GDPR taloushallinnossa: henkilötiedot, oikeusperuste ja rekisteriseloste
Taloushallinto käsittelee väistämättä henkilötietoja: asiakkaiden nimiä, osoitteita ja pankkitilinumeroita. Käymme läpi, mitä pienyrityksen taloushallinnon on otettava huomioon GDPR:n kannalta.
"Financial management inevitably processes personal data: customer names, addresses, bank account numbers, and payroll data. The EU's General Data Protection Regulation (GDPR) sets clear requirements for the processing of this data. In this article, we will go through what small business financial administration needs to consider."
"Personal data in financial administration – what is it?"
"According to GDPR, personal data is any information relating to an identified or identifiable natural person. In financial management, typical personal data includes:"
- "Names, addresses, and business IDs of customers and suppliers (for sole proprietorships)"
- "Bank account numbers"
- "Email addresses and phone numbers of invoice contact persons"
- "Payroll data and personal identity codes (payroll)"
- "Travel and expense report details"
Base jurídica para o tratamento de dados pessoais
"GDPR requires that there is a legal basis for every processing of personal data. In financial administration, the following are generally used:"
- "Performance of a contract: sending invoices and receiving payments"
- "Obrigação legal: obrigações de conservação previstas na legislação contabilística, declaração fiscal"
- "Legitimate interest: debt collection, credit risk assessment"
For a small business, this means in practice: you have the right to process your customer's data for invoicing and accounting purposes without separate consent, because the processing is based on a contract and law.
Prazos de conservação dos documentos de gestão financeira
GDPR requires that data not be kept longer than necessary. In financial administration, retention periods are determined primarily by accounting law:
| Asiakirjatyyppi | Säilytysaika | Peruste |
|---|---|---|
| Kirjanpitokirjat (tase, tuloslaskelma, pääkirja) | 10 vuotta tilikauden päättymisestä | Kirjanpitolaki 2:10 |
| Tositteet (laskut, kuitit) | 6 vuotta tilikauden päättymisestä | Kirjanpitolaki 2:10 |
| Palkka-aineistot | 10 vuotta | Ennakkoperintälaki, eläkelait |
| ALV-aineisto | 6 vuotta | Arvonlisäverolaki |
When the statutory retention period ends, personal data must be deleted or anonymized.
Mini-checklist for a small business
- Create a privacy policy (data protection statement) where you explain what personal data you process and why
- Define retention periods by document type
- Ensure that your financial management software (e.g. Eemel Accounting) is GDPR-compliant
- Limit access to personal data only to those who need it
- Agree on a data processing agreement with the accounting firm and other processors
- Delete outdated information regularly
Practical example: sole proprietor and privacy policy
A sole proprietor kept a customer register in Excel and invoiced with PDF invoices. From a GDPR perspective, the situation was problematic: no privacy policy, no data security, no monitoring of retention periods.
Adopting Eemel Accounting solved most of the problems:
- Customer data is in a protected system, not an open Excel file
- Access is restricted by username and password
- The financial management software provides a basis for a privacy policy
- Old data can be systematically deleted
Try it in practice
Eemel Accounting is designed with GDPR requirements in mind. Personal data is secure and processing is under control.
Try 14 daysFrequently asked questions
Does a small business need a privacy policy?
Yes, if you process personal data (e.g., customer names and addresses for invoicing). A privacy policy must be available.
Can accounting material be deleted based on GDPR?
Not before the statutory retention period expires. Accounting law takes precedence over GDPR here.
Is a data processing agreement required with an accounting firm?
Yes. The accounting firm processes personal data on your behalf, so GDPR requires a written agreement.
How does GDPR affect bank connections?
Account transactions retrieved through a bank connection contain personal data. Processing is based on a contract and law. Leia mais in our PSD2 article.
Do you need to ask for customer consent to process billing information?
Not usually. The processing of billing information is based on fulfilling a contract, not on consent.
This article is general in nature and does not constitute legal advice.