The Regulator's Information Request
A small accountancy practice prepares accounts and tax returns for 60 local clients. A regulator has written to the practice requesting information about one client, a construction firm, as part of a routine compliance review of the sector. The practice partner, Sam, is unsure what to disclose. The client has not been told about the request. Separately, Sam has discovered that a member of staff, without authorisation, emailed a client's bank statements to a personal email address 'to work on them at home'. The practice is not currently registered for any voluntary quality scheme, and Sam is unsure what professional obligations apply to the practice's handling of client data and regulator requests.
1. Explain the professional and regulatory considerations Sam must weigh when responding to the regulator's request for client information.
Read the worked answer
Sam must balance several obligations:
Confidentiality: Client information is confidential and should not be disclosed without authority. However, confidentiality is not absolute - it is overridden where there is a legal or regulatory duty to disclose, or where disclosure is in the public interest (e.g. suspected money laundering).
Legal/regulatory obligation: If the regulator has a statutory power to require the information, the practice must comply. Sam should check the legal basis of the request - is it a voluntary request or a statutory demand? The response differs: a statutory demand must be met; a voluntary request can be discussed with the client first.
Client communication: Where lawful, Sam should inform the client of the request and seek consent, unless doing so would breach a legal restriction (e.g. a tipping-off prohibition). Transparency builds trust.
Data protection: Any disclosure must be limited to what is requested (data minimisation) and handled securely.
Judgement: Sam should establish the legal basis, disclose only what is required, and communicate with the client where permitted - rather than either refusing outright or disclosing everything without thought.
2. Assess the staff member's action of emailing client bank statements to a personal address, and recommend what Sam should do about it.
Read the worked answer
Assessment: Emailing client bank statements to a personal email address is a serious breach. Bank statements are sensitive personal and financial data. Sending them outside the practice's controlled systems:
- breaches confidentiality and data protection obligations;
- removes the data from the practice's security controls (no audit trail, risk of loss or interception);
- was done without authorisation, so it is also a breach of internal policy and of the employee's professional obligations (integrity and professional behaviour).
Recommended actions:
- Establish the facts: what was sent, to whom, whether it has been deleted, and whether any third party accessed it.
- Contain the breach: require deletion from the personal account and confirm in writing; retrieve or destroy copies.
- Assess whether it is a reportable data breach under data protection rules, and notify the client and regulator if required.
- Address the conduct through the disciplinary process, and retrain staff on data handling.
- Review controls - e.g. prohibit personal email for client data and provide secure remote access.
Judgement: The priority is containment and client protection first, then accountability and prevention, not punishment alone.