Did you resolve this? I have recently set up a new practice and am preparing draft engagement letters. I am using the ICAEW templates and have come up against the same problem. I believe that when I'm working for a Sole Director's Limited company and doing their accounts and corporation tax work I'm the data controller in relation to that client but when running their payroll for them I'm the data processor. So what wording do I include in the Data Protection section of the terms of business?