Data security policy
Minimum rule set for an accounting firm
Rules
1.
Database access
Named accounts, role-based rights, 2FA; revoke on offboarding same day.
2.
Document transfer
EDI or secure portal; no unencrypted email for financial documents.
3.
Backups
Daily backups, quarterly restore test, separate offline medium.
4.
Personal data
GDPR: DPA with client, processing register, retention periods.
5.
Offboarding
Database handover in standard format, confirmation of copy deletion.
6.
Incidents
Client notification within 72h of breach (GDPR Art.33).
An accounting firm is a data processor for clients' personal data. Mandatory: DPA, named access, action logs, incident protocol.