Key takeaways
- UK GDPR's right to be informed means you must tell people how you use their personal data, usually through a privacy notice.
- Cover who you are, what you collect, why, your lawful basis, who you share it with, how long you keep it and people's rights.
- Make it specific to your firm and website: generic templates often describe processing you do not do, or miss what you do.
- Link it from every page and every form, and keep it up to date when you add tools.
- Client data processed under engagement letters can be covered by a separate client privacy notice.
A privacy notice (often called a privacy policy) tells people how your firm collects and uses their personal data. For an accounting practice, the website notice usually covers enquiries, marketing, cookies and recruitment, while a separate client privacy notice, often referenced in engagement letters, covers the far more detailed processing involved in providing services.
What your website privacy notice should include
1. Who you are
- your firm’s legal name, address and contact details
- your data protection lead or Data Protection Officer, if you have one
- that you are the controller of the data
2. What data you collect
Be specific to your website:
- enquiry form details: name, email, phone, message
- booking details for consultations
- newsletter sign-ups
- recruitment applications
- technical data from cookies and analytics, such as IP address and pages visited
3. Why and on what lawful basis
| Purpose | Typical lawful basis |
|---|---|
| Responding to enquiries | Legitimate interests, or steps prior to entering a contract |
| Providing quotes and onboarding new clients | Steps prior to a contract; legal obligation for anti-money laundering checks |
| Sending newsletters and marketing emails | Consent (or the soft opt-in for existing clients) |
| Website analytics | Legitimate interests, or consent, depending on your set-up and cookie approach |
| Recruitment | Steps prior to a contract and legitimate interests |
4. Who you share data with
- service providers (processors) such as your web host, email platform, booking tool and IT support
- professional advisers and insurers where necessary
- regulators and law enforcement where legally required
- any transfers outside the UK, with the safeguards used
5. How long you keep it
Set retention periods, such as deleting enquiries that do not become clients after a stated period, and newsletter subscribers when they unsubscribe.
6. People’s rights
Explain the rights to access, rectify, erase, restrict, object and data portability, and to withdraw consent, and how to exercise them. Explain the right to complain to the ICO.
7. Cookies
Either explain cookies in the notice or link to a separate cookie notice. See cookie consent.
8. Updates
Show the date of the last update and explain how changes will be communicated.
Writing tips
- Use plain English: the ICO expects notices to be concise, transparent and easy to understand.
- Layer it: a short summary at the top, with detail below or on expandable sections.
- Be accurate: only describe processing you actually do, and update the notice when you add tools such as live chat or a new email platform.
- Link it everywhere: in the footer, next to forms and on newsletter sign-ups.
Templates: use with care
Templates and generators are a reasonable starting point, but adapt them. A notice copied from another business may mention processing you do not carry out, or omit your recruitment, booking or analytics tools. The ICO has a free privacy notice generator for small organisations that is a sensible starting point.
Website notice versus client privacy notice
| Website privacy notice | Client privacy notice | |
|---|---|---|
| Audience | Website visitors, enquirers, subscribers | Clients and people whose data you process for clients |
| Covers | Enquiries, marketing, cookies, recruitment | Accounts, tax, payroll, AML checks, retention under professional rules |
| Where | Website footer | Engagement letters and client onboarding |
See also the GDPR checklist for accounting websites and engagement letters.
Frequently asked questions
Does my accounting firm website need a privacy policy?
Yes. If you collect any personal data, such as through enquiry forms, analytics or newsletters, you must tell people how you use it, usually in a privacy notice.
Can I use a privacy policy template?
Yes, as a starting point, but tailor it to the data your website and firm actually collect and the tools you use.
What is the lawful basis for responding to an enquiry?
Usually legitimate interests, or taking steps at the person’s request before entering into a contract.
How often should I update my privacy notice?
Whenever you change how you collect or use data, such as adding new tools, and review it at least annually.
Sources
Facts and rules in this guide were checked against the sources below in October 2026. Platforms, prices and regulations change, so check the current position before acting. This guide is general information, not legal or professional advice.