Personal Data Under DPDP: Examples From a CA Office (More Than You Think)
Ask most CA offices what personal data they hold, and the answer comes back as PAN and Aadhaar. Those are the obvious two. Walk the office instead, from the reception desk to the cupboard by the stairs, and the list keeps growing.
What counts as personal data in a CA office?
Personal data is data about an individual who can be identified from it. In a CA office, that covers identity documents, financial records, family details and the firm's own staff records. Digital personal data is covered, and so is personal data collected on paper and digitised later, under section 3 of the DPDP Act. The main duties apply from about 13 May 2027, under the DPDP Rules, 2025, unless the government shortens the period.
The DPDP Act guide for chartered accountants covers the law itself. This piece covers where the data sits.
Examples, desk by desk
| Desk | Personal data you likely hold | Why it counts |
|---|---|---|
| Reception | Visitor register, appointment diary, business cards on the desk | Each entry names a person, often with a phone number |
| Tax team | PAN, Aadhaar, bank statements, Form 16, rent receipts | Identity and income records for every client |
| Payroll and HR | Staff PAN, bank details, salary, appraisal notes, applicants' CVs | Your own team is personal data too |
| Audit and company work | Director KYC, shareholder lists, minutes that name individuals | Names, IDs and addresses of individuals |
| Paper cupboards | Old client files, signed forms, ID copies | Scanned copies fall within the Act |
| Staff phones | Client photos, voice notes, group chats | The data sits outside the firm's control |
The desks that hide the most data
The tax desk
Say a client sends a bank statement, a salary slip and a PAN card for one return. Three documents, one person, and each page identifies them. Multiply that by every client in the season, and the tax desk holds the firm's largest pile of personal data. How to store Aadhaar, PAN and bank statements safely covers the handling step by step.
The cupboard and the old laptop
Say a client left the firm three years ago, and the cupboard still holds their file. Someone scans it for a query, and the scan is now digital personal data. An old laptop with the same scan keeps that data alive after the work ends.
What clients can ask about their data
A client can ask what your firm holds. Access to information sits under section 11 of the DPDP Act. Correction and erasure sit under section 12, grievance redressal under section 13, and nomination under section 14. A plain client consent notice sample tells the client what you collect before you collect it. Keeping records the law requires is one of the legitimate uses without consent, under section 7.
Where Reposha fits
A single place for client files helps the tax desk most. Reposha, DPDP-ready document management for CA firms, gives each Client a folder. Only staff with access to a Client can open that Client's files, and every open and download is logged. Clients upload from a phone or laptop, with no account to create. They get an upload link and a one-time access code, sent as two separate WhatsApp messages. Upload pages come in English and Hindi.
Data is stored in India with verified and trusted third-party service providers. Retention can be set to 6 months, 1 year or 3 years. Reposha's access logs also answer the question of who saw a client's papers. For the everyday habits behind these risks, see everyday DPDP problems in CA firms.
Start at reposha.com.
Questions people ask
What counts as personal data in a CA office?
Any data about an individual who can be identified from it. That includes client PAN and Aadhaar, salary slips, bank statements and the firm's own staff records.
Does paper in a cupboard count under the DPDP Act?
Yes, once it is digitised. The Act covers personal data collected offline and digitised later, so scanned copies fall within its scope.
Can a client ask what personal data my firm holds?
Yes. Access to information sits under section 11 of the DPDP Act, and correction and erasure sit under section 12.
How can a CA firm find where its personal data sits?
Walk every desk, device and cupboard that holds client files, and note what each one holds. Reposha, DPDP-ready document management for CA firms, gives each Client a folder with a log of every open and download.
General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.
Open the demo account to see how requests, folders and the activity record look. No sign-up needed.
