Privacy Statement

Introduction

This Privacy Statement describes how and why BDO LLP ("we" or "us") and our subsidiaries collect, use and process personal data during the course of running our business. s. It applies to personal data provided directly to us by the individuals concerned and to personal data provided to us by companies and other organisations. It also describes your rights under Data Protection Legislation.

We are committed to the protection of personal data and to fair and transparent processing. If you have any questions about this Privacy Statement, you can contact our Data Protection Officer via email at dpo@bdo.co.uk.

To find out more about how and why we process personal data for specific processing activities, please refer to the relevant layers of this Privacy Statement below.

Our Processing Activities

• Corporate clients
• Personal clients
• Individuals Whose Personal Data we Process When Providing Services to our Clients and Audited Entities
• Suppliers
• Contacts
• Website visitors
• Insolvencies
• Recruits and applicants

Data controller

BDO LLP (a limited liability partnership registered in England with number OC305127 with a registered address of 55 Baker Street, London W1U 7EU) is registered as a data controller under registration number Z5799637.

In some situations when providing services, BDO will act as a processor, which means that our client is the data controller.

For further information about this privacy statement, please contact us at dpo@bdo.co.uk.

Security of personal data

We have policies, procedures and training in place in respect of data protection, confidentiality and information security. BDO’s Information Security Management System is certified under ISO/IEC 27001:2022. We regularly review such measures with the objective of ensuring their continuing effectiveness. The Privacy Statement was last updated in November 2026.

When we share and transfer personal data

We will only share personal data with third parties where we are legally permitted to do so. Where we share personal data with third parties, we will if required put in place appropriate contractual arrangements and seek to ensure that there are appropriate technical and organisational measures in place to protect personal data.

In the course of running our business and providing services to clients we may transfer personal data to third parties who are based outside the UK/EEA. Where we transfer personal data to a country or organisation not determined by the relevant authority to provide an data will be adequately protected in accordance with appropriate safeguards or derogations as defined under Data Protection Legislation

BDO has implemented a global programme of Binding Corporate Rules ("BCRs"), comprising both a BCR Controller Policy and a BCR Processor Policy. The purpose of the BCRs is to ensure compliance with applicable European and UK data protections laws when transferring UK or EEA originated personal data outside the UK and EEA. The BCRs apply to all BDO Member Firms and to other entities within the BDO global organisation and require the same level of protection of personal data across all of these entities. When we transfer personal data to other BDO Member Firms (that may be located in countries which are not adequate), we do so subject to the BCRs. For more information on the BCRs, please click here.

Depending upon the nature of our relationship with you, we may share personal data to:

• Other BDO Member Firms – we may share personal data with other members of the BDO International Network where required for the provision of services to our clients and/or running our business
• Third parties involved in the performance of services – we may also share personal data with third party organisations who assist us in providing services to clients, are otherwise involved in the services we provide to clients, provide us with expertise or who are engaged by our clients
• Third parties who provide IT services, technologies, data processing or functionality – like many professional service providers, we use third party providers to support our business and the provision of services to our clients, such as information technologies, cloud-based software providers, web hosting/management providers, data analysis providers, and data back-up and security/storage providers. These organisations may process personal data in data centres around the world.
• Auditors and advisers – we may share personal data with our auditors and advisers as required by law, as reasonably required in the management of our business, or for the establishment, exercise or defence of legal claims
• Third parties where required by applicable law and regulation – we may be requested or compelled to disclose personal data to third parties such as regulators and law enforcement agencies. We will only provide personal data to such parties where there is a legal requirement or permission to do so.
• Our clients or connected parties – we may be required share personal data with our clients, their group entities/subsidiaries or their affiliates/suppliers to provide professional services to our clients
• Insurance providers – we may be required to share personal data with insurers for the purposes of managing claims.
• Law enforcement, regulators, governmental departments, public authorities and other third parties as required under applicable law or regulation – we may receive requests to share personal data to comply with applicable laws, to assist with investigations, or for the establishment, exercise or defence of legal claims.
• Acquisitions, sales, mergers or disposals – we may be required to share or transfer personal data in connection which a potential or actual acquisition, sale, merger or disposal to enable that activity to take place.
• Other recipients as otherwise permitted under law

We may update this list from time to time and where we act as a processor, the relevant controller has a right to object to changes to the list of criteria we use to select and appoint other processors as set out above.

Your Rights

You have rights in relation to any of your personal data held by us as a data controller. Your rights include:

• Access;
• Rectification;
• Erasure;
• Restriction;
• Objection;
• Portability
• Withdraw consent at any time (where processing is based on consent).
• Contest automated decision making (where processing is reliant upon automated decision making).

Should you wish to exercise your rights please contact our Data Protection Officer via email at dpo@bdo.co.uk. We will endeavour to respond to any request promptly and within any legally required time limit.

Complaints

Should you wish to complain about our use of your personal data, please contact our Data Protection Officer via email at dpo@bdo.co.uk. We will investigate all complaints received and will endeavour to respond to complaints promptly.

You may also complain about our use of personal data to the Information Commissioner’s Office. For further information on your rights and the complaints process, please visit the Information Commissioner’s Office website: https://ico.org.uk/make-a-complaint/.
 

Data Retention

We will only keep personal data for as long as necessary for the purposes for which it was collected, or as required by applicable law or regulation.

Unless there are any overriding legal, regulatory or contractual requirements, we will retain records of services provided (which may include personal data) in accordance with our document retention policy.