Data Protection & Governance

Conservative Security Controls for Complete Client Confidentiality

Your clients trust you with confidential financial records. Our operating model is designed to support UK GDPR-compliant outsourcing arrangements through physical, technological, and contractual safeguards.

Compliance Notice: Our operating model is designed to support UK GDPR-compliant outsourcing arrangements, subject to each client’s specific legal and compliance requirements. Final contractual and international-transfer arrangements should be agreed between the parties and reviewed by qualified legal/data-protection professionals where required. Ferret BizServe does not provide legal advice.

Technical & Operational Safeguards

Practical Security Controls in Everyday Operation

We avoid ambiguous claims. Here are the concrete, day-to-day controls enforced across our production facilities:

Remote Cloud Access Only

We log directly into your authorized cloud software (Xero, QBO, TaxCalc Cloud) or practice-hosted virtual server (RDS). Client accounting databases remain stored on your cloud infrastructure.

Zero local database persistence

Company-Controlled Hardware

Production staff operate exclusively on centrally managed, encrypted company laptops with remote-wipe capabilities, enforced antivirus, and automatic software patch management.

Zero BYOD / personal machines

Enforced Multi-Factor Authentication (MFA)

All system credentials are authenticated via enterprise password management with mandatory hardware or app-based 2FA. Individual named accounts are used; credentials are never shared.

Strict password governance

Restricted Removable Storage

USB mass-storage and external media ports are administratively disabled on production machines to prevent unauthorized local copying or downloading of client documentation.

Hardware port lockdown

No Unsecured Messaging of Client Data

Client financial documents are never transmitted over WhatsApp, personal email, or unsecured consumer channels. All file transfers occur inside your practice portal or client portal.

Zero WhatsApp usage

Immediate Access Termination Protocol

Documented HR offboarding procedure guarantees that all system access, portal logins, and VPN tokens are revoked within 60 minutes of staff departure or role reassignment.

60-minute deprovisioning SLA

Cross-Border Compliance

UK–India International Data Processing Framework

Under UK GDPR, access to UK personal data from India constitutes a restricted international transfer. We put formal legal safeguards in place to ensure compliance:

Data Processing Agreement (DPA)

Article 28 compliant processing contract defining processor obligations, security measures, subprocessor restrictions, and UK practice audit rights.

UK IDTA / ICO Addendum

Implementation of the ICO-approved International Data Transfer Agreement (IDTA) or UK Addendum to provide appropriate safeguards for cross-border data transfer.

Transfer Risk Assessment (TRA)

Documented assessment evaluating destination country legal frameworks, local access risks, and compensating technical controls.

Download our Practice Due Diligence Checklist

Review 24 practical questions regarding UK GDPR, software security, and contracts before sharing client files.

View Due Diligence Checklist →