Data Processing & International Clients
Clients in the United States, United Kingdom, European Union, United Arab Emirates, Saudi Arabia, Australia and Canada must meet their own data-protection obligations when they share personal data with a service provider in India. We sign the written terms they need and operate in line with them.
1. Our role
When we process personal data on behalf of a client, for example employee payroll data, customer ledgers or taxpayer information, the client decides why and how that data is processed. The client is the controller (or "business" under Californian law), and FinEx Tax Advisory acts as its processor (or "service provider"). We process the data only to deliver the agreed services and only on the client's documented instructions.
2. What our Data Processing Agreement contains
- Subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of individuals concerned.
- Instructions. Processing only on documented instructions, including for international transfers, and prompt notice if we believe an instruction breaches the law.
- Confidentiality. Every person authorised to process the data is bound by confidentiality obligations.
- Security. Appropriate technical and organisational measures, described in our Information Security Controls.
- Sub-processors. Use of sub-processors only with the client's general or specific written authorisation, with equivalent obligations passed down and advance notice of changes.
- Assistance. Help with data-subject requests, security, breach notification, impact assessments and consultations with regulators.
- Breach notification. Notice of a personal-data breach without undue delay after becoming aware of it.
- Deletion or return of all personal data at the end of the services, unless the law requires storage.
- Audit. All information needed to demonstrate compliance, including responses to reasonable security questionnaires and audits.
3. Country-specific terms
European Union and United Kingdom
Data Processing Agreement aligned with Article 28 GDPR and UK GDPR. For transfers to India, we sign the European Commission's Standard Contractual Clauses (module two or three as applicable) and, for UK data, the UK International Data Transfer Addendum, and we support the client's transfer risk assessment.
United States
Service-provider terms under the California Consumer Privacy Act as amended by the CPRA, including the prohibition on selling or sharing personal information and on using it for any purpose other than the services. For tax engagements we support the client's obligations under IRS Publication 4557 (Safeguarding Taxpayer Data) and the FTC Safeguards Rule, and the client obtains any taxpayer consent required under the Internal Revenue Code Section 7216 regulations before tax return information is disclosed to us.
Australia
Contractual protections that support the client's obligations under Australian Privacy Principle 8 for cross-border disclosure, together with cooperation under the Notifiable Data Breaches scheme. ATO lodgements remain with the client's registered tax or BAS agent.
United Arab Emirates and Saudi Arabia
Processor terms aligned with the UAE Personal Data Protection Law and the Saudi Personal Data Protection Law, and respect for free-zone regimes such as DIFC and ADGM where they apply to the client.
Canada
Contractual protections that allow the client to remain accountable under PIPEDA for information transferred for processing.
India
Processing in line with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under it.
4. Requesting our DPA
Send us your standard DPA or request ours. We review client DPAs promptly and return comments in a clear, marked-up form.
Questions about security?
We are happy to complete your vendor-security questionnaire and walk your team through our controls.