# Data protection for accounting firms Source: https://conformitate.md/en/industries/accounting-firms Updated: 2026-10-17 Accounting firms For the data it receives from clients, an accounting firm is usually a processor: it processes the data on the client’s behalf and only on the client’s instructions (art. 28). It needs a written contract with each client, appropriate security measures and, as a rule, records of processing activities. For its own employees, the firm is the controller. ![An accounting firm's desk with clients' documents in order](/_astro/contabilitate-1200.C3Em1XcV.webp) ## Industry-specific risks ### Access to payroll data Payroll sheets contain the salaries, deductions, IDNPs and bank accounts of clients’ employees. Security measures must be appropriate to the risk this data presents. [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") [art. 53](https://conformitate.md/en/law-195-2024/article-53 "Processing of a national identification number") ### Files sent by email A payroll sheet sent to the wrong address is an unauthorised disclosure, and therefore a personal data breach, which the firm reports to the client without undue delay. [art. 4](https://conformitate.md/en/law-195-2024/article-4 "Definitions") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### No contract with the client Processing on the client’s behalf is governed by a written contract or other legal act. If the firm determines the purposes and means of a processing operation itself, it is treated as the controller for that operation. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") ## Data you process IDNP and identity data Salaries and deductions Bank accounts Sick-leave certificates Family details for tax allowances Employment contracts ## Your obligations under Law No. 195/2024 1. Processing clients’ data only on their documented instructions [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") 2. A written processing contract with each client [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 3. Records of the activities carried out on behalf of each client, where the processing is not occasional [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 4. Security measures for access to data and for file transfers [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 5. Notifying the client of a personal data breach without undue delay [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") 6. Engaging another processor only with the client’s prior specific or general written authorisation [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") ## Documents we deliver Every document is tailored to your activity, not copied from a template. Data processing contract for clients [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") Records of processing activities as a processor [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") Information security policy [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") Confidentiality undertakings [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") Personal data breach log [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") How we work ## From the first conversation to a complete compliance file 1. 1 ### Free consultation 15 minutes online or by phone. We learn what your company does and what personal data it processes. 2. 2 ### Assessment We take stock of your data, processes and existing documents. You receive a gap report. 3. 3 ### Documentation We draft the records, policies and privacy notices tailored to your activity. 4. 4 ### Implementation We walk you through the documents and leave a written note for employees; on request, we hold a briefing session for them. For a typical accounting firm The Essential package + extra work, 12,400 MDL This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data. [Calculate the exact price →](https://conformitate.md/en/tools/price-calculator?profil=contabilitate) Packages ## Fixed prices, no surprises Choose a package by how your company processes data, not by headcount. Prices start from the lawyer's work, and a package costs less than its modules bought separately. ### Essential 5,900 MDL Module value: 18,500 MDL · you save 12,600 MDL Up to 3 processing activities · 2 privacy notices · 2 processor contracts For a small company with simple processing: a shop, an office, an accounting firm, a homeowners' association. - Data inventory and gap report - Records of processing activities, with the legal basis and retention period of each - Data protection policy and a description of the security measures - Privacy notices for each group of people: clients, employees, patients - Contracts with processors, new or reviewed - Internal rules for data subject requests and for personal data breaches - The confidentiality commitment and the written note for employees Online · delivered in 10 working days · 1 round of revisions · 14 calendar days of email questions [Choose Essential →](https://conformitate.md/en/industries/accounting-firms?pkg=essential#oferta) ### Extended Most popular 19,900 MDL Module value: 44,000 MDL · you save 24,100 MDL Up to 8 activities · 5 notices · 5 contracts · website, cameras, sensitive data For a small or medium company with varied processing: a clinic, an online shop, surveillance cameras, cloud services abroad. - Everything in Essential, with higher limits - Website privacy policy and cookie review - Video surveillance: notice, sign text, internal rules - Sensitive data in one activity (for example, medical records) - Transfers outside Moldova, one group of destinations - We check whether you need an impact assessment and a data protection officer Online · delivered in 20–30 working days · 2 rounds of revisions · 45 calendar days of email questions [Choose Extended →](https://conformitate.md/en/industries/accounting-firms?pkg=extended#oferta) ### Custom from 45,000 MDL No limits · analysis at your premises For clinic networks, banks and microfinance companies, groups of companies, public bodies, or companies that must appoint a data protection officer. - Everything in Extended, with no limits - Data protection impact assessments, as many as needed - Review of data flows and IT systems - Joint controller agreements, profiling, complex transfers Priced after analysis, at module prices [Request a quote →](https://conformitate.md/en/industries/accounting-firms?pkg=custom#oferta) Not sure which package fits? [Calculate the price →](https://conformitate.md/en/tools/price-calculator) [Request a free 15-minute consultation →](https://conformitate.md/en/industries/accounting-firms?pkg=consult#oferta) Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate. ## Case studies and checklist [ Case study Illustrative example ### Case study: accounting firm An accounting firm in Chișinău with 40 clients. Payroll sheets and the data of clients' employees went back and forth through the accountants' personal email addresses, and there was no contract governing the processing of data with any client. Files of clients who had left stayed in the same mailboxes. Result The firm now has a data processing agreement signed with each client, a secure space for exchanging files, a record of the activities carried out on its clients' behalf, internal security rules and a team briefed on its obligations. ](https://conformitate.md/en/case-studies/accounting-firm) FAQ ## What clients ask us ### Are we a controller or a processor? For the data you process on behalf of clients, you are usually a processor. For your own employees, you are the controller, and for your own legal obligations you may be a controller. If you determine the purposes and means of a processing operation yourself, the Law treats you as the controller for that processing. [art. 4](https://conformitate.md/en/law-195-2024/article-4 "Definitions") [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") ### Do we have to sign a contract with every client? Yes. Processing on behalf of a controller is governed by a contract or other legal act, drawn up in writing, including in electronic form. It can form part of the accounting services contract. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") ### What do we do if we sent a payroll sheet to the wrong person? It is a personal data breach. As the processor, you notify the client without undue delay. The client, as the controller, notifies the National Centre for Personal Data Protection without undue delay and, where possible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the people concerned. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### What do we owe our clients as a processor? Besides the written contract, you process the data only on the client's documented instructions and keep your own record of the categories of activities carried out on behalf of each client. You help the client answer data subject requests and meet its obligations on security and personal data breaches, and you notify it of a breach without undue delay. The same applies to IT firms that host or administer their clients' data: they too are processors and may engage another supplier only with the client's written authorisation. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing