Search

“GDPR tax credits” – not tax planning, not tax avoidance, just plain fraud

UPDATE: Computer Weekly coverage here

There are lots of small advisory firms pushing a fake GDPR tax reclaim “service” to SMEs, particularly IT companies.

Here’s an example of the pitch1Now taken off their website, but archived here:

and then:

Or even more explicit:

There are small variations, but it boils down to this series of claims:

  • GDPR is really hard for small businesses, and there’s a huge risk of fines and civil claims for non-compliance
  • We’ll provide a team of experts to assess the risk your company is running
  • We’ll then advise how much it’s prudent to reserve in your accounts.
  • And this reserve should have been made years ago – we’ll help you restate your past accounts.
  • The creation of the reserve was tax deductible! So every £1m you reserve gets you a refund of £190k off your old corporation tax bills.
  • Once you get the £190k refund, we’ll charge you a 30% fee – £57k – leaving you with £133k of free money. And if you don’t get a refund, we’ll charge nothing. It’s risk-free!

What could go wrong?

What goes wrong

Probably something like this:

  • You amend your historic corporation tax returns and get a refund. For the more recent past year, this is more-or-less automatic, as with most changes on HMRC’s online systems. You get your £190k refund and happily pay the advisors’ £57k fee.
  • Sometime later, HMRC take a look through your tax returns and demand the £190k back, plus interest and penalties.
  • You turn to the advisory firm for help, and a refund of your £57k. But they’ve disappeared.
  • You’re out £57k plus the interest and penalties. Nightmare.

I haven’t seen a single example of a regulated law firm or accounting firm pushing the scheme – it’s always dubious-looking unregulated outfits.

Why it doesn’t work

In reality, there’s no such thing as a “GDPR tax credit”.

First, the accounting doesn’t work. You’re not entitled to just magic up a reserve.

Here’s FRS 102:

An entity shall recognise a provision only when:
(a) the entity has an obligation at the reporting date as a result of a past event;
(b) it is probable (ie more likely than not) that the entity will be required to transfer
economic benefits in settlement; and
(c) the amount of the obligation can be estimated reliably.

You need all three elements.

Very few firms, and probably no SMEs, will have any obligations at their reporting date which are “more likely than not” to result in GDPR fines or civil claims, and which can be estimated reliably.

“Probable” in (b) means a “letter before action” from a lawyer, threatening a claim – guesses don’t cut it. If you expected a claim but hadn’t had a letter before action, you might put a note in the accounts, but not a reserve.

“Estimated reliably” in (c) is not a small hurdle. HMRC guidance shows that HMRC are very focused on the accuracy of the estimate.

The rules are the same for very small businesses (“micro-entities”) under FRS 105.2See paragraph 16.5.

Second, and more fundamentally, the tax doesn’t work.

A GDPR fine or punitive damages claim is non-deductible for corporation tax purposes, even if it reached by way of settlement. Damages paid out in a civil claim that compensate for actual loss (as opposed to punitive damages) might be deductible, but such claims are unlikely (and the figures would for most companies be small).

So the whole idea is dead in the water.

Third, if it’s done to avoid tax, it doesn’t work

Even if somehow you manage to book a reserve and get a deduction, you still fail, because reserves created primarily for a tax benefit aren’t deductible anyway. A tax tribunal recently used that principle to deny a business a tax benefit from a reserve created for unfunded pension liabilities – which were much more real than these fictional GDPR liabilities. And all the marketing and (I expect) the communications with the adviser will reveal to HMRC that the whole thing was tax-motivated.

Finally, it’s not a credit

There are a few companies who genuinely could reserve for GDPR – say if they really receive a letter before action today that lets them accurately estimate they will be liable to pay compensatory damages of £x next year. They would of course get corporation tax relief next year, when they pay the damages – it’s a deductible expense like any other. If they can (legitimately) create a reserve now then that accelerates the tax relief to this year… but then there’s no tax relief next year (because you’ve already taken it). A reserve isn’t a “tax credit” – it just changes the timing. Unless of course you are making a reserve for an amount you never expect to pay – but that’s fraud.

A junior accountant would spot these issues in five minutes.

In fact, one did – thanks to Yisroel Sulzbacher for bringing this to our attention.

Any one of these problems would kill the scheme. The whole idea fails so badly that those pushing it are either guilty of incompetence or fraud. There’s no such thing as a “GDPR tax credit”.

Who is pushing the scheme?

There are a large number of firms marketing the scheme on the internet – just on the first page of a google search we see:

How to stop the schemes

HMRC should list the GDPR schemes in their “spotlight” of tax avoidance schemes that don’t work.

And HMRC needs to start prosecuting advisory firms that promote schemes that can’t possibly work. It’s not avoidance, it’s fraud. And if HMRC thinks a prosecution is too hard under current law, the law should change.

We have a whole panoply of rules to stop tax avoidance and people who promote it. Those rules generally work. But modern “tax avoidance” isn’t avoidance at all – it’s fraud – and civil law rules to stop avoidance clearly have little deterrent value. Only the prospect of criminal sanctions will change the incentives.


Thanks to Yisroel Sulzbacher for bringing this issue to our attention and for his original analysis, and to C for her technical accounting expertise; also to Martin McDonald for further comments. A firm called Forbes Dawson wrote an excellent article on this scheme, months before we became aware of it. It would, incidentally, be great to see more firms’ websites carrying articles about tax planning that should be avoided – it’s a public service and (in our experience) clients love it.

9 responses to ““GDPR tax credits” – not tax planning, not tax avoidance, just plain fraud”

  1. I agree with two of the reasons you give for why this doesn’t work, but not the last one. The comparison to unfunded pension reserves is slightly false in my view. In that case, the actions which were taken in order to necessitate the reserve (i.e. entering into the deeds) were found to be tax-motivated. Therefore the resulting expense failed the “wholly and exclusively” test because the pension commitments served no commercial purpose. Whereas in this scheme, it is pre-supposed that the need for a reserve already exists (i.e. possibility of fines/damages for GDPR breach). If such fines/damages were ever to be levied on the company, payment of the charge would not fail the “wholly and exclusively” test – it may fail others, but I don’t think it can be argued that the payments themselves become tax-motivated just because some creative (but ultimately ineffective) accounting choice was made. As your other points well note, the scheme fails because the accounting is wrong and/or the underlying expense is non-deductible.

    • I fear you are being too kind. In this scheme, the company had no idea that it had any possibility of GDPR fines/breaches, and the promoter is “discovering” them (aka inventing them out of thin air) just for the tax benefit.

      • Perhaps I am being too kind, although I have never heard that said about me before. I agree that the choice to recognise an accounting expense was tax-motivated because the prospect of the actual expense materialising was non-existent (and all the scheme marketing materials make the intent pretty clear). But that is just another way of saying the accounting is clearly wrong. The “wholly and exclusively” test is about the purpose for incurring the expense. To me, that pre-supposes that the expense was properly incurred. You cannot incur an expense for a bad purpose if you did not actually incur the expense. So if we accept the (incorrect) premise that the expense ought to have been recognised in the accounts, does it then fail the W&E test? I’m not sure it does.

  2. We’ve had some comments from people who I’m guessing are connected with this scam. I’ve deleted them. If anyone involved wants to seriously contest the arguments in this piece then go ahead. Other non-specific attempts at defending these outfits will be deleted.

  3. It does seem these schemes are run by the online equivalent of a dodgy bloke down the pub telling you a pound of tax saved is a pound in your pocket.

    • An accountant friend of mine saw one of these schemes pushed to his clients last year. Needless to say they were dismissed out of hand…

      I would say on the accounting side, as pointed out in the article, at best this would be a contingent liability so this fails even before the tax treatment is considered. Having said that estimating the amount of fine is, potentially, actually quite easy (so 21.4c isn’t much of a hurdle) as GDPR regs set out the scope of fines that can be leveraged – 2% of turnover. You don’t need an algorithm to figure out what these scheme promoters are coming up with when they do their calcs…

      • Ah, but the 2% fines are absolutely non-deductible, so that doesn’t get you anywhere. You’d have to estimate the non-punitive damages awards you expect against you. Without a letter before action, that can’t be done

        • Tosh. They are absolutely mentioning fines (just check the websites) when they are 100% not deductible. As we say in the article, claims by individuals will only be tax deductible to the extent they are non-punitive and where they have been asserted in a letter before action (which for most companies will never happen). And the bank PPI reserves/payments were/are non-deductible. The whole thing is a scam.

Leave a Reply

Your email address will not be published. Required fields are marked *