Key takeaways

  • Sending client personal data to a separate company outside the UK is a restricted transfer under UK GDPR, and it needs adequacy regulations, an appropriate safeguard or an exception.
  • India, the Philippines, Pakistan, Sri Lanka and South Africa are not covered by UK adequacy regulations, so transfers there usually rely on the IDTA or the International Data Transfer Addendum plus a transfer risk assessment.
  • Giving an overseas team remote access to UK systems still counts as a transfer, because the ICO says a transfer covers making data accessible as well as sending it.
  • ACCA says it has no specific outsourcing or offshoring regulations, but its Code of Ethics sections on supervision, self-review and using the work of others still apply.
  • If your firm holds the client relationship, it keeps ultimate responsibility for AML, and ACCA says all customer due diligence must be carried out and documented by your practice.
  • Only your firm's MLRO can file a suspicious activity report with the National Crime Agency; offshore staff should escalate concerns internally.
  • A processor contract must cover the Article 28(3) terms, including documented instructions, confidentiality, security, sub-processors, audits and deletion at the end.

UK accounting firms can use offshore and outsourced teams, but the firm stays responsible for client data, AML and the quality of the work. Under UK GDPR, giving a separate overseas company access to client personal data is a restricted transfer that needs a legal basis such as the IDTA. Your professional body’s Code of Ethics then sets the standard for supervision and review.

What counts as outsourcing and offshoring?

ACCA’s guidance for UK practices uses three models. Outsourcing means hiring a provider in the UK. Offshoring means setting up your own team or branch in another country. Using an overseas provider that employs the staff is both.

The model matters because the data protection route differs. Your own overseas branch is the same legal entity as your firm; a separate overseas provider is not.

When is it a restricted transfer under UK GDPR?

A transfer is restricted if all three of the ICO’s tests are met. In its international transfers guide, updated 15 January 2026, the ICO says this applies when:

  1. UK GDPR applies to the processing.
  2. You initiate the transfer to an organisation outside the UK.
  3. The recipient is a separate legal entity from you.

The ICO says “transfer” covers making data accessible, not just sending files. Remote desktop access by an overseas provider’s staff to your practice software is therefore caught. The rules apply even to small, infrequent transfers.

There are three routes, and you must use them in order.

RouteWhen it worksWhat you need
Adequacy regulationsRecipient country is on the UK listNo extra safeguard
Appropriate safeguardNo adequacyIDTA or Addendum, plus a transfer risk assessment
ExceptionNeither of the above fitsShow it is necessary and proportionate

The ICO’s adequacy list includes the EU and EEA states, Gibraltar, Guernsey, Jersey, the Isle of Man, Israel, New Zealand, Switzerland, South Korea and others. Canada, Japan and the United States have partial adequacy only.

India, the Philippines, Pakistan, Sri Lanka and South Africa, common outsourcing locations, are not on the list. For those, most firms use the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU standard contractual clauses. The transfer risk assessment checks that protection will not be materially lower once the data leaves the UK. Exceptions are for occasional cases, not a routine bookkeeping service.

What must the processor contract say?

An outsourced provider usually acts as your processor, so Article 28(3) of UK GDPR sets the minimum contract terms. The ICO’s contract checklist requires:

  • processing only on your documented instructions, including for international transfers
  • a confidentiality commitment from everyone who handles the data
  • security measures meeting Article 32
  • your authorisation before any sub-processor is used, with the provider liable for them
  • help with data subject requests, breaches and DPIAs
  • deletion or return of data when the contract ends
  • audits and inspections, and information to show compliance

The ICO notes this guidance is under review following the Data (Use and Access) Act, so check for updates before you sign.

How do AML duties work with an offshore team?

Your firm keeps AML responsibility if it holds the client relationship. ACCA’s AML guidance on outsourcing under the Money Laundering Regulations 2017 says:

  • all customer due diligence must be carried out and documented by your practice
  • only your MLRO can file suspicious activity reports with the National Crime Agency
  • you should train offshore staff on UK red flags and escalation, and not assume they know UK rules
  • records held abroad must be retrievable promptly for your supervisor’s inspection

Our client due diligence checklist covers the in-house steps.

How do you keep quality and confidentiality?

The Code of Ethics puts review duties on you, not the provider. ACCA’s outsourcing guidance says it has no specific outsourcing rules, but points to section 110 (training and supervision of people working under your authority), section 120 (self-review threats, so review outsourced work) and 220.7 (due diligence on the provider’s expertise).

ICAEW’s 28 July 2026 confidentiality article points to subsection 114 of its Code. It tells firms working across several jurisdictions or digital platforms to review access controls, training and technology governance regularly.

Neither ACCA nor ICAEW guidance we checked says you must get client consent to outsource. Many firms disclose it in the engagement letter and privacy notice anyway, which also supports UK GDPR transparency.

What to do now

  1. Map the data. List which client data the team sees, from where, and on which systems.
  2. Pick the route. Check the adequacy list; if the country is not on it, sign the IDTA or Addendum and complete a transfer risk assessment.
  3. Sign an Article 28 contract. Include sub-processor and audit rights.
  4. Keep CDD and SARs in-house. Brief offshore staff on escalation to your MLRO.
  5. Tell your insurer. ACCA says outsourcing affects professional indemnity cover.
  6. Set a review standard. Decide who signs off outsourced work before it reaches clients or HMRC.

For UK-based options, see outsourcing bookkeeping for accounting firms.

Frequently asked questions

Can a UK accountant outsource work to India?

Yes, but India has no UK adequacy regulations, so you normally need the IDTA or the International Data Transfer Addendum, a transfer risk assessment and an Article 28 processor contract.

Is remote access by an overseas team a data transfer?

Yes. The ICO says a transfer includes making personal data accessible to a separate organisation outside the UK, not only sending it.

ACCA and ICAEW guidance we checked does not require consent. Disclosing it in your engagement letter and privacy notice is common practice and supports UK GDPR transparency.

Who is responsible for AML if work is outsourced?

Your firm, if it holds the client relationship. ACCA says CDD must be done and documented by your practice and only your MLRO can file SARs.

Does ACCA have rules on offshoring?

ACCA says it has no specific outsourcing or offshoring regulations, but its Code of Ethics sections 110, 120 and 220.7 apply to outsourced work.

Sources

Rates, thresholds and rules in this guide were checked against HMRC and GOV.UK guidance on 6 November 2026. Tax rules change, so check the current position on GOV.UK or with a qualified adviser before acting. This guide is general information, not personal advice.