GDPR and consent when an accountant refers a client onward

It is easy to think of a referral as simply passing on a name. In data-protection terms it is more than that: you are disclosing an individual's personal data — their identity, contact details, and often sensitive information about their finances, family and affairs — to a separate organisation. That disclosure is processing under UK GDPR, and it needs a lawful basis and appropriate transparency just like any other handling of personal data.

This does not make referrals difficult; millions of legitimate data-sharing arrangements operate every day. But it does mean you cannot forward a client's details to a specialist on autopilot. Before the introduction is made, you need to be clear on why you are permitted to share the data, and the client needs to understand and, in practice, agree to it.

UK GDPR requires a lawful basis for sharing personal data. For a client referral, the cleanest and most appropriate basis is usually the client's consent — they agree to their details being passed to a named specialist or network so that they can be helped. Consent under GDPR must be freely given, specific, informed and unambiguous, which fits naturally with a referral the client actively wants to happen.

Consent must be a positive, active step. A client saying 'yes, please put me in touch' is a clear indication; silence, inactivity, or a pre-ticked box is not. Because the referral only makes sense when the client wants the introduction, obtaining genuine consent is rarely difficult — but it must be real, recorded, and specific to this sharing, not a blanket permission buried elsewhere.

Consent is only valid if it is informed, which links straight to your transparency obligations. Before or at the point of sharing, the client should understand:

• Who their data will be shared with — the specialist or the network
• What information will be passed on
• Why it is being shared — to arrange the help they are seeking
• That they can decline, and that the choice is theirs

Much of this should already sit in your privacy notice, which ought to explain that you may share client data with third-party specialists where the client agrees. The privacy notice sets the framework; the specific consent at the point of referral makes it concrete for that client.

Two further principles apply directly. Data minimisation means you should share only what the specialist actually needs to take the referral forward — not your entire client file. At the introduction stage that is often just contact details and a short note of the reason; the specialist can gather the rest directly from the client once engaged.

You should also have reasonable confidence that the firm you are sharing with will handle the data properly. Referring to vetted, regulated specialists supports this, because it means the destination is not an unknown quantity. Sharing sensitive personal data with an unchecked recipient would sit poorly with your accountability obligations, so the vetting behind a referral network does double duty — protecting the client's interests and their data.

The practical way to stay compliant is to make consent a fixed step in how you refer, not something you improvise each time. Ask the client clearly whether they are happy for their details to be passed to the specialist, capture that agreement, share only what is needed, and keep a record of the consent. If a client ever asks how their data reached a third party, you can answer immediately.

A referral network that builds consent capture into its workflow makes this reliable, because the request and the record are part of the process rather than left to memory. That protects the client, keeps you accountable under UK GDPR, and lets the introduction — and any resulting fee share, typically a 60-70% member share — proceed on a clean footing. Where your processing is more complex, or the data especially sensitive, take specific data-protection advice; this is general guidance, and the ICO's own materials are a useful reference point.