DPDP Act for Advocates: The Inconvenience It Brings and How to Deal With It
The DPDP Act for advocates lands on ordinary days. An associate forwards a client's Aadhaar on WhatsApp. A medical report from a custody dispute sits in an old email thread. Nobody remembers which phone holds the scanned bank statements.
When do DPDP duties start for advocates?
The main duties under the DPDP Rules, 2025 apply from about 13 May 2027, unless the government shortens the period. The Act covers digital personal data, and personal data collected on paper and digitised later. There is no blanket exemption for small businesses, so a small chamber carries the same duties in principle. Our guide to what changes by May 2027 covers the wider firm.
Stage 1: Now, map what you hold
Start with a list of every place client papers sit. Check phones, laptops, email, WhatsApp groups and the cupboard in the record room. Then check what each matter collects. Your client intake papers show the usual set: intake forms, copies of Aadhaar and PAN, bank statements, salary slips, and medical reports where the matter needs them.
Family files need extra care. A property or matrimonial matter can hold a spouse's salary slip, a child's school record or a relative's identity proof. Those people's data is on your map too, even though they are not your client.
Stage 2: Before 13 May 2027, send a plain notice
The notice must be standalone and in plain language. It lists the personal data, the purpose, how to withdraw consent, how to exercise rights and how to complain to the Board. Clients can ask for it in an Eighth Schedule language. The consent notice sample shows the layout.
Consent is not the only route. Compliance with law is a legitimate use without consent under section 7, so statutory records can be kept. Keep them for as long as the law needs, and no longer.
Stage 3: When a client asks for their data
Clients hold rights to access information (section 11), correction and erasure (section 12), grievance redressal (section 13) and nomination (section 14). Prepare three things before the first request arrives: a list of the data you hold on that client, a copy of the file index, and one named person who answers.
Under the DPDP Rules, 2025, a grievance must be answered within a reasonable period that does not exceed 90 days. Ninety days is the ceiling, so answer as quickly as your staff can.
Stage 4: If a breach happens
Tell affected people promptly, in plain language. Tell the Data Protection Board without delay, with full details within 72 hours unless the Board allows longer. Certain logs must be kept for at least one year, so keep the record of who opened what. The Schedule sets maximum penalties of ₹250 crore for failing to take reasonable security safeguards, and ₹200 crore for failing to report a breach.
Write the breach plan on one page. Name who decides, who informs the Board, and where the access logs sit. A plan that is read on the day of the breach is too late to write.
Stage 5: When a matter closes, delete on a schedule
Keep what the law requires, and delete the rest on a date you set and can show. Matrimonial files hold the most sensitive papers. The contested divorce checklist shows what that kind of file usually holds.
Keep client papers out of phones and inboxes
Reposha, DPDP-ready document management for advocates, gives each Client a folder. You send one upload link per request. Clients upload from a phone or laptop with no account, on pages in English or Hindi. Only staff with access to a Client can open that Client's files. Every open and download is logged, and retention can be set to 6 months, 1 year or 3 years.
Start with Reposha at reposha.com.
Questions people ask
When do DPDP duties apply to advocates?
The main duties under the DPDP Rules, 2025 apply from about 13 May 2027, unless the government shortens the period. Start the list of client papers now.
Does the DPDP Act have an exemption for a small advocate's office?
No blanket exemption exists for small businesses. A small chamber that handles clients' digital personal data has duties under the Act.
How fast must an advocate report a data breach?
Tell affected people promptly, in plain language. Tell the Data Protection Board without delay, with full details within 72 hours unless the Board allows longer.
How can an advocate keep client files DPDP-ready?
Start with one secure place for each client's papers and a log of every open. Reposha, DPDP-ready document management for advocates, gives each Client a folder and logs every open and download.
General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.
Open the demo account to see how requests, folders and the activity record look. No sign-up needed.
