GDPR checklist for accounting tools.
Accounting tools hold invoices and payment records that name customers, suppliers and sometimes staff. Compare 3 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Xero | Usually a processor | Set per account or project | Published by the vendor |
 Zoho Books | Usually a processor | Set per account or project | Obtained through the vendor |
 Bill.com | Depends on the activity | Set per account or project | Published by the vendor |
What to check for accounting tools
- Limit access to people who need the books, and review it when someone leaves.
- Agree how long invoices are kept: accounting law often sets a minimum.
- Check the region and any transfer outside the EEA.
- Record whether your accountant also has access, as a separate recipient.
All accounting tools
Questions, answered.
What should I check before using an accounting tool under the GDPR?
Limit access to people who need the books, and review it when someone leaves. Agree how long invoices are kept: accounting law often sets a minimum. Check the region and any transfer outside the EEA. Record whether your accountant also has access, as a separate recipient.
Do I need a data processing agreement with an accounting provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which accounting tools does Privacyboard cover?
Xero, Zoho Books, Bill.com. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.