When you send personal, financial or tax information to an accounting firm, you may wonder who can see it.
You may provide:
- tax returns;
- bank statements;
- business accounts;
- payroll records;
- details of your income and assets;
- HMRC correspondence;
- identification documents; and
- information about your family or financial circumstances.
Does everyone at the firm have access to all this information?
Generally, they should not.
Professional accountants must respect client confidentiality. Accounting firms should also control how their teams access, share and use client information.
Therefore, the key question is not simply, “Does the firm hold my information?” It is, “Who needs access to it, and why?”
This question matters more than ever as accounting practices use cloud software, remote teams, outside service providers and artificial intelligence.
What Information Might an Accounting Firm Hold?
An accounting firm may hold much more information than the figures shown on your tax return.
Depending on its work, the firm may hold:
- identity documents;
- tax and accounting records;
- bank statements;
- payroll information;
- investment and property details;
- overseas financial information;
- contracts and invoices;
- HMRC correspondence; and
- information about directors, shareholders or family members.
Some records may contain sensitive personal information. Others could reveal commercially valuable details about a business.
For that reason, confidentiality forms a central part of an accountant’s professional responsibilities.
Who Inside the Firm May See Your Information?
The answer depends on the firm, the service you receive and the systems it uses.
People who may need access include:
- the accountant dealing with your work;
- a partner or director supervising the engagement;
- members of the accounts or tax team;
- payroll staff, if the firm runs your payroll;
- administrative staff supporting the work;
- anti-money laundering or compliance staff;
- IT staff in limited circumstances; and
- outside specialists engaged by the firm.
However, employment by the same firm should not give every member of staff unrestricted access to every client file.
A well-run practice should limit access to people who need the information for a genuine professional, legal or business reason.
For example, a payroll employee may need to see your payroll records. However, that person may have no reason to read confidential correspondence about a tax investigation.
People sometimes call this the “need-to-know” approach. In simple terms, the firm should connect access to a clear purpose.
What About Partners and Different Departments?
For example, a partner may need to review:
- a complex tax issue;
- an HMRC investigation;
- a complaint;
- a conflict of interest;
- a risk assessment; or
- the quality of the team’s work.
Even so, seniority does not remove the duty of confidentiality. A partner should not access, discuss or use client information without a proper reason.
Different departments may also need to share certain information.
For instance, the tax team may need figures prepared by the accounts team.
Similarly, the payroll team may need information supplied by a director or employer.
However, the firm should not share more information than the receiving team needs.
It should take particular care with information about personal difficulties, disputes, undeclared income, tax investigations or commercially sensitive transactions.
Why Might AML and Compliance Staff Need Access?
UK accounting firms must follow anti-money laundering rules. Consequently, members of the compliance team may need to review information about:
- your identity;
- beneficial ownership;
- the source of funds;
- your business activities;
- unusual transactions; and
- the firm’s assessment of money-laundering risk.
The firm may need this information even when it does not appear in your accounts or tax return.
However, compliance work does not make the information available to everyone. The firm should still restrict access under its policies and legal obligations.
In some circumstances, the law may also prevent an accountant from telling a client about a report or investigation. This is why the firm may not always be able to answer every question about its anti-money laundering work.
Can the Firm Share Information Outside the Practice?
Sometimes an accounting firm needs to involve another person or organisation.
This could include:
- an external tax specialist;
- a legal adviser;
- an auditor;
- a software or payroll provider;
- a regulator;
- HMRC; or
- another public authority.
Nevertheless, the firm needs a proper basis before it discloses confidential information.
That basis may come from:
- your authority;
- the services covered by the engagement;
- a legal obligation;
- a court order;
- a regulator’s powers; or
- a professional duty or right to disclose.
Therefore, confidentiality does not mean that an accountant can never share information. Instead, it means the accountant must have a valid reason and should disclose only what is appropriate.
What Happens If HMRC Requests Information?
HMRC may ask an accounting firm for information during a tax enquiry or investigation.
However, an HMRC request does not automatically entitle HMRC to every document the firm holds.
The accountant should consider:
- what HMRC has requested;
- whether HMRC has used formal statutory powers;
- which person or business the request concerns;
- whether the information falls within the scope of those powers; and
- whether any legal or professional restriction applies.
If the law requires disclosure, that requirement may override the usual duty of confidentiality. Even then, the firm should consider the proper scope of the request.
This distinction matters because voluntarily supplying information differs from responding to a legally enforceable information notice.
What If You Have a Sensitive Tax Problem?
Internal confidentiality becomes particularly important when a client faces a sensitive tax matter.
For example, the issue might involve:
- undeclared income;
- outstanding tax returns;
- overseas assets;
- a large tax debt;
- an HMRC enquiry; or
- a COP8 or COP9 investigation.
Several specialists may need to work on the case. However, the wider firm does not need to know every detail.
The team should share information carefully and only for a relevant purpose. Staff should not discuss the case casually simply because they work in the same practice.
This matters both professionally and personally. Clients who already feel anxious about a tax problem should know that the firm will handle their information with care.
How Should Firms Protect Digital Information?
Most accounting firms now store client information electronically.
They may use cloud accounting software, client portals, document-management systems, payroll platforms, tax software and email services.
These systems can improve security and efficiency. However, the firm must configure and manage them properly.
A password alone does not provide complete protection. Appropriate safeguards may include:
- access based on each person’s role;
- multi-factor authentication;
- regular reviews of access rights;
- secure transfer and storage of documents;
- monitoring of privileged accounts;
- staff training;
- controls over contractors and suppliers; and
- prompt removal of access when someone leaves.
Confidentiality also continues after an employee or client leaves the firm. A former employee should not keep, disclose or use client information merely because they once had access to it.
The Information Commissioner’s Office guidance on access controls recommends that organisations review access regularly and remove it promptly when a person no longer needs it.
Can an Accounting Firm Use AI Tools?
Accounting firms increasingly use AI for research, document review, drafting, data processing and administrative work.
However, staff should not place confidential client information into an AI system without checking whether the firm has approved that use.
Before using an AI tool, the firm should consider:
- where the system stores the information;
- who can access it;
- whether the provider may reuse it;
- whether the system uses information to train a model;
- what contractual safeguards apply;
- whether personal data may leave the UK; and
- how staff check the security and accuracy of the output.
Therefore, an accountant should not treat an AI tool like a private notebook.
ACCA advises firms to carry out proper checks, put contractual protections in place and obtain internal approval before entering confidential information into digital or AI systems.
Can Another Client See Your Information?
No. A firm should not disclose one client’s confidential information to another client.
This remains particularly important when the firm acts for competing businesses or people whose interests conflict.
For example, the firm should not use one client’s pricing, tax strategy or business plans to give another client an unfair advantage.
In some cases, the firm may use separate teams and additional controls to manage a conflict. In others, it may decide that it cannot act for both parties.
What Safeguards Should a Firm Have?
A professional practice should do more than place files behind a password.
Depending on its size and work, appropriate safeguards may include:
- role-based access;
- secure passwords and multi-factor authentication;
- confidentiality policies;
- staff training;
- access logs and monitoring;
- data-protection procedures;
- conflict checks;
- secure document storage;
- controls over outside providers;
- procedures for external disclosures; and
- clear rules for AI and other digital tools.
The precise measures will vary. However, the controls should reflect the sensitivity of the information and the risks involved.
What Can You Ask Your Accountant?
If you feel concerned, you can ask the firm how it handles your information.
Useful questions include:
- Who can access my client file?
- Do you restrict access according to each person’s role?
- Will you share my information with another team?
- Do you use contractors or outside specialists?
- Which systems hold my information?
- Do you use AI tools to process client information?
- Could a provider store my information outside the UK?
- When could you disclose information without asking me?
- How long will you keep my records?
A reputable firm should answer these questions clearly. However, it may not always be able to reveal confidential details about security arrangements or anti-money laundering work.
Who May Access Your Information?
| Person or organisation | May they have access? | Typical reason |
| Your accountant | Yes | Providing the agreed service |
| Supervising partner | Where necessary | Review and quality control |
| Payroll team | Only where relevant | Providing payroll services |
| AML or compliance staff | Where necessary | Meeting legal and regulatory duties |
| Staff with no work-related reason | Access should be restricted | No legitimate need |
| External specialist | Potentially | Providing agreed expert support |
| HMRC | Where authorised or legally required | Tax administration or enforcement |
| Court or regulator | Where legally authorised | Exercising statutory powers |
| Another client | No | Confidentiality must apply |
| Former employee | Not merely because they once had access | Confidentiality continues |
| Technology provider | Depending on the arrangements | Providing an approved service |
What If Someone Accesses Your Information Improperly?
Raise the matter with the accounting firm as soon as possible.
Ask the firm to explain:
- what happened;
- which information someone accessed or disclosed;
- who received or viewed it;
- why the access or disclosure occurred;
- what legal or professional basis applied; and
- what the firm will do to prevent it from happening again.
The firm may also need to follow its personal-data breach procedure. Depending on the level of risk, it may need to notify the Information Commissioner’s Office or the affected individuals.
However, not every internal error meets the legal threshold for regulatory notification. The firm should assess the circumstances and record its decision.
If the firm does not address your concern properly, you may need independent legal advice or guidance from the ICO. You may also be able to complain to the accountant’s professional body.
💡 Key Takeaway
Giving information to an accounting firm does not mean that every employee should have unrestricted access to it.
The people working on your affairs may need to see relevant records. Partners, compliance staff and outside specialists may also need access for a proper reason.
However, the firm should control that access, protect your information and share no more than necessary.
If your tax or financial position is sensitive, you can ask who will see the information, why they need it and what safeguards the firm uses.
Frequently Asked Questions
Can everyone in an accounting firm see my tax return?
No. The firm should normally limit access to people who need the information for a genuine professional, legal or business purpose.
Can my accountant share my information with another employee?
Yes, if that employee needs it to provide a service, supervise work or fulfil a compliance duty. However, the firm’s confidentiality obligations still apply.
Can an accountant give my information to HMRC?
Sometimes. HMRC may receive information with your authority or under its legal powers. The accountant should consider the basis and scope of the request before disclosing information.
Can an accounting firm put my information into an AI tool?
Only after considering confidentiality, data protection, contracts and security. The firm should understand how the tool stores, accesses and uses the information.
Can another client see or use my information?
No. The firm should not disclose your confidential information or use it to give another client an unfair advantage.
Does confidentiality continue after I leave the firm?
Generally, yes. Professional confidentiality can continue after the client relationship ends, although legal or professional exceptions may apply.
Where to Find Official Information
- ACCA Rulebook and Code of Ethics and Conduct
- ICO guidance on organisational access controls
- HMRC: Tax compliance checks
Need Help?
If you have concerns about how an accounting firm is handling your financial information, start by asking the firm to explain its procedures.
At Accounts Tax Group, we handle sensitive UK tax matters, HMRC enquiries and compliance issues with care. We understand that clients need to know who will see their information and why.
If you need help with an HMRC matter, contact us for a confidential, no-obligation conversation.
For regular updates, follow the Accounts Tax Group company page or Sean Davern on LinkedIn.
