DPDP Act for CA Firms: What Changes by May 2027, in Plain Words
It is a quiet afternoon in March. A client asks, "Does this new data protection law apply to your office?" You have read two newsletters and still cannot answer in one sentence.
This guide is built for DPDP compliance for CA firms and for other advisers who hold client papers. It explains the duties in plain words, then gives a practical timeline. It is not legal advice, and you should confirm your own position with a professional.
- Firms that decide why and how personal data is used are called Data Fiduciaries under the Act.
- The main duties apply in full from 13 May 2027, under the notified rules.
- Core duties: tell people why you collect data, keep it safe, erase it when done and report breaches.
- You can start now with habits that also make your firm run better.
What the Act is, in one paragraph
The Digital Personal Data Protection Act, 2023 sets rules for how personal data is collected, used, kept and erased. The government has notified rules that bring its duties into force in stages. You can read the Act and the rules on the MeitY website.
A firm that decides why and how personal data is handled is called a Data Fiduciary. A CA, consultant, advocate or advisor who collects PAN, Aadhaar and bank statements from clients usually falls into that group.
The timeline that matters
Dates are the part everyone asks about. Here is a simple view.
| When | What happens |
|---|---|
| 2023 | The Act is passed |
| Late 2025 | Rules are notified, with duties phased in |
| 13 May 2027 | Main duties for Data Fiduciaries apply in full |
Confirm the dates on the MeitY site before you plan around them. The practical point is that you have months, not years, to build habits.
The duties, in plain words
Most firms need to understand six duties.
- Tell people why. Explain what data you collect and for what purpose, and ask for consent where needed.
- Use data only for that purpose. Do not repurpose a client's documents for something unrelated.
- Keep it safe. Use reasonable safeguards such as access control, encryption and records of access.
- Erase when done. Remove data when the purpose ends and no law requires you to keep it.
- Report breaches. Tell the Data Protection Board and the affected people if a breach happens.
- Answer requests. Give people a way to ask questions, correct data or ask for erasure.
Failing to keep reasonable safeguards can carry a penalty of up to ₹250 crore under the Act's schedule. The aim of the law is care, not fear, but it is good to know the scale. The text is on the MeitY site, and your adviser can explain how it applies to you.
What a notice to clients can look like
The Act asks you to tell people why you collect their data. In a small firm this can be one short paragraph on your engagement letter or on the page where clients upload.
It should say what you collect, such as PAN, Aadhaar and bank statements. It should say why, for example to prepare a return. And it should say how long you keep it and how a client can ask a question or request erasure.
Keep the words plain. A client who understands the notice is more likely to trust you with the documents.
Where firms usually fall short
Most gaps appear in daily habits, not in policy files.
- Documents arrive on chat and sit on personal phones.
- Everyone on the team can open every client's papers.
- Nobody can say who opened a file last month.
- Old files are never erased, even after the work is done.
None of these needs a lawyer to fix. Each one is a habit you can change this quarter. We look at the first in the hidden cost of collecting documents on WhatsApp, and at the third in who opened that file.
A practical plan for DPDP compliance for CA firms
You do not need to do everything at once. A six-step plan works for most practices.
- Map the data. List what you collect from clients and where it sits.
- Move collection to a secure link. Stop receiving files on personal phones.
- Limit access. Let each person open only the clients they handle.
- Keep a record. Make sure every open and download is logged.
- Set retention. Decide how long each class of document stays. See how long to keep client documents.
- Write a one-page breach plan. Who is told, by whom, within what time.
Review the plan every quarter. Small, steady steps beat a rush in April 2027. Put the review date in your calendar today, and name one person who owns it.
A written checklist keeps the plan honest, and it gives your partners something to sign off. Start small, tick what you already do, and note what is left.
Our DPDP readiness checklist is free to use. It lists the questions to ask yourself, in the order most firms need them. You can also read the shorter DPDP guide, which includes the dates and what each duty means for client documents.
This article is general information, not legal advice. Check specific obligations with your professional adviser.
Where Reposha fits
Reposha is a secure client document service that helps you handle client data responsibly. It is not a certificate and does not guarantee compliance. Clients upload through a link, so files stay off personal phones. Staff see only the clients assigned to them, and every open and download is recorded. You set a retention period, get reminders before files are erased, and files are removed on schedule. These are habits the Act asks for, in a form your team can follow without extra effort.
Questions people ask
Does the DPDP Act apply to CA firms?
A firm that decides why and how personal data is used, such as client PAN, Aadhaar and bank details, is generally a Data Fiduciary. That includes most CA, consultant and advocate practices. Confirm your own position with a professional adviser.
When do the DPDP duties start for a CA firm?
The rules phase in over time, and the main duties for Data Fiduciaries apply in full from 13 May 2027. Check the dates on the MeitY website before planning, because they come from the notified rules and may be updated.
What is the penalty under the DPDP Act?
The Act sets monetary penalties by type of breach, with the highest, up to ₹250 crore, for failing to keep reasonable security safeguards. Amounts depend on the facts and are decided by the Data Protection Board. Read the schedule on the MeitY site.
Can a document service make a firm DPDP compliant?
No service can guarantee compliance. The law depends on how you collect, use, keep and erase data. A good service supports the habits, such as access control, logs and retention, but your firm still owns the decisions and the policies.
A short checklist of the habits the DPDP Act asks for, in the order most firms need them.
