Choose an industry

Medical & dental clinics Online stores Homeowners associations Accounting firms

Accounting firms

Data protection for accounting firms

For the data it receives from clients, an accounting firm is usually a processor: it processes the data on the client’s behalf and only on the client’s instructions (art. 28). It needs a written contract with each client, appropriate security measures and, as a rule, records of processing activities. For its own employees, the firm is the controller.

Request a quote →Request a free consultation

An accounting firm's desk with clients' documents in order

Industry-specific risks

! 01

Access to payroll data

Payroll sheets contain the salaries, deductions, IDNPs and bank accounts of clients’ employees. Security measures must be appropriate to the risk this data presents. art. 32 art. 53

! 02

Files sent by email

A payroll sheet sent to the wrong address is an unauthorised disclosure, and therefore a personal data breach, which the firm reports to the client without undue delay. art. 4 art. 32 art. 33

! 03

No contract with the client

Processing on the client’s behalf is governed by a written contract or other legal act. If the firm determines the purposes and means of a processing operation itself, it is treated as the controller for that operation. art. 28

Data you process

IDNP and identity dataSalaries and deductionsBank accountsSick-leave certificatesFamily details for tax allowancesEmployment contracts

Your obligations under Law No. 195/2024

01Processing clients’ data only on their documented instructions art. 28 art. 29
02A written processing contract with each client art. 28
03Records of the activities carried out on behalf of each client, where the processing is not occasional art. 30
04Security measures for access to data and for file transfers art. 32
05Notifying the client of a personal data breach without undue delay art. 33
06Engaging another processor only with the client’s prior specific or general written authorisation art. 28

Documents we deliver

Every document is tailored to your activity, not copied from a template.

Data processing contract for clients art. 28

Records of processing activities as a processor art. 30

Information security policy art. 32

Confidentiality undertakings art. 28

Personal data breach log art. 33

How we work

From the first conversation to a complete compliance file

1
Free consultation
15 minutes online or by phone. We learn what your company does and what personal data it processes.
2
Assessment
We take stock of your data, processes and existing documents. You receive a gap report.
3
Documentation
We draft the records, policies and privacy notices tailored to your activity.
4
Implementation
We walk you through the documents and leave a written note for employees; on request, we hold a briefing session for them.

For a typical accounting firm

The Essential package + extra work, 12,400 MDL

This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data.

Calculate the exact price →

Packages

Fixed prices, no surprises

Choose a package by how your company processes data, not by headcount. Prices start from the lawyer's work, and a package costs less than its modules bought separately.

Essential

5,900MDL

Module value: 18,500 MDL · you save 12,600 MDL

Up to 3 processing activities · 2 privacy notices · 2 processor contracts

For a small company with simple processing: a shop, an office, an accounting firm, a homeowners' association.

✓Data inventory and gap report
✓Records of processing activities, with the legal basis and retention period of each
✓Data protection policy and a description of the security measures
✓Privacy notices for each group of people: clients, employees, patients
✓Contracts with processors, new or reviewed
✓Internal rules for data subject requests and for personal data breaches
✓The confidentiality commitment and the written note for employees

Online · delivered in 10 working days · 1 round of revisions · 14 calendar days of email questions

Choose Essential →

Extended

Custom

from45,000MDL

No limits · analysis at your premises

For clinic networks, banks and microfinance companies, groups of companies, public bodies, or companies that must appoint a data protection officer.

✓Everything in Extended, with no limits
✓Data protection impact assessments, as many as needed
✓Review of data flows and IT systems
✓Joint controller agreements, profiling, complex transfers

Priced after analysis, at module prices

Request a quote →

Not sure which package fits? Calculate the price → Request a free 15-minute consultation →

Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate.

Case studyIllustrative example

Case study: accounting firm

An accounting firm in Chișinău with 40 clients. Payroll sheets and the data of clients' employees went back and forth through the accountants' personal email addresses, and there was no contract governing the processing of data with any client. Files of clients who had left stayed in the same mailboxes.

ResultThe firm now has a data processing agreement signed with each client, a secure space for exchanging files, a record of the activities carried out on its clients' behalf, internal security rules and a team briefed on its obligations.

Free checklist

Accounting firms

Check in 10 minutes whether your organisation meets the basic requirements of Law No. 195/2024.

Complete the checklist →

FAQ

What clients ask us

Are we a controller or a processor?

For the data you process on behalf of clients, you are usually a processor. For your own employees, you are the controller, and for your own legal obligations you may be a controller. If you determine the purposes and means of a processing operation yourself, the Law treats you as the controller for that processing. art. 4 art. 28

Do we have to sign a contract with every client?

Yes. Processing on behalf of a controller is governed by a contract or other legal act, drawn up in writing, including in electronic form. It can form part of the accounting services contract. art. 28

What do we do if we sent a payroll sheet to the wrong person?

It is a personal data breach. As the processor, you notify the client without undue delay. The client, as the controller, notifies the National Centre for Personal Data Protection without undue delay and, where possible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the people concerned. art. 33

What do we owe our clients as a processor?

Besides the written contract, you process the data only on the client's documented instructions and keep your own record of the categories of activities carried out on behalf of each client. You help the client answer data subject requests and meet its obligations on security and personal data breaches, and you notify it of a breach without undue delay. The same applies to IT firms that host or administer their clients' data: they too are processors and may engage another supplier only with the client's written authorisation. art. 28 art. 30 art. 33

Free consultation

Not sure where to start?

Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.

Request a quote →Request a free consultation

Data protection for accounting firms

Industry-specific risks

Access to payroll data

Files sent by email

No contract with the client

Data you process

Your obligations under Law No. 195/2024

Documents we deliver

From the first conversation to a complete compliance file

Free consultation

Assessment

Documentation

Implementation

Fixed prices, no surprises

Essential

Extended

Custom

Case studies and checklist

Case study: accounting firm

Accounting firms

What clients ask us

Not sure where to start?

Find out what compliance costs for your company