Case study: accounting firm
When an accounting firm runs payroll for its clients, it usually processes the data on their behalf, as a processor. Law No. 195/2024 requires that processing to be governed by a contract or other legal act, in writing (art. 28) and the data to be protected by appropriate security measures (art. 32). In this illustrative example, both were missing.
The situation
An accounting firm in Chișinău with 40 clients. Payroll sheets and the data of clients' employees went back and forth through the accountants' personal email addresses, and there was no contract governing the processing of data with any client. Files of clients who had left stayed in the same mailboxes.
What was missing
- 01There was no contract or other legal act with any client setting out the subject matter, duration, nature and purpose of the processing, the type of data and the categories of data subjects, although the firm processed payroll data on its clients' behalf. art. 28
- 02Payroll sheets with IDNPs, salaries and sick-leave certificates, which can reveal data concerning health, travelled through personal email addresses, outside any control by the firm. art. 9 art. 32
- 03The firm kept no record of the categories of processing activities carried out on behalf of each client, which the law also requires of a processor. art. 30
- 04Former clients' data were neither deleted nor returned, although at the end of the services the processor does one or the other, at the controller's choice. art. 28
- 05The accountants had made no commitment to confidentiality, and access to files did not depend on which client each of them worked for. art. 28 art. 29 art. 32
The risks
A fine for the processor
The obligations on the contract, records and security also fall on the processor. Infringing them carries fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of total turnover in the year preceding the sanction, whichever is higher. Of the fine imposed, 10% applies in the first year after the law enters into force. art. 28 art. 30 art. 32 art. 88 art. 90
The firm can become a controller
If the firm itself determines the purposes and means of the processing, for example by using clients' employee data for its own purposes, it is considered a controller for that processing and answers for it like any controller, including for breaching the principles, with a ceiling of 2,000,000 lei or 2%. art. 28 art. 88
Compensation claimed by clients' employees
A client's employee whose data reached the wrong recipient may claim compensation. The processor is liable where it has not complied with the obligations specific to processors or has acted outside the client's instructions; where several parties are liable, each may be held liable for the entire damage. art. 76
Incidents that go unnoticed
The processor notifies the controller without undue delay after becoming aware of a personal data breach, so that the controller can notify the Centre. With no control over personal mailboxes, the firm may never learn that a mailbox has been compromised. art. 33
What is in place now
- 01A data processing agreement signed with each client, so that the firm's role and the client's instructions are set down in writing. art. 28
- 02A secure space for exchanging files, in place of personal email addresses. art. 32
- 03A record of the processing activities carried out on behalf of each client. art. 30
- 04Internal security rules that tie access to files to the clients each accountant works for. art. 25 art. 32
- 05Confidentiality undertakings signed by the accountants and a briefing and advice session for the team. art. 28 art. 29
- 06A rule on deleting or returning data when work for a client ends, set out in the agreement with that client. art. 28
Result
The firm now has a data processing agreement signed with each client, a secure space for exchanging files, a record of the activities carried out on its clients' behalf, internal security rules and a team briefed on its obligations.
For a typical accounting firm
The Essential package + extra work, 12,400 MDL
This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data.
Calculate the exact price →FAQ
Questions about this case
Does an accounting firm need the consent of its client's employees?
No. The client, as employer and controller, has its own legal basis for processing payroll data, usually a legal obligation it is subject to. The firm processes the data on the client's behalf and only on its instructions, so it needs no separate basis for the same processing. art. 6 art. 28 art. 29
Can we keep client files in a cloud storage service?
Only with the client's specific or general written authorisation, and under a general authorisation the firm informs the client of any change of providers so that it can object. The provider takes on the same obligations by contract, and the firm remains fully liable to the client. If the data are stored in a state outside the European Economic Area, the rules on transfers also apply. art. 28 art. 44
What do we do with the data of a client who has left?
When the services end, the firm deletes or returns all the data to the client, at the client's choice, and deletes existing copies, unless legislation requires them to be stored. art. 28
Does a processor have to keep a record of processing?
Yes. It keeps its own record of the categories of activities carried out on behalf of each controller. The exemption for enterprises with fewer than 250 employees does not apply where the processing is not occasional, as monthly payroll is, or includes data concerning health. art. 30
Free consultation
Not sure where to start?
Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.