A privacy policy for a bookkeeping business tells clients and website visitors what personal and financial data the practice collects, why, which tools and people process it, how long it is kept, what rights clients have and whom to contact. It must describe what the practice actually does, not what a template assumes it does.
Does a bookkeeping business need a privacy policy?
Most bookkeeping businesses need a privacy policy, for two reasons. A website with a contact form or client portal collects personal data from visitors, and many privacy laws expect a published notice for that. Separately, bookkeeping is a financial service, so rules on financial privacy may apply when clients are individuals.
In the US, the Gramm-Leach-Bliley Act's privacy rule is the federal starting point. The FTC's guide to complying with the GLBA Privacy Rule lists services offered by accountants and tax preparers among financial activities. It also draws a line that matters for bookkeepers: business clients, including sole proprietorships, are not "consumers" under the rule. The duty to give a privacy notice attaches to individuals who use a service for personal, family or household purposes.
So a practice that serves only businesses may owe little under that rule, while a practice that also does household books or personal tax work may owe a formal notice to those clients. State privacy laws, international laws for overseas clients, and your professional body can add their own requirements. Confirm what applies to you with a lawyer.
Even where no rule demands one, a privacy policy does useful work. It answers the question every new client asks, "what happens to my statements?", in writing. It forces the practice to list its own data flows, which is half the work of securing them. Related security duties, such as having a written security program, come from a separate rule; the post on the FTC Safeguards Rule for bookkeepers covers whether that one applies.
Data collected section of a bookkeeping privacy policy
The data collected section lists every kind of personal information the practice receives, grouped so a client can recognise their own records. For a bookkeeper that goes well beyond names and emails: bank and card statements, payroll records, tax identification numbers, vendor details and anything a client explains in a message.
Start by writing down what actually arrives, client by client, over a normal month. Then group it. A typical list:
- Contact details: names, email addresses, phone numbers, business and mailing addresses.
- Identification numbers: tax IDs for the business and, for sole proprietors, a Social Security number.
- Financial records: bank, card and loan statements, merchant reports, invoices and receipts.
- Payroll data, if you run payroll: employee names, pay rates, bank details and tax withholding.
- Third-party data: details of the client's vendors and customers that appear in their records.
- Website and portal data: form submissions, sign-in records and, if used, analytics cookies.
The third-party line is often forgotten. A client's statements name the people and businesses they pay. Their vendor files may hold those vendors' tax IDs, for instance from forms gathered for year-end reporting; the guide to collecting W-9 forms from vendors shows how much identifying data that process brings in. Your policy should say you hold such data on the client's behalf and use it only for their books.
Say where each kind of data comes from: from the client directly, from their bank or accounting system with their permission, or from your website. Then say why you collect it, in one line per group. "To prepare your books and reports" is a reason. "For business purposes" is not.
Naming the tools that process client data in a privacy policy
A bookkeeping privacy policy should say which kinds of tools process client data and, ideally, name them or point to a list. Clients reasonably want to know whether their statements pass through an accounting system, a document portal, a statement converter, an email provider or an AI tool. Vague wording like "trusted partners" gives them nothing to check.
There are two workable approaches:
- Categories in the policy, names in a list. The policy says "accounting software, document storage, statement conversion and email services", and links to a short list of current providers that you update.
- Names in the policy. Simpler for a small practice with few tools, but every tool change means a policy change.
For each category, the policy should say what the tool does with the data and that it is bound to use the data only to provide its service to you. The FTC guide above notes that sharing with service providers is expected, under a contract that keeps the information confidential. Check that your vendor terms actually say that before you write it.
Be accurate about what each tool does. If your statement converter is AutoBankConvert, for example, you can say that files are encrypted in transit and at rest and that the practice chooses how long originals are kept after export, because the vendor states both. Do not add claims a vendor has not made.
Include people as well as software. Contractors, a virtual assistant or an outsourced team abroad are also "who processes the data". If staff share logins, you cannot say with confidence who accessed what, which makes this section hard to write honestly; the post on shared logins in a bookkeeping firm explains how to move away from them.
Retention terms in a bookkeeping privacy policy
The retention section says how long the practice keeps each kind of record and what happens at the end. It should match your real habits and your tools' settings. A promise to delete statements after a year is worthless if copies sit in email, in a converter's history and on a backup drive for five.
Write retention by record type, not as one number:
| Record | Example retention period | Reason |
|---|---|---|
| Original bank statements | Until export plus a set number of months | Needed to check and correct the books |
| Working papers and reports | Several years after the year they cover | Needed for questions from the client or their tax preparer |
| Payroll records | As long as payroll rules require | Legal record-keeping duties |
| Website form submissions | A short period, unless they become a client | No continuing need |
| Records after the client leaves | Returned or deleted after an agreed period | End of the engagement |
The periods above are examples. Set yours from your legal duties, your insurer's advice and your engagement letters, then configure each tool to match. Say who decides: often the client can ask for earlier deletion of records you are not required to keep.
Also say what deletion means. A practice can delete working files promptly but may keep backups for a while longer before they roll over. State that plainly, rather than promising instant, total deletion.
Client rights and contact details in a privacy policy
The client rights section says what a client or visitor can ask the practice to do with their data, and how. Common requests are a copy of their records, a correction, deletion of what is no longer needed, and a stop to marketing emails. Which rights are legal rights depends on where the client lives, so describe them carefully.
Write it in plain terms:
- How to ask for a copy of the records you hold.
- How to correct details that are wrong.
- How to ask for deletion, and which records you may have to keep anyway.
- How to opt out of newsletters or marketing.
- How long you take to reply.
Then give a real contact. Name a role, such as "the practice owner", and give an email address that someone checks. A small practice does not need a privacy officer title. It needs one person who owns the inbox and answers within the stated time.
Add how to report a suspected problem, such as a misdirected email or a phishing message using your name. Clients who know where to send a concern send it to you first.
Privacy policy promises a bookkeeping business cannot keep
The most common privacy policy mistake is copying a template written for a larger company, then leaving in promises the practice cannot keep. Lines about a dedicated privacy team, round-the-clock monitoring, deletion on request within a day, or never sharing data with anyone are easy to copy and hard to live up to.
A policy that says something untrue can be worse than no policy, because it is a written statement clients relied on. Read every sentence and ask: do we actually do this, every time, for every client?
Promises to remove or rewrite:
- "We never share your data with third parties." Every practice shares data with its software providers. Say who, and why.
- "Your data never leaves our office." Cloud accounting and cloud storage mean it does.
- "All data is deleted when you leave." Payroll and other records may have to be kept. Say which.
- "We use bank-level security." This phrase means nothing specific. Describe what you actually do: encryption, access controls, second-step sign-in.
- "We will notify you within 24 hours of any breach." Commit only to a timeframe you can meet and that fits the law that applies.
A related trap is processing data in ways the policy does not mention. If a client sends a statement that your usual tool cannot read, and a staff member pastes it into a free online converter, the policy's list of tools is now wrong. The post on why a statement is flagged as unsupported explains safer ways to handle those files, which keeps the policy true.
What does a finished bookkeeping privacy policy look like?
A finished bookkeeping privacy policy is usually one to three pages: short sections in a fixed order, each answering one question a client would ask. The outline below gives the order and example wording to adapt. It is a starting point, not legal advice, and a lawyer should review the final text.
- Who we are. "Example Books LLC provides bookkeeping services to small businesses. This policy explains how we handle personal information."
- What we collect. The grouped list from the data collected section, with where each group comes from.
- Why we use it. "We use your records to prepare your books, reports and filings you ask us to prepare, and to communicate with you about that work."
- Who processes it. Tool categories, a link to the current provider list, and a line on staff and contractors.
- How we protect it. Two or three specific measures you really use.
- How long we keep it. The retention table, or a summary with a link.
- Your choices and rights. Copy, correction, deletion, marketing opt-out, and the reply time.
- Website data. Forms, cookies and analytics, if any.
- Changes to this policy. "We will post updates here and tell current clients about material changes."
- Contact. A named role and a monitored email address.
Put the policy on your website footer and link it from your engagement letter. Review it each year, and whenever you add a tool. If you are setting up statement conversion for clients as part of that review, AutoBankConvert shows what the tool does with statements from upload to export, so you can describe it in the policy accurately.