GDPR and collecting client documents: who answers for what.

When you collect documents from clients, UK GDPR applies to almost every file you receive. Passports, bank statements, payslips and tax records are all personal data. GDPR and document collection come down to a few plain questions: who's responsible, why you're asking, what you ask for, how you protect it and when you delete it.

This guide answers each one in plain words, with a link to the ICO's guidance for every point. It's written for UK firms of any kind, and it's general information, not legal advice.

Who's the controller under GDPR: your firm or your tools?

UK GDPR splits responsibility between two roles. The ICO's guidance on controllers and processors defines them like this:

• The controller decides why and how personal data is processed. It's responsible for complying with UK GDPR and must be able to show it does.
• The processor processes personal data on the controller's behalf, only on its instructions. It has more limited responsibilities.

In practice, your firm is the controller for the documents it asks clients for. You decide what to collect, from whom and why. The tools you use to collect, store and send them are usually processors: your email provider, your cloud storage and any upload tool.

The ICO gives an example that fits most professional firms. An accountant doing a client's books is a controller in their own right, because professional obligations make them responsible for the personal data. It says specialist service providers acting under their own professional obligations will always be controllers.

That means using a tool never hands your responsibility to someone else. If a tool loses a file, the client's question is still for you.

Your lawful basis for asking for documents

You need a lawful basis before you collect personal data. The ICO's guide to lawful basis lists seven, including contract, legal obligation and legitimate interests. No one basis is better than the others: the right one depends on your purpose and your relationship with the person.

For a firm collecting client documents, a few points from that guide matter most:

• Decide it first and write it down. You must choose your basis before you start and record it. You shouldn't swap to another basis later without good reason.
• "Necessary" has a meaning. Most bases need the processing to be necessary. The ICO says that's more than useful and more than standard practice. If you can reasonably do the job with less personal data, the basis won't apply.
• Tell people. Your privacy information must say what your basis is and what you use the documents for.
• Some data needs more. Special category data, such as health information, and criminal offence data each need an extra condition on top of a lawful basis.

The basis can differ from one document to the next. A bank statement for a tax return and a passport for anti-money laundering checks may sit on different bases, so record each purpose.

Ask only for what you need

The data minimisation principle says personal data must be adequate, relevant and limited to what's necessary. The ICO's guidance on data minimisation puts it simply: hold the minimum you need for your purpose, and no more.

Document requests are where most firms collect too much. A vague "send us everything" brings in files you never use, and each one is personal data you now have to protect.

A checklist per job and per type of client helps, because it makes you decide in advance:

• Name each document. "Bank statements for April 2025 to March 2026" brings in what you need. "Your bank statements" brings in years of them.
• Cut what you don't use. Review last year's list. If nobody opened a document, stop asking for it.
• Tailor per client. Remove items that don't apply before you send, rather than asking every client for everything.
• Ask for less sensitive versions. If the last four digits of an account will do, say so.

Keep documents secure

UK GDPR's security principle says you must use appropriate technical and organisational measures. The ICO's guide to data security says they must be appropriate to your circumstances and the risk, and should include measures such as encryption where appropriate. These requirements apply to processors too.

For collected documents, the risky moments are predictable:

• Arrival. Attachments sit in several mailboxes and are easy to forward or send to the wrong person.
• Storage. Files in shared folders are often open to the whole firm, or to anyone with a link.
• Access. Old team members, shared logins and personal devices all widen who can open a file.
• Leaving. Downloads and copies spread unless you know where each file should live.

Choose a collection route that keeps files out of inboxes, limits who can open them and records who did. Why you should stop collecting documents by email covers the email risks in more detail.

Don't keep them longer than you need

The storage limitation principle says you must not keep personal data longer than you need it. The ICO's guidance on storage limitation expects you to justify each period, set standard periods in a policy where you can, and erase or anonymise what you no longer need.

For document collection, that means two decisions. How long you keep the records you file, and how soon you delete the working copies left where documents arrived. How long should you keep client documents? covers the periods the rules set and gives a policy outline.

What to ask any tool you use

Each tool that processes client documents for you is a processor, so UK GDPR asks two things of your firm. The ICO's guidance on what it means to be a controller says you can only use processors that give sufficient guarantees, and you must have a binding contract with each one.

The processor agreement

Article 28(3) sets out what the contract must contain. The ICO's page on what needs to be included in the contract lists:

• the subject matter, duration, nature and purpose of the processing
• the types of personal data and who it's about
• processing only on your documented instructions
• a duty of confidence for the people handling it
• appropriate security measures
• rules on using sub-processors
• help with data subject rights and your other obligations
• deletion or return of the data at the end
• audits and inspections

Most tools publish this as a data processing agreement, or DPA. If a tool that handles client documents doesn't have one, ask for it before you use it.

Subprocessors

Tools rely on other companies too: hosting, storage and email delivery. The ICO says a processor mustn't use a sub-processor without the controller's prior specific or general written authorisation, and must pass on equivalent protections (what it means to be a processor).

Before you sign up, ask any tool:

• Where's your DPA, and does it cover the Article 28 terms?
• Which subprocessors do you use, for what, and where do they process data?
• How will you tell us before you add or change one, and can we object?
• How do you protect files in storage, in transit and when they're downloaded?
• How long do you keep files, and can we change that and delete early?
• How quickly will you tell us about a breach, and how?
• How do we get everything out, in one go?

Your clients' rights

Your clients have rights over the documents they send you. The ICO's guide to individual rights covers each one:

• To be informed about how you use their data.
• Of access to a copy of their data.
• To rectification of inaccurate or incomplete data.
• To erasure, in some circumstances.
• To restrict processing.
• To data portability.
• To object, in some circumstances.
• Rights related to automated decision-making, including profiling.

The right of access is the one firms meet most. The ICO's guide to subject access says you must respond without undue delay and within one month, and can't charge a fee in most cases. You can extend by up to two more months if the request is complex.

Whether each right applies can depend on your lawful basis. The lawful basis guide has a table: for example, the right to erasure doesn't apply where you rely on legal obligation.

Answering quickly is easier when you know where each client's documents are. Every copy left in an inbox or a download folder is one more place to search.

How to do this in GarnerDocs

Your firm stays the controller. GarnerDocs is a processor that collects documents on your instructions.

• A data processing agreement. Our Data Processing Agreement sets out the roles, the instructions we follow, confidentiality, security, subprocessors, help with your clients' requests, deletion, breach notification and audits.
• A published subprocessor list. Our subprocessors names each company, what it does, the data it processes and where. We'll tell firms before we add or replace one, so you can object.
• Security you can check. Files are stored privately and download only through a short-lived link after a permission check. GarnerDocs scans each upload for malware and blocks a file until the scan is clean, but no scanner catches everything, so treat files like any email attachment. You can add a PIN to sensitive requests and require two-factor authentication for your team. Our Security page has the details.
• Only what you list. Each request is a checklist you build from a template or from scratch, and you can remove items per client before you send.
• A retention period you choose. Files are deleted 30, 90, 180 or 365 days after a request is completed, after email warnings 14 and 3 days before. You can download everything as a ZIP or delete files early.

See How long files are kept.

Sources

• What are 'controllers' and 'processors'?, ICO. Checked on 21 October 2026.
• What does it mean if you are a controller?, ICO. Checked on 21 October 2026.
• What does it mean if you are a processor?, ICO. Checked on 21 October 2026.
• A guide to lawful basis, ICO. Checked on 21 October 2026.
• Principle (c): Data minimisation, ICO. Checked on 21 October 2026.
• A guide to data security, ICO. Checked on 21 October 2026.
• Principle (e): Storage limitation, ICO. Checked on 21 October 2026.
• What needs to be included in the contract?, ICO. Checked on 21 October 2026.
• A guide to individual rights, ICO. Checked on 21 October 2026.
• A guide to subject access, ICO. Checked on 21 October 2026.

Much of the ICO's guidance is under review after the Data (Use and Access) Act, so check each page again before you rely on it. This guide is general information, not legal advice. Take advice on how UK GDPR applies to your firm.