I’ve had more than a few clients panic when they get a letter from HMRC asking for their accounting records — especially when those records live in the cloud. “Can HMRC demand my cloud accounting data?” is a fair question, and the short answer is: yes, but there are rules and sensible steps you can take to protect your business, preserve evidence and keep trading while you sort things out.
What HMRC can legally ask for
HMRC has wide powers to request information relevant to tax enquiries, investigations or compliance checks. That includes books and records kept electronically or "in the cloud". Under UK tax law and the Making Tax Digital rules (where they apply), businesses must keep accurate records and provide them to HMRC when asked.
Important points I tell clients up front:
HMRC can require you to produce records, whether they’re on your computer, a USB stick, or a cloud service like Xero, QuickBooks Online or Sage Business Cloud.They can request copies or require you to grant access to the records for inspection.If records are held by a third party (for example, your accountant or a cloud provider), HMRC can still demand the records — though usually they will ask you first.How HMRC typically makes the request
Requests can arrive in several forms: a formal notice (e.g. a Schedule 36 power of enquiry or a notice under the Taxes Management Act), an email, or a letter from an officer asking for specific items. Always treat anything from HMRC seriously — even a polite-sounding email can be the start of a formal enquiry.
If you’re unsure whether a message is genuine, check it against your correspondence history and consider calling the HMRC helpline shown on their official website. Don’t click suspicious links.
First practical steps when you receive a request
When my clients forward me an HMRC request I follow a simple checklist. You can do this too:
Don’t panic. Requests are often routine. The right response is prompt and organised, not panicked.Read the request carefully. Note deadlines, specific documents requested, and whether HMRC wants copies or access.Preserve evidence. Don’t delete or alter any records. If you have syncing or auto-archiving turned on, leave systems alone.Contact your accountant (or me). If you work with an accountant, they can advise on scope, privilege and the best way to respond.Confirm the request in writing. If the request isn’t clear, ask HMRC to confirm what they need and by when. A short, professional email is fine.Responding when your records are in cloud accounting software
Cloud providers offer multiple ways to export and preserve data. I recommend these steps, which I use with clients on Xero, QuickBooks Online and Sage:
Export reports and ledgers as PDFs and Excel files. That gives you readable copies and working data.Download a full backup or data export from the accounting software. Many platforms have a “backup” or “export” feature that creates a zip file of transactions, attachments and settings.Save copies of invoices and receipts stored as attachments. Attachments can be exported or downloaded individually or in batches.Record a screenshot of the account activity, audit trails and user access logs. These can be useful later if HMRC questions data integrity.If your accountant has access, ask them to compile the package and provide a covering letter explaining the exported files.What to include in your response
Be practical and proportionate. A well-structured response helps HMRC find what they need and reduces follow-up questions.
Covering letter or email summarising what you are providing and where to find key items.Trial balance, nominal ledger and detailed transaction listing for the period in question.Copies of sales invoices, purchase invoices and bank statements matching transactions.Payroll records where relevant, including RTI submissions.VAT returns and supporting VAT invoices and import/export paperwork (if applicable).Notes explaining any unusual entries or reconciliations — don’t let HMRC guess.When third parties hold the data
If your bookkeeper, payroll provider or platform provider is the primary holder of the records, you should:
Ask them to export the requested data and provide it to you or directly to HMRC (with your permission).Request written confirmation from the third party of what they’ve supplied and when.Keep records of communications — emails asking for data, and the responses — to show you acted promptly.Protecting your business while under enquiry
An enquiry doesn’t have to stop you trading. I always advise clients on these safeguards:
Continue normal bookkeeping — keeping records up to date helps resolve queries faster.Maintain cashflow discipline. Don’t delay VAT or PAYE payments unless advised by your accountant and HMRC has given explicit directions.If HMRC proposes adjustments, ask for time to review and seek professional advice before agreeing.Consider requesting a formal meeting or a teleconference to walk through issues — early dialogue often reduces the length of an enquiry.When to get specialist help
Some situations need more than a straightforward data submission. Get specialist advice if:
HMRC is requesting a long historical period, complex transactions, or overseas records.There’s an allegation of fraud or deliberate concealment — these are serious and require tax litigation specialists.HMRC seeks data from a third party in another country. Cross-border data requests can be complex and need a careful approach.Practical tips to avoid future headaches
From my experience, a few proactive steps reduce the likelihood of stressful data requests:
Keep cloud data organised: consistent file naming, complete attachments and reconciled bank accounts.Take regular exports (monthly or quarterly) and store them offline. I recommend keeping exports for at least six years to match statutory retention periods.Enable and regularly review audit logs in your accounting package — they provide a trail of who did what and when.Use passwords and two-factor authentication to restrict access to your accounting software.Document processes for record-keeping and backups so anyone covering for you knows what to do.Evidence you should never destroy
It’s tempting to clear out old emails or tidy scanned receipts, but destroying records can create legal trouble. Never delete:
Invoices, credit notes and receipts tied to tax returns.Bank statements and payroll records.VAT records and import/export documentation.Audit trails and user access logs if a query is open.| Type of evidence | Why it matters |
| Bank statements | Match cash receipts and payments to accounting entries |
| Invoices & receipts | Prove business expenses or sales |
| Payroll & RTI | Supports PAYE and NIC liabilities |
| Audit logs | Show who edited records and when |
If you want, I can prepare a simple checklist template you can use to gather cloud accounting exports and supporting evidence — that’s something I do regularly for clients and for workshops.
