A reporting package can carry personal data

Who has which role

A controller determines the purposes and means of processing; a processor processes personal data on the controller's behalf. In a typical accounting arrangement the client is the controller and the accounting firm is the processor. Where two organisations jointly determine purposes and means, their joint-controller arrangement must be defined rather than assumed.

A processor may appoint a subprocessor only with written authorisation and must impose equivalent obligations. Every system in the reporting chain is therefore a documented choice. The processor also maintains its own record of processing activities.

Transfers to the parent company

A transfer within the EU does not trigger the third-country transfer chapter. A transfer outside the EU needs an applicable basis: an adequacy decision, safeguards such as standard contractual clauses or binding corporate rules, or a narrowly construed derogation for a specific situation. A monthly reporting process should not be designed around an exception.

There is a separate accounting restriction: accounting documents and books may be stored outside Croatia only in another EU Member State, with supervisory access available. The GDPR analysis and the accounting-location rule must both be satisfied.

Security and automated decisions

GDPR requires technical and organisational measures appropriate to risk, including encryption where appropriate. A decision based solely on automated processing that has legal or similarly significant effects is generally restricted. This matters if group systems use employee data for automated scoring or decisions.

Where generative AI is used for language or preparation work, the EU AI Act adds transparency duties. Our process uses AI as an assisted tool with named human review, not as the final decision-maker over client or employee data.