
  • You have set retention periods for website enquiries, unsuccessful leads and newsletter subscribers
  • Old form entries are periodically deleted

9. Client portal and documents

  • Client documents are exchanged through a secure portal, not email attachments or website forms
  • The portal provider has appropriate security and data processing terms

Why it matters for accountants

Beyond legal risk, professional bodies expect members to maintain confidentiality and protect client information. Anti-money laundering checks also involve identity data, which should flow through secure, purpose-built systems, not your marketing website.

Frequently asked questions

Does my accounting firm website need to comply with GDPR?

Yes. Any website that collects personal data, through forms, cookies or analytics, is subject to UK GDPR and PECR.

No. You can usually rely on legitimate interests or steps prior to a contract to respond. You do need consent to send marketing emails in most cases.

Can clients upload documents through my website?

Use a secure client portal rather than general website forms or email for financial and identity documents.

Do I need to pay the ICO data protection fee?

Most firms that process personal data must pay the fee unless an exemption applies. Check the ICO’s self-assessment tool.

Sources

Facts and rules in this guide were checked against the sources below in October 2026. Platforms, prices and regulations change, so check the current position before acting. This guide is general information, not legal or professional advice.