Outsourcing to India and UK GDPR: a checklist for UK practices

1. Be clear about who is responsible

For the client data you hold, your practice is a controller under UK GDPR. A provider that works on that data only on your instructions acts as your processor, and Article 28 requires a written contract between you. Among other things, it should cover:

• processing only on your documented instructions
• confidentiality commitments from everyone who works on the data
• appropriate security measures
• no sub-processors without your authorisation
• help with data subject requests and personal data breaches
• deleting or returning the data when the work ends, as you choose
• the information you need to show compliance, including audits

2. Treat offshore access as a restricted transfer

If a separate organisation outside the UK can reach personal data your practice is responsible for, including by logging in to your cloud accounting software from abroad, plan on the basis that the UK GDPR rules on international transfers apply.

India is not covered by UK adequacy regulations, so the transfer needs an appropriate safeguard. For most practices that means the ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the EU standard contractual clauses, signed with the provider.

You also need a transfer risk assessment. The Data (Use and Access) Act 2025 calls it the "data protection test": whether the protection for the data after the transfer is not materially lower than in the UK. The ICO updated its international transfers guidance in January 2026, and its transfer risk assessment tool is a practical place to start.

3. Keep the data where it is

The lowest-risk set-up is for the provider to work inside your own systems, such as Xero or QuickBooks Online, through named logins you create, at an access level you choose and can remove at any time. Avoid emailing client records, or storing them in folders the provider controls.

4. Ask about security, and get the answers in writing

• Is client work done only on firm-owned computers, never on personal devices?
• Is 2-step verification used on email and on client software?
• Does each team member have their own login, with no shared passwords?
• Are client files kept off personal phones and USB drives?
• Do all staff sign confidentiality agreements?
• How quickly will you be told about a personal data breach?
• What happens to access and data when the engagement ends?

5. Check your own obligations to clients

Check whether your professional body's rules and your engagement letters require you to tell clients that you use an outsourced provider. Your privacy notice should also mention international transfers where they apply, and the safeguards you rely on.

How we work

We sign an NDA before any access and provide data processing terms for UK practices. We work inside your systems through logins you control, on firm-owned computers with 2-step verification. The full list of our controls is on our data security page.

How we support UK practices →