DPDP Act for Chartered Accountants: A Practical Guide
The Digital Personal Data Protection Act, 2023 governs personal data in digital form. Its Rules were notified on 13 November 2025. Most CA firms have not yet changed how they handle client documents, and the Act does not wait for them to be ready.
This guide explains what applies to a CA firm, which dates matter, and what to change first.
How can my CA firm prepare for the DPDP Act when handling client documents?
Start by listing the personal data your firm holds and where it sits. Stop storing identity documents in personal WhatsApp and personal email. Limit access to the team members who need each file. Keep a record of who opened what. Delete files you no longer need, unless a tax or company law requires you to keep them. A secure document service can handle the access and logging parts, so your team does not have to track them by hand.
Why this applies to your firm
The Act covers personal data processed in digital form. A scanned PAN card, an Aadhaar photo and a bank statement sent by email all fall within it. So does a paper file that you scan and store.
The Act also applies even when a file arrives on WhatsApp, in an email, or through a cloud folder. The channel does not change the duty.
Be careful with free online tools that compress, convert or run OCR on client documents. Many upload files to servers you do not control. A written firm policy that bans uploads to unapproved tools is a simple, practical control.
The dates that matter
| Date | What starts |
|---|---|
| 13 November 2025 | DPDP Rules notified, and the Data Protection Board provisions take effect |
| 13 November 2026 | Consent manager provisions take effect (optional for firms) |
| 13 May 2027 | Most other duties take effect, including consent and notice, security safeguards, breach notification, grievance redressal and erasure rights |
The most important date for your firm is 13 May 2027. That is when the duties that affect daily work begin. Use the time before then to put the habits in place, rather than waiting for the deadline.
Eight habits to change now
Write down each type of client document you collect and the reason for collecting it.
Ask only for documents the work needs. If a document is not needed for the engagement, do not request it.
Move client documents out of personal phones and personal email accounts.
Give each team member access only to the clients they work on.
Keep a record of who opened and downloaded each sensitive file.
Set a retention period for each document type, and check it against the law that requires you to keep it.
Write a short breach response plan. Name who acts, how you check what happened, and when you inform the affected clients.
Tell clients what you collect, why you collect it, and how long you keep it. Record their acknowledgement.
What the Act does not require
WhatsApp and cloud storage are not banned under the Act. You remain responsible for protecting the data you put in them. Two questions help. Can you limit who sees the file? Can you show who did?
Your firm's first week
Pick one partner or senior staff member to own the DPDP work. Ask them to list the places where client data sits, from the shared drive to the staff phones. Give them two weeks to complete the list.
In the second week, ask the team to stop sending identity documents through personal email and personal WhatsApp. Explain the reason, and give them the replacement route before you remove the old one. A rule without a route tends to fail in the first busy week.
Who inside the firm owns this
The duties fall on the firm itself, so you need a named person who answers for them. Which duties apply also depends on whether your firm is a data fiduciary or data processor. Name one person for client data questions and a second for breaches. In a small firm these may be the same person. That works as long as they know the response plan and your lawyer's details are on file.
Questions people ask
Does the DPDP Act apply to a small firm?
Yes, if the firm processes personal data in digital form. The basic habits in this article apply to small firms as much as large ones. Speak to your lawyer about your firm's exact position.
When do the main duties start?
Most duties start on 13 May 2027. The consent manager provisions start on 13 November 2026.
Does this article count as legal advice?
No. It explains the basics. For advice on your firm's specific obligations, speak to a qualified lawyer.
