Answer
What Should I Check When Choosing a Vendor That Handles Client Data?
By Saba Khalvashi, Co-Founder & CEO
Published · Updated · Legal status September 2026
Any software that processes client data is also a professional-law decision. Under § 62a(2) StBerG, German tax advisors must select service providers carefully, and the relationship must end if the requirements can no longer be met. The BStBK FAQ puts technical reliability and legal compliance first.
What should I ask the vendor?
| Check | Question for the vendor | Why it matters |
|---|---|---|
| Secrecy | Will you sign a commitment under § 62a StBerG in text form? | Must be in place before any knowledge of the data |
| Data processing | Is there a data processing agreement under Art. 28 GDPR? | Mandatory for processing on behalf of the firm |
| Subprocessors | Who else processes the data, and in which country? | § 62a(3) governs passing on the duty |
| Location | Where exactly is the data stored and processed? | The BStBK recommends EU vendors or EU data centres |
| Model training | Are inputs used for training? | Ideally not, and contractually assured |
| Deletion | When and how is data deleted? | Deletion concepts are a GDPR duty |
| Security | Which encryption and certifications are in place? | State of the art, for example ISO 27001 |
| Traceability | Can results be traced back to sources? | Black-box results are hard to stand behind |
What matters more, features or legal certainty?
Legal certainty comes first, because no feature makes up for a missing secrecy commitment. Comparing features only pays off once the first four rows of the table are settled. Then professional fit counts: has the tool proven itself for the purpose, are there references from the sector, and does it fit the firm's existing IT?
How do I test a tool before client data flows?
With harmless data. The BStBK always recommends a test phase before rollout, assessing quality, usability and security features. For the review itself, an approval process involving firm management, the data protection officer or an IT lead makes sense.
How do I know I should walk away?
When a vendor can't answer the questions above clearly. The BStBK advises doing without a tool if in doubt, however innovative it looks. That also applies if the vendor doesn't provide the information you need for a data protection impact assessment.
What applies on top for AI meeting assistants?
Consent from all participants comes on top, because the spoken word is being captured. Details are in the article May an AI tool transcribe client meetings?. The chamber's overall position is summarised in the BStBK FAQ in 12 points.
Common questions.
Is a data processing agreement enough?
Only if it also covers the secrecy commitment under § 62a StBerG. That must exist in text form before the vendor gains knowledge of client data.
May I use free AI tools with client data?
Generally not. The BStBK warns that inputs there are often used for training. Without safeguards, nothing may be entered that points to clients or engagements.
Who should approve a new tool in the firm?
The BStBK FAQ names firm management, the data protection officer or an IT lead. Unauthorised installations and private AI accounts should be ruled out.
Sources
- Bundessteuerberaterkammer: FAQ: KI im steuerberatenden Berufsstand (as of 27 October 2026, in German), accessed 30 October 2026
- Gesetze im Internet: § 62a StBerG, use of service providers (in German), accessed 30 October 2026
- EUR-Lex: Regulation (EU) 2016/679 (GDPR), accessed 30 October 2026
This article is for information only and is not legal or tax advice.
See TaxMeet on a sample conversation.
See in 30 minutes how a confidential client meeting becomes finished work.