GDPR alert: Data protection and data security are often still given short shrift in tax practices. Yet Data Protection and Data Security more than just a mandatory requirement under the GoBD. Tax accountancy firms can also eliminate certain risks if they tackle these issues properly. 

Hendrik Sievers, a specialist solicitor in IT law, was a guest on the latest „hsp live at 11" livestream, where he spoke with Paul Liese (hsp Software) on the importance of data protection and data security for tax practice firms and their clients. Hendrik Sievers leads the ‘Data Protection and Data Protection Law’ module in the hsp academy’s e-learning course to become a digitalisation consultant. In thisr E-learning-Unit He dispels the most common misconceptions about data protection law, outlines the key principles that businesses need to bear in mind, and finally provides aspiring digitalisation consultants with a checklist to take with them. 

Data protection in procedural documentation

In his module, Hendrik Sievers covers topics that tax advisers should definitely discuss with their clients. The often vexing issue of the duty to provide information also plays a key role at the E-learning is essential, as companies simply cannot avoid the issue of data protection. Those whose data is used must also be properly informed about this. Data protection, including the duty to provide information, is also fundamental to the preparation of procedural documentation, as personal data is processed in the course of accounting. The GoBD guidelines serve as the framework for Preparation of procedural documentation and set out how data must be processed and protected. 

However, just like procedural documentation, data protection documentation is not merely a requirement for tax audits. Like procedural or process documentation, it offers many advantages: What data flows exist within the organisation? How can processes be optimised? Are there any duplicate licences? Process documentation reveals all of this, whilst data protection ensures the protection of those whose data is being processed. However, Hendrik Sievers also makes it clear: „For companies, it is also a matter of, whether she control over the data processed have. "Do I know what is happening within the company? Is the data protected against unauthorised access?" According to the lawyer, a thorough understanding of GDPR issues is necessary to determine this. 

In any case, data protection and data security must always be considered together, as Hendrik Sievers: „When I focus on data protection, I automatically improve IT security as well – and vice versa." To protect data, it must be safeguarded against unauthorised access. And that requires a high level of security. If unauthorised individuals hack into the system – for example, using an encryption Trojan – and the data is not backed up on external servers, this can have disastrous consequences for companies. „If I’m not well prepared in this regard these days, my business could be paralysed for a whole week, or even face the threat of major damage," explains Hendrik Sievers. Because not only would companies be unable to access their own systems in such a case, but hackers would also have furthermore full access to the stored data. 

From a specialist solicitor’s point of view, it makes sense for businesses of any size to appoint a data protection officer. Although this is only mandatory for companies with 20 or more employees, as even small businesses must deal with data protection and data security, it is helpful to have a specific point of contact for these matters. This also reduces the workload for the management. 

Setting a good example as a professional bound by confidentiality

However, data protection and data security are relevant not only for businesses but also for tax consultancy firms themselves. On the one hand, firms process personal data themselves; on the other, they should set a good example for their clients. „Tax advisers should establish ways to exchange data securely," explains Hendrik Sievers. Instead of using the insecure method of email, tax firms should send data to their clients via secure online platforms. After all, if tax consultancy firms handle personal data professionally, they also project a positive image to the outside world. Ultimately, tax advisers are bound by professional secrecy and cannot afford incidents or even scandals relating to data protection.  

That is why tax consultancy firms are also obliged to ensure that their staffhe/she/they to raise awareness of data protection and provide regular training – and to provide evidence of this. If, for example, employees take part in Hendrik Sievers’ e-learning course, they fulfil this obligation. 

Admittedly, due to its length, the e-learning course does not cover every detail. However, Hendrik Sievers is available to answer participants’ detailed questions during the regular live calls. In addition, the hsp academy will provide regular updates to the course, as the lawsThe legal framework surrounding data protection is constantly changing. For the lawyer, one thing is clear: „Data protection can actually be fun." He wants to spare budding digitalisation consultants the hassle that the subject can entail, particularly at first glance. save.