GDPR Compliance for Client Correspondence

When a letter arrives at your registered office address addressed to a client company, it seems straightforward enough — open it, notify the client, file it away. But under UK GDPR, each of those steps involves the processing of personal data, and that processing must be lawful, purposeful, and properly managed. For accountancy practices offering registered office services, the obligations are more involved than most firms realise.

This guide sets out the key UK GDPR requirements that apply when your firm handles client correspondence, and gives practical steps for building a compliant process.

Why Registered Office Mail Is a UK GDPR Matter

UK GDPR applies to the processing of personal data — which includes any information relating to an identified or identifiable natural person. Most correspondence arriving at your registered office address will contain personal data of some description: a director's name, an employee's National Insurance number on a PAYE notice, a shareholder's details on a Companies House filing, or the personal details of a customer in a court document.

As the firm handling this data, you are acting as a data controller in relation to the client company's correspondence, and potentially as a data processor if you are handling it on behalf of the client in accordance with their instructions. Either way, you have obligations under the UK GDPR (retained in UK law following Brexit via the Data Protection Act 2018) and are subject to oversight by the Information Commissioner's Office (ICO).

Establishing a Lawful Basis for Processing

The first question to address is your lawful basis for processing the personal data contained in client mail. For most practices, the most appropriate basis will be legitimate interests — you have a legitimate business interest in handling the correspondence of the companies for which you provide a registered office service, and that interest is unlikely to be overridden by the interests of the data subjects concerned.

However, legitimate interests requires you to carry out a Legitimate Interests Assessment (LIA) documenting why you believe your interests are proportionate. Alternatively, where you are processing data on behalf of your client under a formal service agreement, contract performance or legal obligation may also apply.

Crucially, you must document your lawful basis. The ICO can request this documentation, and the absence of it — even if your processing is otherwise reasonable — is itself a compliance failure.

Privacy Notices and Transparency

Data subjects — the individuals whose personal data appears in the correspondence — are entitled to know that their data is being processed. Typically, this obligation is discharged by your client company in their own privacy notice. However, you should satisfy yourself that your service agreement with the client makes clear that you will be processing correspondence on their behalf, and that the client is responsible for ensuring their own privacy notice covers this.

Your firm's privacy notice should also reference the fact that you provide registered office services and may process correspondence on behalf of client companies. This is particularly important if a data subject ever exercises their rights directly with your firm rather than through the client company.

Data Minimisation and Access Controls

UK GDPR's data minimisation principle requires that you collect and hold only the personal data that is necessary for your stated purpose. In the context of registered office mail, this means:

• You should not retain correspondence longer than is necessary for the purpose for which you processed it
• Access to scanned or stored correspondence should be limited to those within your firm who need it
• You should not forward correspondence to third parties without a legitimate reason and appropriate controls

In practice, this means your document management or practice management system needs role-based access controls. Not everyone in the firm should be able to browse all registered office correspondence — access should be restricted to those handling the relevant client account.

Retention Periods

One of the most commonly overlooked obligations is the requirement to have a defined retention policy for client correspondence. UK GDPR does not specify fixed retention periods for most categories of data, but it does require that data is not retained longer than necessary.

For registered office mail, a reasonable retention framework might look like this:

• HMRC correspondence: Retain for at least six years to align with HMRC's standard enquiry window. For VAT purposes, this may extend to the date of the assessment plus four years.
• Companies House correspondence: Retain for the duration of the service plus a reasonable period thereafter — typically two years after the registered office service ends.
• Legal correspondence and court documents: Retain in line with the relevant limitation period, which under the Limitation Act 1980 is typically six years for contract matters and twelve years for matters under deed.
• Routine correspondence: Review annually and delete when no longer needed.

Whatever periods you choose, document them in a formal retention policy and enforce them. Periodic deletion of data is not just good practice under UK GDPR — it also reduces your firm's exposure in the event of a data breach.

Handling Subject Access Requests

Under UK GDPR, individuals have the right to request access to their personal data — a Subject Access Request (SAR). If a director whose details appear in correspondence processed by your firm submits a SAR, you have one month to respond (extendable by a further two months in complex cases).

This means you need to be able to locate all personal data relating to an individual across your systems, including scanned correspondence. Practices that store correspondence in unindexed PDF archives or physical filing systems will find this extremely difficult in practice. A searchable, well-organised document management system is not just convenient — it is a compliance necessity.

It is also worth noting that a SAR to your firm may be separate from a SAR to the client company. You should have a clear process for handling SARs that arrive at your firm directly, and ensure your staff know how to escalate them appropriately.

Data Breach Obligations

If personal data contained in client correspondence is lost, accessed without authorisation, or accidentally disclosed, you may have a notifiable data breach. Under UK GDPR, personal data breaches that are likely to result in a risk to individuals' rights and freedoms must be reported to the ICO within 72 hours of you becoming aware of the breach.

Common scenarios that can give rise to breaches in the context of registered office mail include:

• Correspondence forwarded to the wrong client by mistake
• Scanned documents stored in a shared folder that is not properly access-controlled
• A lost or stolen laptop containing downloaded client correspondence
• A disgruntled employee accessing correspondence they are not authorised to see

Having a documented breach response procedure — including who is responsible for assessing and reporting breaches, and how affected individuals will be notified — is an ICO requirement, not an optional extra.

Transfers Outside the UK

If your firm uses cloud-based document management or practice management software, check where your data is hosted. Post-Brexit, transferring personal data outside the UK requires either an adequacy decision, standard contractual clauses, or another transfer mechanism recognised under UK GDPR. Most reputable UK-focused software providers will offer UK-hosted options or have appropriate transfer mechanisms in place, but you should verify this — not assume it.

Practical Steps for Compliance

Bringing your registered office mail processing into line with UK GDPR does not have to be an overwhelming project. Start with these steps:

• Document your processing activities. Add registered office mail to your Record of Processing Activities (ROPA), noting the categories of data, the lawful basis, and the retention period.
• Review your service agreements. Ensure your registered office service agreement includes appropriate data processing clauses, making clear who is responsible for what.
• Implement access controls. Restrict access to stored correspondence to those who need it.
• Create a retention schedule. Define how long each category of correspondence will be kept and build a process for periodic deletion.
• Train your staff. Ensure everyone who handles registered office mail understands their UK GDPR obligations, including how to recognise and escalate a potential data breach.
• Check your software. Verify that any third-party tools you use to store or transmit correspondence have appropriate data processing agreements in place.

The ICO's website contains detailed guidance on all of these areas, and their self-assessment tools are a useful starting point for smaller practices. Registered office mail may feel like a peripheral concern, but the personal data it contains deserves the same care and rigour as any other category of client data your firm processes.