# Case study: accounting firm Source: https://conformitate.md/en/case-studies/accounting-firm Updated: 2026-10-17 Case study Illustrative example When an accounting firm runs payroll for its clients, it usually processes the data on their behalf, as a processor. Law No. 195/2024 requires that processing to be governed by a contract or other legal act, in writing (art. 28) and the data to be protected by appropriate security measures (art. 32). In this illustrative example, both were missing. ## The situation An accounting firm in Chișinău with 40 clients. Payroll sheets and the data of clients' employees went back and forth through the accountants' personal email addresses, and there was no contract governing the processing of data with any client. Files of clients who had left stayed in the same mailboxes. ## What was missing 1. There was no contract or other legal act with any client setting out the subject matter, duration, nature and purpose of the processing, the type of data and the categories of data subjects, although the firm processed payroll data on its clients' behalf. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 2. Payroll sheets with IDNPs, salaries and sick-leave certificates, which can reveal data concerning health, travelled through personal email addresses, outside any control by the firm. [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 3. The firm kept no record of the categories of processing activities carried out on behalf of each client, which the law also requires of a processor. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 4. Former clients' data were neither deleted nor returned, although at the end of the services the processor does one or the other, at the controller's choice. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 5. The accountants had made no commitment to confidentiality, and access to files did not depend on which client each of them worked for. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") ## The risks ### A fine for the processor The obligations on the contract, records and security also fall on the processor. Infringing them carries fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of total turnover in the year preceding the sanction, whichever is higher. Of the fine imposed, 10% applies in the first year after the law enters into force. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions") ### The firm can become a controller If the firm itself determines the purposes and means of the processing, for example by using clients' employee data for its own purposes, it is considered a controller for that processing and answers for it like any controller, including for breaching the principles, with a ceiling of 2,000,000 lei or 2%. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") ### Compensation claimed by clients' employees A client's employee whose data reached the wrong recipient may claim compensation. The processor is liable where it has not complied with the obligations specific to processors or has acted outside the client's instructions; where several parties are liable, each may be held liable for the entire damage. [art. 76](https://conformitate.md/en/law-195-2024/article-76 "Right to compensation and liability") ### Incidents that go unnoticed The processor notifies the controller without undue delay after becoming aware of a personal data breach, so that the controller can notify the Centre. With no control over personal mailboxes, the firm may never learn that a mailbox has been compromised. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ## What is in place now 1. A data processing agreement signed with each client, so that the firm's role and the client's instructions are set down in writing. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 2. A secure space for exchanging files, in place of personal email addresses. [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 3. A record of the processing activities carried out on behalf of each client. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 4. Internal security rules that tie access to files to the clients each accountant works for. [art. 25](https://conformitate.md/en/law-195-2024/article-25 "Data protection by design and by default") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 5. Confidentiality undertakings signed by the accountants and a briefing and advice session for the team. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") 6. A rule on deleting or returning data when work for a client ends, set out in the agreement with that client. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") ## Result The firm now has a data processing agreement signed with each client, a secure space for exchanging files, a record of the activities carried out on its clients' behalf, internal security rules and a team briefed on its obligations. For a typical accounting firm The Essential package + extra work, 12,400 MDL This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data. [Calculate the exact price →](https://conformitate.md/en/tools/price-calculator?profil=contabilitate) FAQ ## Questions about this case ### Does an accounting firm need the consent of its client's employees? No. The client, as employer and controller, has its own legal basis for processing payroll data, usually a legal obligation it is subject to. The firm processes the data on the client's behalf and only on its instructions, so it needs no separate basis for the same processing. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") ### Can we keep client files in a cloud storage service? Only with the client's specific or general written authorisation, and under a general authorisation the firm informs the client of any change of providers so that it can object. The provider takes on the same obligations by contract, and the firm remains fully liable to the client. If the data are stored in a state outside the European Economic Area, the rules on transfers also apply. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") ### What do we do with the data of a client who has left? When the services end, the firm deletes or returns all the data to the client, at the client's choice, and deletes existing copies, unless legislation requires them to be stored. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") ### Does a processor have to keep a record of processing? Yes. It keeps its own record of the categories of activities carried out on behalf of each controller. The exemption for enterprises with fewer than 250 employees does not apply where the processing is not occasional, as monthly payroll is, or includes data concerning health. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") Related pages [Accounting firms](https://conformitate.md/en/industries/accounting-firms) [Personal data breach: what to do](https://conformitate.md/en/situations/data-breach) [Inspection by the Centre](https://conformitate.md/en/situations/inspection-by-the-centre) [Controller and processor obligations](https://conformitate.md/en/law-195-2024/controller-and-processor-obligations) [Security and personal data breaches](https://conformitate.md/en/law-195-2024/security-and-breaches) --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing