6.3 Professional Ethics, Data Protection & Record Retention
Key Takeaways
- The AAT Code of Professional Ethics establishes five fundamental principles: Integrity, Objectivity, Professional Competence and Due Care, Confidentiality, and Professional Behaviour.
- Tax professionals must actively reject improper practices such as underreporting VAT, operating unrecorded cash payrolls, or misclassifying employees as self-employed contractors.
- The Data Protection Act 2018 and UK GDPR classify payroll details (NINO, salary, bank accounts, medical fit notes) as sensitive personal data requiring robust security and data minimization.
- Statutory rules require VAT records, invoices, and MTD digital links to be retained for at least 6 years (10 years for One Stop Shop / MTD digital audit trails).
- Payroll records (including P11 deduction sheets, FPS/EPS submission logs, and statutory pay records) must be retained for at least 3 years after the end of the tax year to which they relate.
6.3 Professional Ethics, Data Protection & Record Retention
1. AAT Code of Professional Ethics: 5 Fundamental Principles
All members of the Association of Accounting Technicians (AAT)—including student members, full members (MAAT), and fellow members (FMAAT)—are bound by the AAT Code of Professional Ethics. Derived from the International Ethics Standards Board for Accountants (IESBA) framework, the Code sets out five fundamental principles that govern professional conduct:
┌────────────────────────────────────────┐
│ AAT 5 Fundamental Ethical Principles │
└───────────────────┬────────────────────┘
│
┌────────────────┬───────────────────┼───────────────────┬────────────────┐
▼ ▼ ▼ ▼ ▼
┌───────────┐ ┌────────────┐ ┌───────────────┐ ┌───────────────┐ ┌──────────────┐
│ Integrity │ │Objectivity │ │ Professional │ │Confidentiality│ │ Professional │
│ (Honesty │ │ (No Bias / │ │ Competence & │ │ (Protect Data/│ │ Behaviour │
│ & Truth) │ │ Conflicts) │ │ Due Care) │ │ No Disclosure)│ │ (Obey Laws) │
└───────────┘ └────────────┘ └───────────────┘ └───────────────┘ └──────────────┘
A. The Five Fundamental Principles Detailed
- Integrity: Members must be straightforward and honest in all professional and business relationships. Integrity implies fair dealing and truthfulness. A professional accountant must not knowingly be associated with reports, returns, or communications containing materially false or misleading statements.
- Objectivity: Members must not allow bias, conflict of interest, or undue influence of others to override professional or business judgments. Tax calculations and advice must reflect statutory tax law, not employer pressure to minimize liabilities illegally.
- Professional Competence and Due Care: Members have a continuing duty to maintain professional knowledge and skill at the level required to ensure that clients or employers receive competent professional service based on current legislation, techniques, and practice. Members must act diligently in accordance with applicable technical standards.
- Confidentiality: Members must respect the confidentiality of information acquired as a result of professional and business relationships. Information must not be disclosed to third parties without proper and specific authority unless there is a legal or professional right or duty to disclose. Confidential information acquired must not be used for personal advantage.
- Professional Behaviour: Members must comply with relevant laws and regulations and avoid any conduct that the member knows or should know might discredit the accounting profession.
2. Ethical Dilemmas in Tax and Payroll Compliance
Accounting technicians working in tax and payroll frequently face commercial pressure to compromise compliance standards. Common ethical dilemmas include:
A. Pressure to Underreport Output VAT or Suppress Cash Sales
- Scenario: A manager instructs the payroll/tax accountant to omit cash sales from the quarterly MTD VAT return to keep taxable turnover below a threshold or reduce output VAT payable.
- Ethical Breach: Breaches Integrity and Professional Behaviour. Submitting deliberately false VAT returns constitutes criminal tax evasion under UK law.
B. Off-the-Books Cash Wages & Off-Ledger Payments
- Scenario: An employer pays cash wages to casual staff without declaring earnings on an FPS or deducting PAYE income tax and Class 1 NICs.
- Ethical Breach: Violates Integrity and Professional Behaviour. The accountant is aiding in illegal tax evasion and breaching PAYE statutory regulations.
C. Worker Status Misclassification (Disguised Employment / IR35)
- Scenario: An employer forces staff to register as self-employed contractors rather than employees, solely to avoid paying Employer Secondary Class 1 NICs (15% for 2025/26) and providing statutory holiday and sick pay.
- Ethical Breach: Breaches Objectivity and Professional Competence. The accountant must evaluate worker status based on legal indicators (control, substitution, mutuality of obligation) rather than commercial convenience.
D. Ethical Conflict Resolution Framework
When faced with an ethical conflict, an AAT member must follow a structured resolution pathway:
Step 1: Gather Relevant Facts & Statutory Rules
│
▼
Step 2: Raise Issue Internally (Line Manager / Senior Board)
│
▼
Step 3: Consult AAT Ethics Helpline (Confidential Advice)
│
▼
Step 4: Obtain Independent Legal / Professional Advice
│
▼
Step 5: Refuse Association & Resign if Uncorrected
If an employer refuses to correct illegal tax or payroll practices after internal escalation, the member must refuse to be associated with the false returns and, if necessary, resign from employment. Members must also evaluate statutory obligations to submit a Suspicious Activity Report (SAR) under Anti-Money Laundering (AML) legislation.
3. Data Protection Act 2018 & UK GDPR in Payroll Administration
Payroll departments handle vast quantities of personally identifiable information (PII). Under the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR), payroll records contain both standard personal data and sensitive special category data.
A. Sensitive Payroll Data Elements
- Identifiers: National Insurance Numbers (NINO), full names, residential addresses, dates of birth, and personal email addresses.
- Financial Data: Bank account numbers, sort codes, salary details, court attachment of earnings orders, and pension contributions.
- Special Category Data: Health data and medical fit notes (required for Statutory Sick Pay eligibility), trade union membership fee deductions, and disability status.
B. Core Principles of UK GDPR Applied to Tax & Payroll
- Lawfulness, Fairness, and Transparency: Processing payroll data is lawful under Article 6(1)(c) (Compliance with a legal obligation) for PAYE/RTI statutory compliance.
- Purpose Limitation: Payroll data collected for tax calculations must not be repurposed for unauthorized commercial activities (e.g. marketing third-party financial products to staff).
- Data Minimization: Only personal data strictly necessary for payroll and tax processing should be collected and processed.
- Accuracy: Payroll teams must maintain accurate employee records, ensuring correct tax codes and NINO details are held to prevent RTI validation rejections.
- Storage Limitation: Personal data must not be kept longer than necessary for statutory purposes.
- Integrity and Confidentiality (Security): Payroll software must use end-to-end encryption, password-protected payslips, multi-factor authentication (MFA), and role-based access controls to prevent data breaches.
4. Statutory Record Retention Rules (HMRC Compliance)
UK tax law imposes mandatory record retention periods on businesses. Failing to maintain complete statutory records for the required duration can trigger HMRC penalties of up to £3,000 per tax year or period.
A. Statutory Record Retention Periods
| Record Category | Mandatory Minimum Retention Period | Statutory Reference |
|---|---|---|
| VAT Records & Accounts | At least 6 years from transaction date or period end | VATA 1994 Schedule 11 |
| MTD Digital Audit Trails | At least 6 years (10 years for OSS/MOSS schemes) | VAT Notice 700/22 |
| PAYE & Payroll Records | At least 3 years after the end of the tax year | Income Tax (PAYE) Regs 2003 |
| Statutory Pay Records (SSP/SMP) | At least 3 years after the end of the tax year | Social Security Regulations |
| Company Accounting Records | 6 years from end of financial year | Companies Act 2006 s.388 |
B. Payroll Records Subject to the 3-Year Rule
Employers must retain the following payroll documentation for at least 3 years after the end of the tax year to which they relate:
- Detailed P11 Gross-to-Net deduction sheets.
- Electronic logs of all RTI submissions (FPS and EPS confirmation receipts).
- Tax code notifications received from HMRC (Forms P6, P9, and Student Loan start notices).
- Records of statutory pay payments (SSP, SMP, SPP, SAP) and supporting medical evidence (Forms MATB1, Fit Notes).
- Documentation supporting Employment Allowance claims.
Example: Payroll records for the 2025/26 tax year (ending 5 April 2026) must be retained until at least 5 April 2029.
C. VAT Records Subject to the 6-Year Rule
Registered businesses must retain all VAT records for at least 6 years:
- Copy tax invoices issued and original tax invoices received.
- Credit notes and debit notes.
- Import and export documentation (C79 documentation, customs declarations).
- Daily gross takings records for retail schemes.
- MTD digital links connecting underlying accounting systems to filing software.
5. Comprehensive Summary Table: Retention vs. Ethics vs. GDPR
| Compliance Dimension | Primary Governing Body / Statute | Key Operational Rule |
|---|---|---|
| Professional Ethics | AAT Code of Professional Ethics | Adhere to 5 principles; escalate/resign if tax fraud requested |
| Data Protection | DPA 2018 / UK GDPR | Encrypt payroll data; process under legal obligation; minimize data |
| Payroll Record Keeping | HMRC / PAYE Regulations 2003 | Retain P11, FPS, EPS, statutory pay records for 3 years post tax year |
| VAT Record Keeping | HMRC / VATA 1994 Sch 11 | Retain tax invoices, VAT accounts, MTD links for 6 years minimum |
6. Exam Traps & Common Pitfalls
Exam Trap 1: Confusing VAT and Payroll Retention Periods A classic AAT exam trap asks candidates for the retention period of payroll records vs VAT records. Remember: Payroll records = 3 years after the end of the tax year. VAT records = 6 years from transaction date/period end.
Exam Trap 2: Disclosing Confidential Payroll Data Under Manager Pressure An accountant cannot breach confidentiality simply because a non-authorized manager asks for salary details of colleagues. Disclosure requires proper authority, legal obligation, or official statutory inquiry (e.g. HMRC statutory audit demand).
What is the mandatory statutory minimum retention period required by HMRC for VAT records, invoices, and MTD digital accounts?
An accounting technician is instructed by their finance director to omit cash wages from RTI submissions to lower PAYE and Class 1 NIC liabilities. Which fundamental principle of the AAT Code of Professional Ethics is primarily violated if the accountant complies?
What is the statutory minimum retention period for PAYE payroll records (such as P11 deduction sheets, FPS/EPS logs, and statutory pay records) after the end of the relevant tax year?
Under UK GDPR and the Data Protection Act 2018, which of the following items processed by a payroll department is classified as sensitive 'special category data' requiring heightened security measures?