GDPR for Tax Advisors and Law Firms: Client Data Specifics

Main article: Data processing agreement template under Art. 28 GDPR — a model contract with the mandatory content of Art. 28(3) GDPR for your service providers.

1. BayLDA clarification 2024

Tax advisors and lawyers are Controllers in their own right, NOT Data Processors. No data processing agreement under Art. 28 is required. The clarification comes from the BayLDA, a German state data protection authority (supervision of non-public bodies: § 40(1) BDSG (German Federal Data Protection Act)). The distinction itself follows from Art. 28(1) and (3) GDPR and applies unchanged in Austria — there the Austrian Data Protection Authority (Datenschutzbehörde) is the competent supervisory authority (§ 18(1) DSG (Austrian Data Protection Act)).

The practical consequence: the firm bears the Controller's obligations itself. These include its own record of processing activities (Art. 30(1) GDPR), its own notification of a Personal Data Breach (Art. 33(1) GDPR), its own handling of data subject requests (Art. 12(3) GDPR) and its own assessment of the duty to designate a data protection officer (Art. 37(1) GDPR, supplemented in Germany by § 38(1) BDSG).

A data processing agreement remains necessary wherever the firm itself engages service providers that process personal data on its behalf. Art. 28(1) GDPR permits only Data Processors providing sufficient guarantees of appropriate technical and organisational measures; Art. 28(3) GDPR sets out the minimum content of the contract: the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the Controller.

Practice recommendation: record in your own documentation why the client relationship is not treated as processing on behalf of a controller. Confusing processing on behalf of a controller with (joint) controllership is among the frequent errors in the record of processing activities. It also remains sensible for firm and client to inform each other about their privacy notices.

2. Professional secrecy under § 203 StGB and the GDPR fining range

Stricter than the GDPR. In the event of a breach: criminal complaint and fine in parallel. § 203(1) no. 3 StGB expressly covers lawyers and tax advisors — this is German criminal law; Austrian firms are subject to the confidentiality duties of their respective professional law.

On the GDPR side, the fining range of Art. 83 GDPR applies alongside: under Art. 83(4) GDPR up to EUR 10 million or 2 % of the total worldwide annual turnover of the preceding financial year for infringements of, among others, Art. 25 to 39 GDPR; under Art. 83(5) GDPR up to EUR 20 million or 4 % for infringements of the processing principles and conditions for consent (Art. 5, 6, 7, 9 GDPR) or of the rights of the data subject (Art. 12 to 22 GDPR) — whichever amount is higher. In Austria, § 62(1) DSG provides for administrative fines of up to EUR 50,000 for certain offences — among them intentional unlawful access to a data processing operation and the intentional transmission of data in breach of data secrecy (§ 6 DSG) — unless the act is already covered by Art. 83 GDPR; the Datenschutzbehörde is competent for these decisions.

Scope of this article: it deals with the data protection side (GDPR, BDSG, DSG); the reach, exceptions and consent questions relating to § 203 StGB as well as to BRAO and StBerG should be clarified with an admitted lawyer.

3. Protection of client files

Strict retention (StBerG: 10 years, BRAO: 6 years — German professional law, as are § 257 HGB / § 147 AO). Access only by professionals and assigned staff.

In data protection terms, the type of data determines the level of protection: where the client file contains health data or information on racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation — typical in personnel and illness cases — the general prohibition on processing in Art. 9(1) GDPR applies, with narrow exceptions under Art. 9(2) GDPR, such as explicit consent.

This classification can trigger two further obligations: large-scale processing of special categories makes a data protection impact assessment necessary in particular under Art. 35(3) GDPR; where the core activity consists of such large-scale processing, a data protection officer must be designated under Art. 37(1)(c) GDPR — irrespective of any headcount.

For the firm's own accounting records, the commercial and tax law retention obligation in Germany is ten years under § 257 HGB and § 147 AO; the professional law periods of the StBerG and the BRAO apply alongside. Retention obligations and erasure requests regularly collide. Where a retention obligation stands in the way of an erasure request, the conflict with Art. 17 GDPR belongs in the documentation rather than being left open in the procedure. In Austria, data secrecy under § 6 DSG applies in addition (see the section 'Germany and Austria').

4. Cloud software for law and tax firms

DATEV (hosting in Germany), Stack-IT, legal software from Wolters Kluwer. Where hosting is in the US: transfer impact assessment (TIA) and particular caution (professional secrecy!).

Irrespective of the provider: anyone having firm data processed in a cloud is engaging a Data Processor. Required are sufficient guarantees of appropriate technical and organisational measures (Art. 28(1) GDPR) and a contract with the minimum content under Art. 28(3) GDPR. Where the place of processing lies in a Third Country, the transfer requires a safeguard — in practice standard contractual clauses, the Data Privacy Framework or binding corporate rules. The record of processing activities needs a separate column for this (Art. 30(1) GDPR names Third Country transfers as mandatory information).

A recurring documentation error is the missing Third Country reference for US tools. Practice recommendation: list every application in use together with its provider, place of processing and safeguard, record there when you last reviewed that safeguard, and review the list as part of the review cycle for the record of processing activities; outdated recipient lists and missing erasure periods are among the most frequent errors in the record of processing activities.

5. Email with the client

S/MIME or PGP encryption is recommended. The special electronic lawyers' mailbox (besonderes elektronisches Anwaltspostfach, beA) is mandatory for lawyers in Germany (§ 31a BRAO; passive duty of use under § 31a(6) BRAO). For tax advisors, this section addresses only the data protection side of communication; professional law channel obligations are not covered here.

Encryption is not merely a protective measure, it changes the legal consequences of a breach: under Art. 34(3) GDPR, notification of the data subject is not required where appropriate technical and organisational protection measures — in particular encryption — have been applied, where the high risk no longer exists as a result of subsequent measures, or where notification would involve disproportionate effort — only in this last case is a public communication made instead. Notification of the supervisory authority follows independently from Art. 33(1) GDPR: it is dispensed with only where the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

As for where protection measures are recorded: under Art. 30(1) GDPR the record of processing activities contains only a general description of the technical and organisational measures. The details belong in a central TOM concept under Art. 32 GDPR, to which each processing activity refers — a separate set of measures for each activity is unusual in practice and merely creates duplication.

6. Specifics of a Personal Data Breach

In the event of a Personal Data Breach: notification of the supervisory authority plus the § 203 StGB risk. Law firms: informing the bar association is possible — a professional law question that this article does not examine in depth (see the scope note in section 2). The notification deadline itself is uniform across the EU: without undue delay and, where feasible, within 72 hours to the competent supervisory authority (Art. 33(1) GDPR) — in Germany the state data protection authority (§ 40(1) BDSG), in Austria the Datenschutzbehörde (§ 18(1) DSG).

The notification itself has a fixed mandatory content under Art. 33(3) GDPR: a description of the breach by nature and circumstances, the approximate number of data subjects and of the records concerned, the categories of data, the likely consequences, the measures taken to address it and to mitigate damage, and the contact details of the data protection officer or Controller. Where notification is not made within 72 hours, reasons for the delay must accompany it (Art. 33(1) GDPR). Independently of this, every breach must be documented under Art. 33(5) GDPR — including those not notified, together with the reasons why no notification was made.

Reporting route in practice: in Germany, non-public bodies notify the authority competent under state law, each of which operates its own notification portal (§ 40(1) BDSG) — in Bavaria, for example, the Bavarian Data Protection Supervisory Authority (Bayerisches Landesamt für Datenschutzaufsicht, lda.bayern.de). In Austria, the notification goes to the Datenschutzbehörde (dsb.gv.at).

For the sequence after a misdirected email, this means (practice recommendation): record the incident internally at once and assess the risk, notify the supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33(1) GDPR), inform the data subjects where the risk is high (Art. 34(1) GDPR), ask the recipient to delete the data and document every step (Art. 33(5) GDPR). Whether a fine follows, and in what amount, is decided by the supervisory authority in the individual case within the range set out in section 2; under Art. 83(2) GDPR it takes into account, among other things, the measures taken to mitigate the damage suffered by data subjects (Art. 83(2)(c)), the degree of cooperation with the supervisory authority (Art. 83(2)(f)) and the categories of personal data affected (Art. 83(2)(g)).

Record of processing activities: nine fields per processing activity

For each processing activity, the firm documents nine fields: the Controller and contact details (including the data protection officer), purposes, categories of data subjects, categories of personal data, categories of recipients, Third Country transfers with safeguards, envisaged erasure periods, a general description of the technical and organisational measures (details in the central TOM concept under Art. 32 GDPR, see section 5) — and the legal basis. Eight of these are mandatory information under Art. 30(1) GDPR: the provision lists seven points ((a)–(g)); because point (c) bundles two items — categories of data subjects and categories of personal data — practice works with eight mandatory fields. The ninth field, the legal basis, is not named in Art. 30(1) but derived from the Accountability principle in Art. 5(2) GDPR. The obligation to keep the record falls on the firm as Controller.

The exemption in Art. 30(5) GDPR is of little practical help to firms: it applies only cumulatively — fewer than 250 employees and no risk to the rights and freedoms of data subjects and no regular processing and no special categories under Art. 9 or data on criminal convictions. Ongoing client and personnel administration is regular processing (practice assessment), which removes the ground for the exemption.

On the form: a spreadsheet suffices — the record must be kept in writing, which may also be in electronic form (Art. 30(3) GDPR); what matters is that the content, currency and legibility are right. On request, the record must be made available to the supervisory authority (Art. 30(4) GDPR). In practice, supervisory enquiries begin with exactly this document, followed by the data processing agreement, the TOM concept and the DPIA. Practice recommendation: review annually and on every change, quarterly where structures are growing, documenting each update with a date.

Client requests under data subject rights: one month to respond

The firm must respond to requests for the exercise of data subject rights without undue delay, and in any event within one month of receipt (Art. 12(3) GDPR). The period may be extended by two further months where the complexity or number of requests requires it — the data subject must then be informed of the extension and its reasons within the first month. All requests under Art. 15 to 22 GDPR are covered, in particular access, rectification and erasure.

The practically most difficult case is the erasure request: the conflict between Art. 17 GDPR and the retention obligations (see section 3) should be documented in a comprehensible way (practice recommendation) — which data remain, on what ground and for how long, and when they are actually erased. Those periods belong in the 'envisaged erasure periods' field of the record of processing activities in any case.

Deadlines and references at a glance

The following table lists obligations under the GDPR only; they apply equally in Germany and Austria. Professional and criminal law obligations (§ 203 StGB, BRAO, StBerG) are deliberately not shown here.

Germany and Austria: where they differ

The GDPR articles themselves (including Art. 9, Art. 28, Art. 33, Art. 37) apply identically in both countries. What differs is the supplementary national law, the professional law and the competent supervisory authority:

• Germany: the BDSG applies in addition — a duty to designate a data protection officer where as a rule at least 20 persons are constantly engaged in automated processing (§ 38(1) BDSG), and irrespective of that for processing subject to a DPIA. Supervision of non-public bodies: the state data protection authorities competent under state law (§ 40(1) BDSG), and for federal bodies the Federal Commissioner for Data Protection (BfDI) (§ 9(1) BDSG). Professional and criminal law: § 203 StGB, BRAO/StBerG, beA under § 31a BRAO — all German law, as is the BayLDA clarification. In addition to Art. 83 GDPR, § 43 BDSG makes the faulty handling of an access request and infringements of the consumer information duty under § 30 BDSG an administrative offence subject to a fine; the fine is up to EUR 50,000 (§ 43(2) BDSG), and no fines are imposed on authorities and other public bodies (§ 43(3) BDSG).
• Austria: the DSG applies in addition. It provides for no numerical threshold for the data protection officer — the duty to designate follows directly from Art. 37 GDPR (§ 5 DSG additionally governs confidentiality and freedom from instructions). Supervision: the Datenschutzbehörde as the national supervisory authority under § 18(1) DSG. Administrative fines under § 62(1) DSG, see section 2. Professional confidentiality follows Austrian professional law, not § 203 StGB. Two Austrian provisions are also relevant to everyday firm practice: data secrecy under § 6 DSG, which obliges Controllers, Data Processors and their staff to maintain secrecy, and § 11 DSG, under which the Datenschutzbehörde applies Art. 83 GDPR proportionately and, in particular for first-time infringements, issues a reprimand instead of imposing a fine. The DSG has no dedicated employee data protection provision comparable to § 26 BDSG; what applies are Art. 6 and Art. 88 GDPR, supplemented by § 12(4) no. 2 DSG (image recording for the monitoring of employees is inadmissible) and § 96(1) no. 3 ArbVG (Austrian Labour Constitution Act) (monitoring measures affecting human dignity only with a works agreement).