DPDP Problems for CA Firms: The Inconvenience DPDP Brings and How to Deal With It
DPDP problems for CA firms rarely start with the law. They start on a Monday morning. An article assistant forwards a client's Aadhaar on WhatsApp. A shared login opens last year's files. A 2019 bank statement sits on a laptop nobody remembers.
The short answer
The main duties under the Digital Personal Data Protection Rules, 2025 apply from about 13 May 2027, unless the government shortens the period. There is no blanket exemption for small businesses. Any CA firm that handles clients' digital personal data has duties.
The rules themselves are readable. The inconvenience is in the daily habits they test. Our practical DPDP guide for chartered accountants covers the law. This piece covers the friction, and how to deal with it.
Seven habits DPDP will test
| Habit today | What DPDP expects | How to deal with it |
|---|---|---|
| Client files arrive on WhatsApp and personal email | Reasonable security safeguards over personal data | Move collection to one secure channel the firm controls |
| Everyone uses one office login | Knowing who accessed what | Individual logins, with access only to assigned clients |
| No record of file opens | Logs kept for at least a year | A system that records every open and download |
| No written breach plan | Board informed with full details within 72 hours | A one-page plan: who decides, who informs, what to collect |
| Old files kept forever | Keep data only as long as needed | A retention schedule, with deletion on a date |
| Clients never told what you collect | A plain-language notice before consent | A short standalone notice, given as its own page and not a clause in the engagement letter |
| No route for client requests | Access, correction and erasure rights | One named person and one email address for requests |
Why each one is inconvenient
WhatsApp is the hardest to give up. Clients like it. Staff like it. But files on staff phones sit outside the firm's control. When someone leaves, the files leave too. We explain whether CA firms can use WhatsApp and Google Drive under DPDP in detail.
Shared logins feel efficient. Until a client asks who saw their papers. Then nobody can answer.
Deletion feels risky. Firms keep everything "just in case". But the safest file is the one you no longer hold. The legitimate need to keep records for tax law stays. Keeping a scanned passport from a closed engagement is harder to justify.
The notice feels like paperwork. It is a few lines. Our guide to the client consent notice has the structure.
You hold more personal data than you think. It goes beyond PAN and Aadhaar. Salary slips, bank statements, family details and medical bills for 80D all count. See what counts as personal data in a CA office.
A 30-minute start
You don't need a consultant to begin. Do these three things this week:
- List every place client files live today. Phones, inboxes, drives, cupboards.
- Pick one channel for collecting documents from now on.
- Write the names of the people who should see each client's files.
That list is your real DPDP gap. Everything else builds on it.
Where Reposha fits
Reposha is DPDP-ready document management for CA firms. It gives every Client a folder, so files stop living on phones and in inboxes. Only staff with access to a Client can open that Client's files. Every open and download is logged. Data is stored in India with verified and trusted service providers. Retention can be set to 6 months, 1 year or 3 years.
It replaces the WhatsApp habit, not the law. For a direct look at the shift, see how Reposha compares with Google Drive for CA firms.
Is your office ready for the DPDP Act? Start at reposha.com.
Questions people ask
When do DPDP duties start for CA firms?
The main duties under the DPDP Rules, 2025 apply from about 13 May 2027, unless the government shortens the period.
Does the DPDP Act apply to small CA firms?
Yes. There is no blanket exemption for small businesses. A CA firm that handles clients' digital personal data has duties under the Act.
What is the biggest DPDP problem for CA firms?
Client documents spread across WhatsApp, personal email and staff phones. The firm cannot secure, track or delete what it cannot see.
How fast must a firm report a data breach under DPDP?
Tell affected people promptly, and tell the Data Protection Board without delay, with full details within 72 hours unless the Board allows longer.
Which tools help CA firms prepare for DPDP?
Start with one secure place for client files, individual access and a log of every open. Reposha, the best AI for CAs, gives each client a folder and records every open and download.
General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.
Open the demo account to see how requests, folders and the activity record look. No sign-up needed.
