Privacy Policy

Institute of Accountants and Bookkeepers
General Privacy Notice

1. Regulatory Requirements

1.1 To ensure transparency and accountability Articles 12 and 13 UK GDPR Data Protection Act 2018, require that organisations publish a ‘privacy notice’ that informs people about how their personal data is collected, used, stored, and shared by the organisation.

1.2 The privacy notice covers the types of data collected, the purposes of processing the data, the legal bases for processing, data sharing practices, retention periods, and individuals’ rights in relation to their data.

2. Purpose

2.1 This document serves as a privacy notice fulfilling the IAB data protection responsibilities.

2.2 The purpose of this privacy notice is to explain how the Institute of Accountants and Bookkeepers (the IAB) processes personal data.

3. Operation

3.1 Under data protection legislation the IAB is a ‘data controller.’ This means the IAB determine the purpose and use of the personal data being processed.

3.2 It is the responsibility of the IAB Privacy Manager (PM) to ensure the processing of personal data is in accordance with UK data protection legislation.

3.3 The IAB PM is contactable using hello@iab.org.uk.

3.4 The personal data collected by the IAB will be contact details sufficient to be able to respond to general enquiries, for marketing purposes and, where relevant, to administer membership, and to enable a member’s CPD record to be maintained by the IAB’s CPD platform provider. Where a member evidences, via our CPD platform provider or another verifiable source, and sends details of completed CPD activity (such as training completed and points logged) back to IAB, we hold these in our CRM system as part of your membership record.

3.5 The IAB duty of confidentiality means that IAB staff will treat personal data with due respect and confidence. It is only disclosed to others when absolutely required.

3.6 The IAB use reasonable organisational and technical measures to ensure personal data is kept secure.

3.7 The IAB also expects the same duty of confidentiality of all third parties with whom personal data is shared.

3.8 All processing takes place at on-site and/or agreed off-site locations, all within the UK, with routine backups performed on UK and EU based servers.

3.9 Personal data is processed by the IAB in accordance with the principles of data protection and always against lawful bases such as:

1. When processing is necessary for the purposes of our legitimate interests or for the legitimate interests of third parties
2. For the purpose of disclosing data to a third party, in response to a valid request, the IAB may apply a ‘recognised’ legitimate interest
3. When the IAB assess that there is a public interest to do so, such as publishing the findings of the IAB Adjudication Panel on our website
4. To comply with the IAB’s legal obligations
5. Where the IAB have a contractual arrangement with a person to administer membership, to administer membership, including assessing whether a member has met their CPD requirement (whether evidenced via our CPD platform provider or another verifiable source) in order to determine continued membership eligibility.
6. When processing personal data for a pre-defined purpose. (The IAB will seek prior consent before processing commences and such consent may be withdrawn at any time by contacting the IAB PM)

3.10 The IAB will share personal data, including with:

1. Administrative support staff bound by a data processing agreement and/or contractual arrangements.
2. Other organisations that provide services directly to members, such as CPD platform providers, who may act as independent controllers of the data they receive.
3. Appointed contractors for specific outsourced services who are subject to a data processing agreement or equivalent as bound by their contracts
4. Professional bodies
5. Law enforcement agencies
6. Public authorities, including regulators
7. HMRC

3.11 These organisations are reviewed regularly, and the number is kept to a minimum.

4. Retention

4.1 The IAB follows a retention schedule to determine the length of time different types of personal data are held. The key retention periods are:

1. Routine correspondence for casual enquiries in hard copy or in emails will be stored for 7 years after the last interaction with the IAB.
2. Routine correspondence relating to payments will be retained for 6 years starting at the end of the tax year in which this personal data was collected.
3. Contact data is stored indefinitely unless a valid request to erasure has been received, in which case it will be given due consideration.

4.2 At the end of the retention period, and where the IAB has no lawful basis to justify retention, the IAB will destroy or delete personal data together with any associated emails or relevant documentation.

4.3 The IAB allows up to three months after the retention period has ended to complete this action.

4.4 If it is technically impractical to delete electronic copies of personal data, it will be put beyond operational use.

5. Data Subject Rights

5.1 Although not all rights are applicable in all situations; UK data protection legislation sets out the following rights of data subjects in relation to their personal data:

1. The right to be informed as to how personal data are being processed – this is done through this notice.
2. The right to access personal data held by the IAB; this is done by submitting a ‘Subject Access Request’ (SAR) to the IAB privacy manager.
3. The right to rectification of personal data if the IAB has collected it incorrectly or it needs to be updated.
4. The right to the erasure of personal data for which the IAB no longer have a legitimate purpose to process.
5. The right to restrict processing under certain circumstances, during which personal data will be taken out of operational use until the matter is resolved.
6. The right to data portability of personal data in a machine-readable version, however this applies only to data provided with consent or under contract.
7. The right to object to processing personal data for which the IAB does not have a legal or contractual obligation.
8. The right to complain about the way the IAB has processed personal data.
9. Rights related to automated decision making and profiling. (however, the IAB does not use these techniques in its decision making)

5.2 Further details about all these rights can be found on the Information Commissioner’s Office (ICO) website: https://ico.org.uk.

6. Concerns and Enquiries

6.1 Raising concerns, exercising rights, or making queries about IAB processing of personal data can be done by contacting the IAB PM.

6.2 It is important to note the IAB will need to verify a requester/enquirer’s identity before responding fully. For that reason, proof of identification may be required that, in context, will enable the IAB to confirm identity.

6.3 Alternatively, enquirers may contact the ICO directly. However, the ICO is likely to refer the matter back to the enquirer if the matter has not been addressed with the IAB beforehand.

Last updated: September 2026