Data Security Policy

Data Security Policy 

Outbooks Ireland 

At Outbooks, client information is managed with professionalism, responsibility and consistent care. Financial data is at the core of every engagement and protecting it is at the core of everything we do. 

Security is not an add-on. It is embedded into every process, system and infrastructure layer we operate. This document outlines how Outbooks safeguards client information against unauthorised access, breaches, misuse and operational disruption, in accordance with applicable Irish and European data protection law. 

1. Our Data Security Governance Framework 

Outbooks operates a data security governance framework that combines operational controls, technical safeguards and internal oversight to ensure responsible data handling across all client engagements. 

Our framework ensures: 

• Defined security policies and internal procedures 

• Clear allocation of security responsibilities across teams 

• Ongoing monitoring and testing of security controls 

• Periodic review of internal data protection practices 

Security controls are proportionate to the sensitivity of the data and the level of operational risk involved. 

2. Regulatory Compliance 

As an outsourced accounting and bookkeeping provider serving Irish firms and businesses, Outbooks aligns its data protection practices with applicable Irish and European law, including: 

• General Data Protection Regulation (GDPR) (EU) 2016/679 

• Data Protection Act 2018 (Ireland) 

• Documented internal procedures supporting ongoing compliance 

• Incident management protocols aligned with regulatory requirements 

• Maintenance of records of processing activities where applicable 

 

We process personal data only where a lawful basis exists under Article 6 of the GDPR: 

• Contractual necessity — where processing is required to deliver agreed services 

• Legal obligation — where processing is required under Irish or European law 

• Legitimate interests — where processing supports our operations, provided individual rights are not overridden 

We do not process personal data beyond what is necessary for the identified purpose. 

3. Technical Security Controls 

Outbooks maintains multiple layered technical safeguards across its infrastructure, systems and authentication processes: 

• Secure server environments 

• Access through protected VPN connections 

• Encrypted data transmission 

• Encrypted data storage where applicable 

• Regular system updates and patch management 

• Continuous system monitoring 

• Multi-factor authentication (MFA) for access to all critical systems 

• Periodic vulnerability assessments to identify and address security risks 

• System activity logging to support monitoring and investigation 

 

4. Malware and Threat Protection 

To reduce exposure to cyber risks, Outbooks maintains active threat protection measures: 

• Email filtering and phishing protection systems 

• Endpoint protection mechanisms across all operational devices 

• Monitoring for unusual or unauthorised activity 

• Restricted access to non-work-related websites 

 

5. Access Control and User Management 

Access to client information is governed by strict internal controls, ensuring that only authorised personnel can access data relevant to their assigned engagement. 

Our access governance framework includes: 

• Role-based access aligned with job responsibilities 

• Access granted strictly on a need-to-know basis 

• Authorised channels for all file uploads and downloads 

• Immediate revocation of access upon role change or termination 

• Regular review of user access permissions 

• Formal access review exercises conducted at defined intervals 

• Documented authentication and authorisation procedures 

Access to sensitive financial data is monitored and audited on an ongoing basis. 

6. Physical Security Measures 

Client data is processed within secure, controlled office environments supported by physical safeguards: 

• CCTV monitoring of all office premises 

• Controlled access to operational areas 

• Visitor logging and supervision procedures 

• Secure internal storage facilities 

• Restricted access to designated secure or infrastructure zones 

 

7. Device and Endpoint Management 

We maintain controlled device usage standards across all operational areas to significantly reduce the risk of unauthorised data access or removal: 

• Use of company-authorised desktop systems only 

• Prohibition of personal devices for official work activities 

• Controlled installation of approved software only 

• Centralised tracking of IT assets 

• Secure disposal of obsolete equipment 

• Centrally managed endpoint security configurations 

 

8. Staff Responsibilities and Security Awareness 

Our people are a critical part of our security posture. Outbooks ensures that all employees who handle client data are trained, vetted and accountable: 

• Mandatory confidentiality agreements for all staff 

• Internal policies governing secure communication practices 

• Use of encrypted communication channels 

• Periodic data protection and cyber awareness training sessions 

• Defined escalation channels for reporting suspected security incidents 

Security responsibilities are reinforced at every level of the organisation, from frontline staff to senior management. 

9. Third-Party and Sub-Processor Governance 

Where Outbooks engages third-party providers or sub-processors who may access or process client data, we apply rigorous due diligence: 

• Due diligence assessments conducted before onboarding any third-party provider 

• Confidentiality obligations within all contractual agreements 

• Data usage restricted to approved purposes only 

• Oversight mechanisms to maintain operational control 

• Periodic review of third-party security practices 

 

In the event of a third-party security incident affecting client data: 

• The incident is assessed promptly 

• Impact on client data is evaluated 

• Corrective measures are coordinated with the third party 

• Contractual obligations require vendors to notify security incidents without undue delay 

• Clients are notified where required under applicable data protection laws 

 

10. Secure Communication Protocols 

All transmission of financial records, accounting files and client documentation follows strict security protocols: 

• Encrypted file-sharing platforms are used for all document exchange 

• Sensitive information is never transmitted via plain-text or unsecured email 

• Large file transfers are handled through secure, access-controlled portals 

• Email communications are monitored to enforce compliance with secure transfer standards 

 

11. Data Storage, Retention and Minimisation 

Outbooks maintains a formal data retention policy governing how long client data is held and how it is securely disposed of at the conclusion of an engagement: 

• Storage on secure and monitored infrastructure 

• Access restricted to authorised personnel only 

• No storage of client data on personal devices 

• Encrypted backup systems supporting data recovery 

• Secure deletion procedures applied when data is no longer required 

• Data minimisation principles applied to limit processing to necessary information only 

• Defined data retention schedules aligned with legal and operational requirements 

 

12. International Data Transfers 

Where cross-border processing is required for service delivery, Outbooks applies appropriate safeguards: 

• Secure transmission methods for all international data exchanges 

• Contractual controls governing third-party data handling 

• Appropriate legal safeguards for transfers outside the European Economic Area, where applicable 

International processing is undertaken only where necessary and in full accordance with Irish and European data protection standards. 

13. Incident Response and Regulatory Notification 

Outbooks maintains a documented incident response process that is tested and updated regularly. In the event of a suspected or confirmed data breach, our structured response is activated immediately. 

Our incident response protocol follows these stages: 

• Identification and containment measures initiated immediately 

• Affected systems secured to prevent further exposure 

• Impact assessment conducted to understand the nature and scope of the incident 

• Corrective actions implemented and full system restoration carried out 

• Post-incident review and improvement of controls to prevent recurrence 

 

Where required, notification is made to the Data Protection Commission within applicable regulatory timelines. Affected clients are notified promptly in accordance with Irish and European data protection law. 

14. Business Continuity and Operational Resilience 

To support continuity of service in the event of disruption, Outbooks maintains: 

• Encrypted backup systems 

• Defined recovery procedures for all operational systems 

• Business continuity planning with documented recovery protocols for critical services 

 

15. Your Rights Under GDPR 

As an individual whose data we process, you have the following rights: 

• Right of Access — request a copy of your personal data we hold 

• Right to Rectification — request correction of inaccurate or incomplete data 

• Right to Erasure — request deletion where data is no longer necessary, subject to legal obligations 

• Right to Restriction — request we limit processing in certain circumstances 

• Right to Data Portability — request your data in a structured, machine-readable format where applicable 

• Right to Object — object to processing based on legitimate interests 

• Right to Withdraw Consent — withdraw consent at any time without affecting prior processing 

16. Cookie and Tracking Technologies 

Our website may use cookies and similar technologies to support functionality and improve user experience. Full details are available in our Cookie Policy. We operate in accordance with the Irish ePrivacy Regulations and GDPR. 

17. Policy Review and Continuous Improvement 

Cyber threats and regulatory requirements evolve constantly. Outbooks treats information security as an ongoing operational commitment, not a one-time exercise. 

Our continuous improvement programme includes: 

• Regulatory updates and changes in Irish and European law 

• Technological changes and adoption of new security capabilities 

• Emerging security risks informed by current threat intelligence 

• Operational improvements identified through internal review and audit 

• Periodic risk assessments to identify and address opportunities for strengthening security controls 

Information security governance is supported by senior leadership, with clear accountability at management level. 

Contact 

For data security enquiries, please contact us: 

Email: info@outbooks.com 

Phone: +353-212069255 

Address: 

Unit 1A Heatherview Business Park
SSC8002
Athlone Road
Co Longford N39KD82