Data privacy questions clients ask accountants in the UAE

Federal Decree-Law No. 45 of 2021 is the UAE’s federal personal data protection law. It applies to organisations in the UAE processing personal data, with exclusions including government data, certain health and banking data governed by their own laws, and free zones with their own data protection legislation, such as DIFC and ADGM.

For accounting firms, the practical point is that books contain personal data: employee salaries, customer names and contact details, sometimes Emirates ID or passport copies. Firms should treat that data with the same care as financial figures, and take legal advice on their specific obligations, particularly if they or their clients sit in DIFC or ADGM.

This is the first question, and the honest answer depends on your software. Ask your vendor for its hosting arrangements in writing and give clients the same answer. Do not guess. If you use HelloBooks, ask the team for current hosting and security details and share them as provided.

Some clients, especially in regulated sectors, will have their own requirements. Find out before onboarding rather than after.

Salary data is the most sensitive item in most ledgers. A good answer is specific: only the bookkeeper and reviewing accountant assigned to the client can see payroll accounts, and the owner decides which of their own staff have access.

On HelloBooks, role-based access controls who can view and edit what, with advanced roles and an audit log on the Business plan. Payroll runs in HelloTime with salary journals posting to the ledger, so firms can choose whether staff see individual salaries or only summary journals.

Owners have read about AI tools learning from user data and want reassurance. Answer only with what your vendor has confirmed in its terms and privacy notice. Explain what the AI does: it reads documents and transactions in the client’s books to propose entries, match payments and answer questions about those books.

Explain what a person does: reviews and approves postings, decides what is filed and controls who has access. That framing, AI as an assistant inside the client’s own ledger, is usually what the owner needs to hear.

Clients want to know they can take their records. Your engagement letter should say how data is returned, in what format and within what time. It should also explain that the firm keeps copies it needs for its own professional and statutory obligations.

Record retention matters here. Corporate tax records must be kept for seven years after the end of the tax period, so the business must keep its books accessible long after changing accountant.

Most privacy problems at small firms are mundane: passport copies in shared email inboxes, former staff with active logins, statements on personal laptops.

• Collect documents through your platform, not email attachments.
• Remove access the day a staff member leaves, and review access quarterly.
• Keep a short register of what personal data you hold for each client and why.
• Put a privacy clause in every engagement letter and review it with a lawyer.
• Train staff on what to do if data is sent to the wrong person.

Mistakes happen: a management pack sent to the wrong client, a shared login left active after someone leaves. Have a short incident routine ready. Contain it, record what happened, tell the client honestly and promptly, and take advice on whether any notification is required under the applicable law.

Clients judge firms more on how they handle an incident than on the incident itself. A same-day call explaining what happened and what you changed preserves trust far better than silence discovered later.

Clients rarely leave over a privacy question answered honestly. They leave when answers are vague or turn out wrong. A one-page privacy summary for clients, reviewed by a lawyer and updated yearly, is worth an afternoon. If you need specific access rules configured, for example payroll visible only to named reviewers, the HelloBooks team can help via /book-a-demo.