do I need to conclude a processor agreement with my accountant
Yes, in most cases that is necessary
An accountant who processes personal data on behalf of a business — think of payroll administration, customer data in invoices, or employee data — usually does so as a processor. This means there must be a processor agreement between the business and the accountant, regardless of whether the accountant is self-employed or works for a firm. The obligation does not depend on whether it is a "large" or "small" client, but on the role the accountant actually plays: processing data on behalf of, and according to the instructions of, the business that manages the customer or employee data.
There is an exception that is often overlooked in practice: if the accountant independently determines why and how data is processed — for example because he has own responsibility for the tax authorities or another statutory task — he may be a controller himself for that part, and a processor agreement is then not the right instrument. Which role precisely applies depends on who actually determines the purposes and means of the processing; this varies per situation and is described in the explanation of processor or controller. What must be included in such an agreement can be found in the overview of mandatory elements of a processor agreement.
Where this follows from: Article 4 and 28 GDPR
Article 4 of the GDPR defines the processor as the person who processes personal data on behalf of the controller, and Article 28 of the GDPR determines that such processing must be documented in an agreement with a fixed set of elements. The EDPB guidelines elaborate further on when someone qualifies as a processor and when as an independent controller, which for an accountant — who sometimes follows instructions and sometimes has an independent statutory role — makes the distinction decisive.
What this is based on
- Article 4 GDPR — the definitions
- Article 28 GDPR — the role of the processor
- European Data Protection Board — guidelines
The regulation itself is on EUR-Lex. We refer per statement; you do not need to believe us.
What you need to do in practice
The implementation for each obligation, including the deadlines involved and the templates to document it, is included in the subscription.
View the subscription Start with the free quick scanThis is not legal advice. This page provides general information about the regulation that this platform is about. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a person on 2026-09-05. Is something not right? Let us know — corrections take priority.