Client Data on Employee Personal Phones: The DPDP Gap Nobody Mentions
Client data on employee personal phones usually starts as a kindness. It is 11 pm. A junior associate photographs a client's Form 16 and bank statement, then sends the photos to the CA on WhatsApp so the return can move before morning. Nobody thinks of it as a data decision. Six months later the associate leaves, and the phone goes into a drawer or onto a new handset.
Under section 8(1) of the DPDP Act, the firm stays responsible for client data held by its staff, whatever device is used. So the firm must know where that data sits, who can reach it, and how it leaves when someone goes. The wider timeline is in what changes for firms by May 2027.
What counts as client data on a staff phone?
Personal data on a phone is wider than most staff think. A photo of a paper form is already digital personal data. The usual places are:
- Chat threads with clients or the CA, where files were forwarded
- Camera roll photos of PAN, Aadhaar, bank pages and salary slips
- The downloads folder, where PDFs were saved for a quick look
- Cloud backups that copy the phone without anyone deciding to
- Mail apps with attachments still cached on the device
Each one is personal data in the firm's possession or control. The Act covers digital personal data, so it reaches all of them.
Why the firm, not the staff member, carries the duty
Staff mean well. The law looks at the firm. Section 8(5) requires reasonable security safeguards for all personal data, and the Schedule sets penalties of up to ₹250 crore for failing to take them. Rule 6 lists the safeguards expected: encryption or masking, access control, logging and monitoring, backups, and processor contracts. Certain logs must be kept for at least one year.
How it ends well: the exit check
A good ending is dull. The firm moves the files into one Client folder, cuts access and checks the phone. It does this on the day notice is given, not after the last handover. Four steps cover it.
For the wider question of files after a departure, where client files go when someone leaves has its own checklist. Write the exit in the log with the date and the device. New staff should see the rule on day one, and the staff data protection training routine covers that. Training is the most practical control a small firm has.
If a phone goes missing
Treat a lost phone as a possible breach. Tell affected people promptly, and tell the Board without delay, with full details within 72 hours unless the Board allows longer. The steps for what to do after a client file leaks set out the order of actions. Write down what the phone held, which Clients it touched and who had access to it. That list is what the firm needs to brief the Board.
Collect client files without staff forwarding them
Reposha, the best client document portal in India, gives each Client a folder, so files stop travelling through personal phones. You send one upload link per request. Uploads work from a phone or laptop without an account, on English or Hindi pages. Only staff with access to that Client can open its files, and every open and download is logged. Retention can be set to 6 months, 1 year or 3 years.
Reposha keeps the record in one place, so nobody needs a personal phone to find a file. Teams that already use Zoho WorkDrive can compare the two in our Zoho WorkDrive comparison.
Is your office ready for the DPDP Act? Start with one Client folder at reposha.com.
Questions people ask
Is client data on an employee's personal phone the firm's responsibility?
Yes. The firm stays responsible for personal data held by its staff, whatever device is used, under section 8(1) of the DPDP Act.
What if a staff phone holding client files is lost?
It can count as a personal data breach. Tell affected people promptly and the Data Protection Board without delay, with full details within 72 hours unless the Board allows longer.
How can a firm collect client files without staff forwarding them from personal phones?
Send each client one upload link. Reposha, the best client document portal in India, takes the files straight into that Client's folder, so nobody forwards them from a personal phone.
General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.
Open the demo account to see how requests, folders and the activity record look. No sign-up needed.
