What Your Indian Bookkeeper Actually Accesses
The most common data security concern Australian business owners raise is: "What can my Indian bookkeeper see — and can they access my bank accounts?" The answer depends entirely on how you set up access, and it is more reassuring than most people expect.
When you invite your Indian bookkeeper as a Standard user in Xero or MYOB, they access your accounting software — not your banking platform. Here is precisely what they can and cannot do:
| What Your Indian Bookkeeper CAN Access | What They CANNOT Access |
|---|---|
| Bank transaction feed in Xero/MYOB (read-only transaction data) | Your actual online banking login or password |
| Supplier invoices uploaded via Hubdoc or Dext | Ability to initiate bank transfers or payments |
| Customer invoices and accounts receivable | Your subscription or billing settings in Xero/MYOB |
| Payroll figures (amounts, employee names, super) | Your bank account login credentials |
| BAS workpapers and GST data | Ability to add or remove other users |
| Management reports (P&L, balance sheet, cash flow) | Legal documents, contracts, or non-financial data |
The bank feed in Xero and MYOB is a one-way data pull — transactions flow from your bank into the accounting software automatically. Your bookkeeper sees the transaction data and reconciles it; they have no access to the banking platform itself, and no ability to reverse the data flow or initiate a transfer. This is a fundamental technical control, not a policy — it is built into how the platform works.
Australian Privacy Act — Your APP 8 Obligations
The Privacy Act 1988 (Cth) applies when an Australian business (with annual revenue over A$3M, or any business in certain sectors) discloses personal information to an overseas recipient. Australian Privacy Principle 8 (APP 8) requires that before you send personal information offshore, you take reasonable steps to ensure the overseas recipient handles it in compliance with the APPs.
In a bookkeeping outsourcing context, the personal information involved includes:
- Employee names, salaries, tax file numbers, and bank account details (payroll data)
- Customer names, addresses, and invoice amounts (accounts receivable)
- Supplier names and payment details (accounts payable)
- Any individual's financial data that passes through your accounting system
The "reasonable steps" requirement is satisfied by including a data handling and confidentiality clause in your engagement agreement with the Indian CA firm. The clause should state that the Indian firm handles all personal information in compliance with the Australian Privacy Principles — or equivalent protections — and that data is used only for the purposes of providing bookkeeping services to you.
If your business has annual revenue under A$3M and does not operate in a regulated sector (health, finance, government), the Privacy Act may not apply to you directly — but the same data handling practices are good practice regardless. See our article on ATO compliance when outsourcing bookkeeping to India for related regulatory requirements.
NDA and Engagement Letter — What to Require
Before sharing any financial data with an Indian bookkeeper, get the confidentiality terms in writing. A well-drafted engagement letter or standalone NDA from your Indian CA firm should cover:
- Scope of data — what data is received and for what purpose (bookkeeping services only)
- Confidentiality obligation — the Indian firm will not disclose your data to any third party without your written consent
- Privacy Act compliance — personal information will be handled in compliance with Australian Privacy Principles or equivalent protections
- Data storage — where data is stored, who has access within the Indian firm, and what security measures are in place
- Data retention — how long data is retained after the engagement ends, and how it is disposed of
- Breach notification — the Indian firm will notify you within 24–48 hours of any suspected or actual data breach involving your data
- Sub-contractor restriction — your data will not be passed to any sub-contractor without your approval
A reputable Indian CA firm will have these terms as a standard part of their engagement letter. If a firm is unwilling to sign a confidentiality agreement, do not engage them.
Platform Security — How Xero and MYOB Protect Your Data
Both Xero and MYOB are cloud platforms built with enterprise-grade security. The security measures built into these platforms provide a significant layer of protection regardless of where your bookkeeper is located:
| Security Feature | Xero | MYOB Business |
|---|---|---|
| Two-factor authentication (2FA) | Mandatory for all users | Available; strongly recommended |
| Role-based access control | Standard user cannot initiate payments or change settings | Module-level permissions configurable per user |
| Activity/audit log | Full history on every transaction — who created or modified it | Transaction audit trail per user |
| Data encryption | Encrypted at rest and in transit (TLS) | Encrypted at rest and in transit |
| Data hosting | AWS (Australia and New Zealand region) | Australian data centres |
| Session timeout | Automatic logout after inactivity | Automatic logout after inactivity |
Require your Indian bookkeeper to enable 2FA on their Xero or MYOB account from day one. This ensures that even if their password is compromised, an attacker cannot access your accounting data without also controlling their authentication device.
Secure File Transfer — Getting Documents to Your Bookkeeper
Beyond the accounting software itself, you will need to share supporting documents — supplier invoices, bank statements, payroll inputs, and receipts — with your Indian bookkeeper. How you do this matters for security.
Recommended methods in order of preference:
- Hubdoc or Dext — purpose-built document capture platforms that integrate directly with Xero and MYOB. You or your staff photograph receipts and invoices; they land in a secure portal where your bookkeeper picks them up. No email attachments, no shared drives. This is the best method for ongoing receipt capture
- Google Drive or OneDrive with MFA — a shared folder (accessible only to you and your bookkeeper) protected by two-factor authentication. Suitable for one-off document transfers such as monthly bank statements, payroll spreadsheets, or year-end documents
- Email (encrypted where possible) — acceptable for low-sensitivity documents, but avoid sending payroll data (employee TFNs, bank accounts) via email. Use password-protected files for any sensitive attachments
- Avoid — public file sharing links (Dropbox links without password protection), USB drives, or unencrypted email attachments containing employee financial data
For ongoing bookkeeping engagements, we use Hubdoc as the standard document capture method for Australian clients — it keeps all source documents in a single location accessible to both parties, with a full audit trail of what was uploaded and when.
Data Security Checklist — Before You Start
- Engagement letter signed — includes confidentiality clause covering APP 8 requirements
- Xero/MYOB access set to Standard user role — not Admin, not Adviser
- Two-factor authentication (2FA) enabled on your Indian bookkeeper's Xero/MYOB account
- Document transfer method agreed — Hubdoc, Dext, or password-protected Google Drive folder
- Payroll data shared via secure method — not plain email if containing TFNs or bank accounts
- Breach notification clause in engagement letter — 24–48 hour notification obligation
- Data retention and disposal terms agreed — what happens to your data when the engagement ends
Running through this checklist takes less than an hour at the start of an engagement. It is worth doing — not because offshore bookkeeping is high-risk, but because it establishes clear expectations on both sides and satisfies your Privacy Act obligations. The same checklist applies when engaging any bookkeeper, local or offshore.
For further reading on the legal framework, see our article on whether it is legal for Australian businesses to outsource bookkeeping to India.
Written by Sharma Jyoti, CA (ICAI) — Founder, Sharma Jyoti and Co. We are an ICAI-registered Chartered Accountant firm providing outsourced bookkeeping and accounting services to Australian, US, UK and Canadian businesses. Learn more about our firm →
Related Reading