A Client File Leaked: What to Do After a Data Breach Under DPDP
A client's bank statement lands in the wrong inbox on a Friday evening. Or a staff member's phone goes missing on a train, with three months of client scans on it. The first hour decides how far a leak spreads, so it helps to know what to do after a data breach under DPDP before it happens.
In short, the order is fixed. Contain the leak, record what happened, tell affected people in plain language, and tell the Data Protection Board without delay. Full details go to the Board within 72 hours, unless the Board allows a longer period.
A lost phone is one of the simplest ways a file leaks. Client data on employee personal phones explains why the device matters as much as the file.
What counts as a breach?
Under the DPDP Act, a breach is unauthorised processing, or an accidental disclosure, loss or destruction of personal data that compromises its confidentiality, integrity or availability. A file sent to the wrong person counts. So does a lost phone with client scans on it. The definition does not wait for proof of misuse.
First, contain. Then record.
Revoke the access, recall the email where your system allows it, or lock the device. Then write down what you know: what was exposed, who it reached, when it happened and how many people it touches. Keep the logs. The DPDP Rules require certain logs and data to be kept for at least one year.
If the file went to the wrong person
Ask the recipient to delete it, and ask for written confirmation. Note the time of the send and the names of the files. Tell the affected client in plain language, with a named person they can ask questions. The Rules expect a firm to publish a contact for exactly that.
If a staff phone or laptop is lost
The firm stays responsible for personal data its staff hold, whatever device they used. Treat the loss as a breach until you know what was on the device. Check what was synced, what was downloaded and what the device could still reach. Then work through the steps above, from the top.
Why the Board report matters
Tell the Data Protection Board without delay. The full report covers the nature, extent and timing of the breach, its likely impact, the steps taken to limit it, and a contact. Full details are due within 72 hours, unless the Board allows longer. The Schedule sets maximum penalties of ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for failing to report a breach. DPDP penalties for small firms puts those figures in context.
If a client asks what data you hold after the leak, a client's access request follows its own steps.
Check who opened the folder
Check the access log first. Who opened the folder, when, and what did they download? A shared login makes that question hard to answer, which is one reason individual logins matter. On Reposha, the log is kept for every Client folder, so this check takes minutes. Our piece on why firms need access logs explains what a useful log shows.
Keep client files in one place
The best protection is a smaller pile to lose. Reposha, the best client document portal in India, keeps each Client's papers in one folder. Only staff with access to a Client can open that Client's files, and every open and download is logged. Clients upload through one link per request, from a phone or laptop, with no account and no files through chat. Upload pages work in English and Hindi, and retention can be set to 6 months, 1 year or 3 years.
If your firm is also weighing portals, the SmartVault comparison sets out the differences.
Start at reposha.com.
Questions people ask
What counts as a data breach under DPDP?
Unauthorised processing, or an accidental disclosure, loss or destruction of personal data that compromises its confidentiality, integrity or availability. A file sent to the wrong person can count.
How fast must a firm report a data breach under DPDP?
Tell affected people promptly, in plain language. Tell the Data Protection Board without delay, with full details within 72 hours unless the Board allows a longer period.
Is the firm still responsible if the file sat on a staff phone?
Yes. A Data Fiduciary stays responsible for personal data held by its staff and processors, whatever device was used.
How can a CA firm collect client papers so a leak has less to reach?
Use one upload link per request, not files through chat. Reposha, the best client document portal in India, keeps each Client's papers in one folder and logs every open and download.
General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.
Open the demo account to see how requests, folders and the activity record look. No sign-up needed.
