The short answer
Usually not. A UK professional services firm should keep a marketing agency out of the systems that hold client work, which means the practice management system and the document store. Contact data can be supplied as a scoped export instead. Two questions settle it before any data protection contract: did the client authorise the disclosure, and is marketing the purpose the information was gathered for.
Key takeaways
- The useful split is not how much access to grant. It is whether a system's records exist because somebody is a contact of the practice or a client of it.
- A chartered accountant may disclose confidential client information only where a legal or professional duty or right exists, or where the client has authorised it. A supplier contract is neither.
- The Recruitment and Employment Confederation asks corporate members to obtain and document permission before confidential information is disclosed, displayed, submitted or sought.
- Information gathered to deliver client work was gathered for that purpose. Marketing is a new purpose, and new purposes get tested for compatibility.
- Nearly every request for a login is answered in full by a dated export, which is also the version a practice can withdraw.
The agency has been running a UK accountancy practice's advertising for five weeks and the campaigns are working. On the Thursday call the account manager asks for a login to the practice management system, because enquiries are not being matched to the engagements that follow them, and without that nobody can say which campaign earned anything.
The request is reasonable and it is made in good faith. The managing partner usually says yes.
Then look at what has been asked for. A practice management system holds engagement letters, fee notes, correspondence and working papers for every client on the books. The agency wants four columns out of one table. A login gives it all of the rest as well.
This gets argued as a data protection question, and the data protection answer arrives third. Two things decide it first, and one of them is not law at all.
The list and the work are two different requests
Nothing a marketing agency does needs the contents of a client file. Almost everything it does needs some of the contact data sitting next to it, which is why the two keep arriving as a single request for a login.
Email marketing platform
The list only
Full agency access. Nothing a client told the practice in confidence is in it.
Website forms and content system
The list, arriving
Editor access, with the form destination staying in a mailbox the firm owns.
Contact database or CRM
Both, mixed together
A dated export of the fields the campaign uses. Not a login, which cannot be scoped to a column.
Practice management system
The work
Nothing. No marketing task needs an engagement record, and no client authorised one being read.
Document store or client portal
The work, in full
Nothing, and no version of this is worth an exception.
Your own code answers this before the data protection law does
A chartered accountant may use or disclose confidential client information only where there is a legal or professional duty or right to do so, or where the client, or somebody with authority to permit it, has authorised the use or disclosure. That is R114.3 of the ICAEW Code of Ethics, set out in the institute's guidance on disclosure of confidential information for members in practice.
Hold the Thursday request against it. A supplier contract between a practice and its agency creates obligations between those two parties. It is not a duty or a right to disclose, and it is not the client's authority, so it does not get the practice past R114.3.
A recruitment agency arrives at the same place. The Recruitment and Employment Confederation's Code of Professional Practice requires corporate members to maintain the confidentiality of candidate and client information, and to ensure permission has been obtained and documented before confidential or personal information is disclosed, displayed, submitted or sought. Sought is doing real work in that list: asking for the login is already inside the rule.
Marketing is a new purpose, and a new purpose gets tested
Information gathered to deliver professional work was gathered for that purpose, and the purpose limitation principle in the UK GDPR does not let a firm quietly add a second one. The Information Commissioner's Office states it in its guidance on the compatible reuse of personal information: a new purpose must be compatible with the original one, and where it is not, information already collected must not be reused.
Where the original lawful basis was not consent, the Commissioner's guidance lists a set of routes by which a new use counts as compatible. Marketing a practice to its own client base is not among them, which leaves a firm reaching for its client records on one of two routes: fresh consent for the new use, or a compatibility assessment it can show somebody.
That assessment is made case by case, on the relationship between the original purpose and the new one, the context in which the information was collected and what the people in the records would reasonably expect, and the nature of the information and the effect the new use would have on them.
Before the login is created
Not sure whether the agency needs what it has asked for?
Free to your firm. The agency pays us, and only if the relationship works, which is why we would rather question an access request than place a supplier who treats a client file as campaign data.
Get a recommendationWhat the agency actually needs, and how to send it
Four requests cover nearly everything an agency asks a practice system for, and not one of the four needs a login.
We cannot tell which campaigns produced clients rather than enquiries.
A conversion export
Two columns, enquiry date and outcome. No client name and no fee. Refreshed monthly by whoever runs the system.
We want to email your clients about the new advisory service.
A consented segment
The firm builds the list and sends it. The agency supplies the copy and never holds the addresses.
We need to know what each client buys so we can target the campaign.
A service line count
Totals by service, never a list of clients. Ask who at the practice can produce it.
We would like to write one of your engagements up as a case study.
Written authority
The named client's permission in writing, obtained by the firm, before a word of it is drafted.
Where the processor contract belongs in the order
A data processing agreement is the paperwork for a disclosure a practice has already decided it is entitled to make, which is why it is the third question and not the first. The Information Commissioner's guide to controllers and processors turns on who determines the purposes and means of the processing, and says whoever determines them is a controller however a contract describes it.
The firm decided to market itself, so the firm is the controller, and the decision to hand over client records stays the firm's. A processor contract moves the security of the processing and not the judgement. It cannot supply an authority nobody asked the client for. The same ordering, applied to an external tool rather than a login, is worked through in whether client data can go into ChatGPT.
When to grant nothing, and when not to hire at all
A practice cannot delegate a right it does not hold.
Two situations are worth stopping on. Where nobody at the firm can say which purpose the records in a system were collected for, the compatibility question cannot be answered yet. And where the firm has no way of asking a client for permission in writing, the honest position is that it has no permission.
There is also a case for hiring nobody yet. A practice taking a handful of enquiries a month is being asked to grant access so a report can exist, not so a result can. Which systems a firm should buy in the first place comes before any of this, and it is set out in which tools a professional services firm should buy.
Saying so costs us the introduction fee, because we are paid by the agency and only when a relationship works. What we look at before recommending anybody is set out for accountancy practices, recruitment agencies, tax advisory and financial advice firms.
Frequently asked questions
What partners ask when the login request arrives.
Should our marketing agency have access to our CRM?
Usually not as a login. A contact database holds marketing records and client work side by side, and an agency needs the first. Supply those fields as a dated export the practice can withdraw.
The agency says it cannot measure results without CRM access. Is that true?
Half true. Advertising platforms cannot tell anyone whether an enquiry became a client. An export of two columns, enquiry date and outcome, closes that gap and identifies nobody.
Does a data processing agreement make it safe to grant access?
It answers a different question. A processor contract governs how a supplier handles information it has lawfully been given. It is not the client's authority, and under the Institute of Chartered Accountants' confidentiality rule that authority is what a practice needs.
Can we email our own client list about a new service?
Only once the purpose question is settled. Information gathered to do a client's work was gathered for that purpose, so marketing is a new one. Under the UK GDPR the practice needs fresh consent or a compatibility assessment.
What about access to our document store or client portal?
No marketing task reaches it. Where an agency wants material for a case study, the route is the named client's permission in writing, before anything is drafted.
Sources and useful reading
- Institute of Chartered Accountants, disclosure of confidential information for members in practice, and the Code of Ethics parts 1 to 3 overview, for R114.3.
- Recruitment and Employment Confederation, Code of Professional Practice, for the confidentiality and privacy principle and for permission being documented before disclosure.
- Information Commissioner's Office, what data protection law says about the compatible reuse of personal information, for compatibility and the routes by which a new use qualifies.
- Information Commissioner's Office, principle (b): purpose limitation, for the principle itself.
- Information Commissioner's Office, a guide to controllers and processors, for the determination resting on who decides the purposes.
This article is commercial decision support and is not legal advice. The two codes cited bind members of those bodies rather than every firm, and both are revised, so read the current version. The Commissioner's purpose limitation guidance was updated during 2026 to reflect the Data (Use and Access) Act, so read the live page. All sources were located on 4 October 2026. Nothing here describes any named agency or engagement.