Your engagement letter might already be in breach

Find your standard engagement letter and read the confidentiality clause. It almost certainly says something close to this:

We will keep your affairs confidential and will not disclose information to third parties without your consent.

Now think about who actually touches client data in your firm.

The freelancer in Surrey you bring in every year end. The outsourcing provider you signed up with last quarter. The bookkeeper you hired directly in Manila who logs into your SharePoint every morning and works on the same files as everybody else.

Anyone outside your firm is a third party as far as that clause is concerned. If your letter is silent on any of them, your confidentiality clause is in breach of itself.

This is not a technicality

It would be easy to file this under paperwork. Three things make it more than that.

UK GDPR requires you to say who receives the data. Article 13 obliges you to tell people about the categories of recipients of their personal data. Not the names, but the categories. An outsourcing provider is a category. So is a subcontractor. Silence is not compliance.

Your professional body expects disclosure. Both ICAEW and ACCA are clear that clients should be told when work is outsourced. Their template wording has moved on to reflect it. The trouble is that firms rarely go back and update the letter they are actually sending, so what you send and what your body currently recommends can be years apart without anyone noticing.

Where the person is matters, not where the data is. This is the one that catches firms out, and it is the most important thing in this article.

The bit almost everyone gets wrong

Firms often reason like this: our data is in a UK data centre, our systems are UK-hosted, so nothing is leaving the country and international transfer rules do not apply to us.

The Information Commissioner's position since Schrems II does not work that way. What matters is who has access, and where they are. A person sitting overseas logging into a UK system has been given access to that data, wherever the server happens to sit.

So the offshore bookkeeper working on your UK-hosted files is an international transfer, even though from your side it looks like nothing left the building. It never appears in a log. Nothing is ever emailed anywhere. And it is still a transfer.

That is why "we do not send anything abroad" is not the reassurance firms think it is. Almost nobody sends anything abroad any more. They grant access instead.

Why this has crept up on the profession

Ten years ago outsourcing meant a deliberate arrangement with a named provider, usually signed off carefully, often disclosed properly because it felt like a big step.

Now it is diffuse. A freelancer at year end. A part-time person hired directly through an overseas jobs board. Someone's cousin who does the bookkeeping. A provider you use for two clients only. None of it feels like the sort of decision that requires updating a legal document, so nobody does.

Meanwhile the engagement letter has not been opened since it was set up, and it still promises something the firm no longer does.

What the clause needs to cover

It does not need to be long. One well-constructed paragraph handles it, and it should cover all three cases rather than only the obvious one:

• UK contractors and freelancers - anyone outside the firm who works on client files, even occasionally
• Outsourcing providers - whether onshore or offshore, named by category rather than by company
• Directly employed overseas staff with remote access - the case most letters miss entirely, because it does not feel like outsourcing at all

It should also say the obvious reassuring things, because they are true and clients want to hear them: that you remain responsible for the work, that confidentiality obligations are imposed on anyone who has access, and that you have satisfied yourself about the arrangements.

Most clients do not mind. What they mind is finding out later.

The conversation you avoid by having it in writing

There is a version of this that goes badly, and it is worth picturing.

A client discovers, in passing, that their records are being worked on by someone in another country. They were not told. Their engagement letter, which they may well go and read at that moment, says you would not disclose their information to third parties without consent.

Now you are having a conversation about trust, from behind, with a document in front of them that appears to support their position.

The same fact, disclosed at the start in a paragraph they agreed to, produces no conversation at all. That is the entire value of the clause. Not that it changes what you do, but that it removes the ability for what you do to feel like something concealed.

Where to start

Open your current engagement letter and search it for the words subcontractor, outsourcing and third party. Then ask yourself honestly whether what you find covers everybody who currently has access to client files.

If it does not, that is your afternoon.

In Power Pricing the outsourcing clause is in the template, written to cover UK contractors, overseas providers and remote-access staff in one paragraph, and it can be switched off if none of it applies to you. It is off by default, because plenty of firms genuinely do not outsource and should not be telling clients they might. When the guidance moves, the template moves.

Your professional body also publishes a helpsheet on outsourcing, which is worth reading if you want the full picture rather than the practical summary above. But do the search on your own letter first. It takes two minutes and it usually settles the question.