Is Your CA Firm a Data Fiduciary or a Data Processor?
The DPDP Act uses two labels that matter for every CA engagement: data fiduciary and data processor. The labels sound technical, but they decide who is responsible for what. Getting them right at the start of an engagement is much easier than untangling them after a problem.
The terms in plain language
The data principal is the person the data is about. For most CA work, that is your client, or a person connected to your client, such as a spouse named on a bank statement.
A data fiduciary decides why personal data is processed and how. It carries the broader set of duties under the Act.
A data processor handles personal data on behalf of a fiduciary, following its instructions. It still has duties to protect the data, but the fiduciary sets the purpose.
Four engagements, four answers
The roles depend on who decides the purpose, so the same firm can hold different roles on different work. The table below shows how that often plays out. It is an illustration, not a ruling.
| Engagement | Who decides why the data is used | Likely role of the firm |
|---|---|---|
| Filing an income tax return for a salaried client | Client, following tax law | Usually processor |
| Payroll processing for an employer | The employer | Usually processor |
| Tax planning where the firm decides which documents to gather and how to use them | The firm, at least for that part of the work | Possibly fiduciary |
| Statutory audit | Set largely by law and the engagement terms | Mixed, check the engagement terms |
Why the label changes your duties
A processor must follow the instructions it receives and protect the data it handles. A fiduciary has wider obligations, including notice to the data principal, handling of complaints and responses to breaches. When your firm decides how a client's data is used, you may carry more of the responsibility than you expected.
What to write into your engagement letter
Keep the wording short and plain. Your engagement letter could cover five points. It can say which documents you will collect for the work. It can say where they will be stored and who on your team can access them. It can say how long you will keep them. It can say who the client should contact about their data. And it can say what happens to the file once the engagement ends.
Ask your lawyer to review the wording for your firm before you use it.
Where the Act applies to you
Many of your engagements will involve both roles. A single client can be a processor relationship for filing and a fiduciary relationship for planning. Treat each engagement on its facts. Write down the role you believe applies, and revisit it if the scope changes.
A worked example
A firm prepares an income tax return for a salaried client. The client supplies the documents and asks the firm to file. The firm follows the client's instructions, uses the documents for that filing, and keeps them only as long as the law requires. In this case the firm is most likely a processor for that work.
The same client later asks the firm to plan their investments for the next three years. The firm decides which documents it needs, how it will use them and what it will recommend. For that planning work, the firm may act as a fiduciary, and its duties for that data are wider, even though the client and the relationship are the same.
Write both roles into the engagement letter, so the client knows which role the firm is playing for each piece of work.
Questions people ask
Can a firm be both a fiduciary and a processor?
Yes. The role depends on each activity, so the same firm can hold different roles within one client relationship.
Does the label change how I file a return?
No. The label changes your responsibilities for the data, not the tax work itself.
Who decides which role applies?
The facts of the engagement decide it: who sets the purpose, and who makes the key choices about the data. Confirm the position with your lawyer for anything unclear.
For the wider picture, the DPDP checklist sets out the steps that apply to most firms.
