Playbook, accounting firm
Why a practice cannot agree to erase a client file
Somebody asking a practice to delete everything usually has a mailing list and a mobile number in mind. What sits behind the request is a set of records the practice is required to hold for a defined period, including the identity evidence it gathered before it could act at all, and that is kept precisely because the relationship has ended. None of this is a refusal worth improvising.
Why this is not the general answer
The handling pattern for data deletion requests holds across every trade. What follows is the part that does not.
- The identity and verification evidence a practice collected before it could begin work is retained for a period running from the end of the engagement, so leaving the practice starts a clock rather than stopping one.
- Working papers are the practice's own records rather than the client's, which makes hand everything over and delete the rest two requests, and only one of them is about personal data at all.
- The material a client wants gone is often the same material the practice would rely on if a filing were ever questioned, so a deletion request arriving next to a fee dispute or a penalty notice is a different message from the same words sent in a quiet month.
- Withdrawing the authority for the practice to act as agent is a separate act from deleting anything, and clients routinely ask for one while meaning the other, so a reply that answers only the deletion half leaves somebody still authorised.
How it arrives
- delete all my data now that i have left
- how long do you keep client records
- can you send me everything you hold about me
- i have moved accountant please remove my file
- can i take my bookkeeping records with me
- who do i send a data request to
What has to be indexed for this to work
| Your retention schedule, with the event each period runs from | How long each kind of record is held and whether the clock starts at the last piece of work or at the end of the engagement. A period quoted without its starting point reads as an excuse rather than as a rule. |
|---|---|
| What counts as your working papers | Schedules, reconciliations, review notes and the correspondence created in doing the work. Clients assume everything in the file is theirs, and drawing the line in advance prevents the argument at the point somebody leaves. |
| The identity and verification records you have to keep | Why they exist, how long they stay, and that they are held for the practice's own obligations rather than for marketing. This is the part of the refusal people accept once it is explained and resent when it is not. |
| How a request is made and who receives it | The address or form, what to include so it can be matched to the right client, and the response period you publish. Route it somewhere read daily, because the clock runs whether or not the message was opened. |
The reply
We cannot delete a client file on request. A practice has to keep certain records for a set period, and the identity evidence we took before we could act for you is kept for a period that runs from the end of the engagement rather than from your last piece of work [1]. Our privacy notice sets out what is held and for how long [2]. Contact preferences are a separate matter and can be looked at. I cannot change anything from here, so leave me your name and an email and it goes to the person who handles these.
It refuses in the opening line rather than working up to it, because a request answered with a description of a process reads as evasion. Naming the record that surprises people, the identity evidence, is what turns the refusal into something a client can accept. It then offers the part that genuinely can move, and says plainly that nothing here alters a record.
Where it stops
The trigger. Any message asking for deletion or erasure, any request for a copy of a file, and anything asking the practice to stop acting or to release records to another firm.
This is a request rather than a question, so I am passing it to the person who deals with them. Leave me your name, an email and what you are asking for, and you will get a reply within the period our privacy notice sets out.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never confirm that anything has been deleted or removed, since nothing here writes to any record.
- Never state a retention period the practice has not published, because these differ by record type and get quoted back later.
- Never confirm whether a named person or business is or was a client of the practice.
- Never agree that leaving the practice ends its obligation to hold identity records, however reasonable the request sounds.
Questions
- A client says we have no right to keep anything. What should it say?
- That the records are held under obligations the practice is subject to, that the detail is in the privacy notice, and then hand it over. Arguing the point in a chat window is how a data request becomes a complaint about the handling of a data request.
- Can it at least remove somebody from a mailing list?
- No. It cannot write anywhere at all. It collects a name, an email and a message which is sent to the address you nominate and stored, so the request survives an email failing, which matters when a response period is attached to it.
- Does a request to hand records over go the same way?
- To the same person, but it is a different request and worth naming as one. What a departing client is entitled to receive and what the practice produced in doing the work are not the same set of documents.
Keep reading
- Everything for a accounting firmDeadlines drive the volume. What an accountancy practice can automate, and why no answer may touch a caller's own numbers.
- Handling data deletion requests in generalA deletion request is a request with a clock on it, not a question. The characteristic failure is silence, so it always has to reach a person.
- The client who wants to stop paying with the accounts half draftedNotice, the annual fee spread across twelve payments, and the handover to the next firm. What can be explained and what cannot be ended here.
- A client wants their fees back after the work has startedThere is nothing to send back and the work is partly done. Why a fee refund at a practice is a scope conversation, not a returns one.
- Publishing hours when the working week changes with the calendarReception hours are the easy half. What to publish about the weeks nobody can come to the phone and the payroll cut off that never moves.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.