# Data Protection and GoBD: E-learning for tax practices
**GDPR alert: Data protection and data security are often still given short shrift in tax practices. Yet [Data Protection and Data Security](../../en/data-protection-documentation/index.md) more than just a mandatory requirement under the GoBD. If they tackle these issues properly, tax accountancy firms can also eliminate certain risks.**

In the latest „hsp live at 11“ livestream, Hendrik Sievers, a specialist solicitor in IT law, was a guest and spoke with Paul Liese \(hsp Software\) about the importance of data protection and data security for tax practice firms and their clients. Hendrik Sievers leads the ‘Data Protection and Data Protection Law’ module in the hsp academy’s e-learning course for digitalisation consultants. In this e-learning module, he dispels the most common misconceptions about data protection law, outlines the key principles that businesses need to bear in mind, and finally provides prospective digitalisation consultants with a checklist to take away.

## Data protection in procedural documentation

In his module, Hendrik Sievers covers topics that tax advisers should definitely discuss with their clients. The often troublesome issue of the duty to provide information also plays a key role at the E-learning is essential, as companies simply cannot avoid it when it comes to data protection. Those whose data is used must also be properly informed about this. Data protection, including the duty to provide information, is also fundamental to the creation of procedural documentation, as personal data is processed in accounting. The GoBD guidelines serve as the framework for [Preparation of procedural documentation](../../en/process-documentation-2/index.md) and set out how data must be processed and protected.

However, just like procedural documentation, data protection documentation is not merely a requirement for tax audits. Like procedural or process documentation, it offers many advantages: What data flows exist within the organisation? How can processes be optimised? Are there any duplicate licences? Process documentation reveals all of this, whilst data protection ensures the safeguarding of those whose data is being processed. However, Hendrik Sievers also makes it clear: „For companies, it is also a question of whether they have control over the data being processed. Do I know what is happening within the company? Is the data protected against unauthorised access?“ According to the solicitor, a thorough examination of GDPR issues is necessary to determine this.

For privacy reasons YouTube needs your permission to be loaded. For more details, please see our [Datenschutz](../../en/data-protection/index.md).

In any case, data protection and data security must always be considered together, as Hendrik Sievers points out: „When I focus on data protection, I automatically improve IT security as well – and vice versa.“ To protect data, it must be safeguarded against unauthorised access. And that requires a high level of security. If, for example, unauthorised individuals hack into the system using an encryption Trojan and the data is not backed up on external servers, this can have devastating consequences for a company. „If I’m not well prepared in this regard these days, my company could be paralysed for a whole week or even face the threat of major damage,“ explains Hendrik Sievers. This is because, not only would companies be unable to access their own systems in such a scenario, but hackers would also have full access to the stored data.

From a specialist solicitor’s point of view, it makes sense for businesses of any size to appoint a data protection officer. Although this is only mandatory for companies with 20 or more employees, as even small businesses must deal with data protection and data security, it is helpful to have a specific point of contact for these matters. This also reduces the workload for the management.

## Setting a good example as a professional bound by confidentiality

However, data protection and data security are relevant not only for businesses but also for tax consultancy firms themselves. On the one hand, firms process personal data themselves; on the other, they should lead by example for their clients. „Tax advisers should establish ways to exchange data securely,“ explains Hendrik Sievers. Instead of using the insecure method of email, tax firms should send data to their clients via secure online platforms. After all, if tax consultancy firms handle personal data professionally, they also project a positive image to the outside world. Ultimately, tax advisers are bound by professional confidentiality and cannot afford any incidents or even scandals relating to data protection.

That is why tax practice firms are also obliged to raise their staff’s awareness of data protection and to provide them with regular training – and to provide evidence of this. If, for example, staff take part in Hendrik Sievers’ e-learning course, they fulfil this obligation.

Admittedly, due to its length, the e-learning course does not cover every detail. However, Hendrik Sievers is available to answer participants„ in-depth questions during regular live calls. In addition, the hsp academy will provide regular updates to the course, as the legal framework governing data protection is constantly changing. For the solicitor, one thing is clear: “Data protection can actually be fun.” He wants to spare budding digitalisation consultants the hassle that the subject can seem to entail, particularly at first glance.