The DPDP Act and Rules for a CA firm: what to put in place before the 18 months run out

A CA firm holds more personal data than most businesses its size: identity documents, bank statements, salary slips, family details for tax planning, often for hundreds of clients, and often in WhatsApp chats and shared folders. The DPDP Act and its Rules turn the care most firms already take into a few things that must be written down and shown. There is time to do it calmly, if the firm starts now.

Why it applies to a CA firm

The Act covers the processing of digital personal data within India, whether it was collected online or collected offline and then digitised.² The organisation that decides why and how the data is processed is the Data Fiduciary, and the individual it belongs to is the Data Principal.² A firm that decides to collect a client's PAN and Form 16 to file their return, and keeps them in a folder or a chat, is the Data Fiduciary for that data.

Parliament passed the Act in August 2023, and the Government notified the DPDP Rules, 2025 in November 2025, with an 18-month phased timeline for compliance.¹² That points to about May 2027 for most firms. This is a summary, not legal advice.

What the Act and Rules ask

• A notice before consent. A notice must be given before consent is sought, covering the data collected and the purpose.² The Rules ask for standalone, clear and simple consent notices that explain the specific purpose.¹
• A contact people can reach. Data Fiduciaries must display clear contact details, such as a designated officer, for questions about how personal data is processed.¹
• Security. The Act asks Data Fiduciaries to build reasonable security safeguards to prevent a breach. Failing to take security measures can cost a penalty of up to ₹250 crore.²
• Breach messages. After a breach, the Data Protection Board and the affected people must be informed.² The Rules say affected people must be told promptly and in plain language what happened, the likely consequences, what has been done, and whom to contact.¹
• Erasure. Personal data is erased once its purpose has been met, unless it must be kept for legal purposes.²
• Requests within 90 days. People can ask to access, correct, update or erase their data, or nominate someone to do so for them, and the Rules give a maximum of 90 days to respond.¹

Five steps for a CA firm

1. List what you hold. For each kind of client record, note where it lives (folders, email, WhatsApp, software) and why you keep it.
2. Add the notice to onboarding. One short paragraph in the engagement letter or KYC form, as in our client onboarding checklist, with the client's agreement recorded.
3. Name a contact. A partner or a staff member, with an email address on your website and in the notice.
4. Lock the basics. Our recommendation: client folders shared only with the people who need them, two-step sign-in on email and storage, documents moved out of personal WhatsApp into the client's folder, and access removed the day someone leaves.
5. Write two lists. How long each kind of record is kept, and what to do in the first day after a breach: who decides, who tells the clients, and the message below.

Wording you can copy

Replace the words in brackets, and keep them in English or Hindi, whichever the client uses. Have your legal adviser check the final notice.

Collecting documents is easier to keep safe when clients send them to one place, as in our ITR documents checklist, and the year's other dates are in our compliance calendar.

What can run by itself

• The notice and the client's agreement, sent with onboarding and recorded against the client.
• Documents filed in one place, read as they arrive and moved out of chats into the client's folder, as in our document processing.
• The retention list, with a reminder when a record reaches the end of its period, so a partner can decide on erasure.
• Request tracking, with the 90-day date worked out and a reminder before it, as in our client reminders.

What stays with your team

• What the law requires you to keep, and for how long, which is a professional judgment for each kind of record.
• A breach, where a partner decides what happened and what to tell the Board and the clients.
• Unusual requests, such as a family member asking for a client's records, which need a conversation.

More of what we write for CA practices is on the blog.

Questions CAs ask