In short
- A CA firm holds clients' PAN, Aadhaar, bank statements and salary details - so the Digital Personal Data Protection (DPDP) Act, 2023 applies to it.
- The DPDP Rules, 2025 were notified on 13 November 2025. Most duties start on 13 May 2027.
- The duties: tell clients what you hold and why, keep it secure, keep it only as long as needed, report breaches (Board: detailed report within 72 hours) and answer clients' requests (within 90 days at most).
- Penalties go up to ₹250 crore for weak security and ₹200 crore for not reporting a breach.
- The biggest risks at a typical firm are everyday habits: WhatsApp groups, email attachments, shared folders and keeping everything forever.
This guide explains the law in plain words for CA firms. It is not legal advice. Check the Act and Rules as published in the Gazette, and take advice on how they apply to your firm.
Does the DPDP Act apply to a CA firm?
Yes. The Act covers digital personal data - any information about an identifiable person, held digitally (or digitised later). A CA firm handles a lot of it: PAN and Aadhaar copies, bank statements, Form 16s and salary details, phone numbers and email addresses of individual clients, proprietors, partners and directors, and employee data for payroll clients.
Because the firm decides why and how that data is used, it is a Data Fiduciary. The client (the person the data is about) is the Data Principal. Software and cloud providers who process the data for you are Data Processors - but the responsibility stays with your firm.
A company's own financials are not personal data. The people inside them - directors, partners, employees, guarantors - are.
When do the DPDP Rules start?
| Date | What starts |
|---|---|
| 13 Nov 2025 | DPDP Rules, 2025 notified. The Data Protection Board and the rules about it start. |
| Nov 2026 | Registration of consent managers (about a year after notification). |
| 13 May 2027 | Most duties for firms: privacy notice, security safeguards, breach reporting, retention and erasure, client rights and grievances. |
18 months sounds long, but changing how a firm collects, shares and deletes documents takes time - and articles and staff need to learn the new way of working. Firms that start in 2026 will be ready without a rush.
What a CA firm has to do, in plain words
1. Tell clients what you hold and why
Give each client a clear notice: what data you collect, why, how they can withdraw consent, how to make a request or complaint, and how to reach the Board. Get consent where it's needed - for example, before sending reminders on WhatsApp. Your engagement letter is a natural place to start.
2. Use data only for the work
Data collected to file a client's return should be used for that work - not shared with a friend at a bank "to help with the loan" without the client asking.
3. Keep it secure
"Reasonable security safeguards" in the Rules include controlling who can access data, encrypting it, keeping logs of access (for at least a year) so you can detect and investigate misuse, and having backups. In practice: each person has their own login, articles see only the clients they work on, and sensitive documents are locked to the people who need them.
4. Don't keep it longer than needed
Personal data should be erased once its purpose is served - unless a law requires you to keep it. Tax and professional rules do require CA firms to keep many records, so decide a retention period for each kind of document and delete the rest. Keep a record of what you deleted.
5. Report breaches quickly
If client data is lost, stolen, seen or changed by someone who shouldn't have it - a stolen laptop, a phishing email, a return emailed to the wrong client - inform the Data Protection Board without delay, send a detailed report within 72 hours, and tell the affected clients without delay. Cyber incidents may also need reporting to CERT-In within 6 hours under its 2022 directions.
6. Answer clients' requests
Clients can ask for a summary of their data, ask you to correct or erase it, nominate someone to act for them, and raise a grievance. Publish how they can do this, and respond within a reasonable period - not more than 90 days.
7. Take extra care with children's data
Processing a minor's data (for example, a minor's investment income) needs verifiable consent from a parent or guardian.
Where CA firms are most exposed
| Common habit | The risk | A better way |
|---|---|---|
| WhatsApp groups for documents | Copies on every phone in the group, forever, with no record | A private upload link per client; files land in one place |
| Emailing returns as attachments | Wrong recipient, forwarded copies, no way to take it back | Expiring share links with a code and a watermark |
| KYC copies in a shared folder | Every staff member can open every PAN and Aadhaar | Sensitive documents locked to partners and managers |
| Articles see all clients | Access far beyond what each person needs | Staff see only their assigned clients; temporary access when needed |
| Keeping everything forever | More data to lose, and against the "only as long as needed" rule | Retention periods per document type, deletion with a record |
| No record of who opened what | You can't investigate a leak or show you were careful | An activity record of every open, download and share |
A DPDP checklist for your firm before 13 May 2027
- List what personal data you hold, where (laptops, email, WhatsApp, pen drives, cloud folders) and who can see it.
- Write a short privacy notice for clients and add a consent clause to your engagement letter.
- Record each client's consent - including for WhatsApp messages.
- Move document collection out of WhatsApp groups and email into one secure place.
- Give every person their own login. Remove shared passwords.
- Limit access: staff to their own clients; KYC and bank documents to partners and managers.
- Keep an activity record of who opened, downloaded and shared what - for at least a year.
- Decide how long to keep each kind of document, with your partners, and delete the rest with a record.
- Share documents with banks and lenders through expiring links, not attachments.
- Set up a way for clients to ask for a copy, a correction or deletion, and track replies.
- Prepare a breach plan: who decides, who tells the Board, CERT-In and clients, and draft messages.
- Check your software and cloud providers: where data is stored, who can access it, and your contract with them.
- Train your team - especially new articles - in the new way of working.
What are the penalties?
| Failure | Maximum penalty |
|---|---|
| Not taking reasonable security safeguards to prevent a breach | Up to ₹250 crore |
| Not notifying the Board and affected people of a breach | Up to ₹200 crore |
| Not meeting the duties for children's data | Up to ₹200 crore |
| Other breaches of the Act or Rules | Up to ₹50 crore |
These are ceilings in the Schedule to the Act. The Data Protection Board decides the actual amount, looking at things like how serious the breach was, how long it lasted and what the firm did to limit harm. The bigger risk for most firms is the loss of clients' trust.
How RoSync helps
RoSync for CA is practice software made for Indian CA firms by SoftSync Lab. Its optional Document Vault & DPDP pack builds the checklist above into daily work:
- One vault per client, by financial year and category, with files from WhatsApp and upload links filed automatically.
- Access control: staff see only their clients; PAN, Aadhaar and bank documents only partners and managers, with a reason recorded each time one is opened.
- An activity record that can't be changed - every open, download, share and deletion, with a check that proves nothing was altered.
- Secure sharing: expiring links with an email code, download limits and a watermark on every page.
- Retention and deletion: periods per category, a "due for deletion" list for partner approval, a deletion record, legal hold and client-exit export.
- Client sign-in with a one-time code, privacy notice and consent record, and requests for a copy, correction or deletion with a reply date.
- Breach register with 6-hour and 72-hour clocks and draft messages to the Board and clients.
- A data-protection health page you can show a client or an auditor.
RoSync helps your firm meet these duties; it doesn't replace legal advice or your firm's own decisions.
See the Document Vault in the demo
Open the demo CA firm and look at the vault, the data protection page and the breach register.
Also read: CA compliance calendar 2026-27 and how to choose CA practice management software in India.
Frequently asked questions
Does the DPDP Act apply to small CA firms?
Yes. A CA firm decides why and how its clients' personal data is used, so it is a Data Fiduciary under the DPDP Act, 2023. There is no general exemption for small firms; the government can exempt notified classes of fiduciaries, so check whether any notification applies to you.
When do the DPDP Rules apply to CA firms?
The DPDP Rules, 2025 were notified on 13 November 2025. A few rules applied straight away and the consent manager rule follows a year later, but most duties - notice, security safeguards, breach reporting, retention and client rights - apply from 13 May 2027.
How quickly must a CA firm report a data breach?
Under the DPDP Rules, the firm must inform the Data Protection Board without delay and send a detailed report within 72 hours of becoming aware of the breach, and tell the affected clients without delay. Separately, CERT-In's 2022 directions require reportable cyber incidents to be reported to CERT-In within 6 hours.
Can a client ask a CA firm to delete their ITRs and records?
A client can ask for their personal data to be erased, but the DPDP Act allows a firm to keep data that another law requires it to keep. The firm should explain what it must keep (and for how long) and delete the rest. Take advice on the retention periods that apply to each kind of record.
How long does a CA firm have to answer a client's data request?
The DPDP Rules ask firms to publish how clients can make requests and to respond to grievances within a reasonable period of not more than 90 days. Many firms aim for 30 days.
What is the penalty for a data breach under the DPDP Act?
The Schedule to the Act sets maximum penalties: up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach. These are ceilings; the Data Protection Board decides the actual amount.
Sources
- Ministry of Electronics and IT (MeitY) - the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025
- Press Information Bureau - explainer on the DPDP Rules, 2025 (November 2025)
- CERT-In - directions of 28 April 2022 on reporting cyber incidents