India had about 4.23 lakh chartered accountants on 1 April 2025, and roughly 1.61 lakh of them were in practice. Almost every practice holds PAN numbers, bank statements, salary details and financial records for its clients, which makes the firm a Data Fiduciary under the Digital Personal Data Protection Act, 2023. The DPDP Rules, notified in November 2025, give firms 18 months to be fully ready. This checklist turns the law into practical steps for a CA firm.
Why a CA firm is a Data Fiduciary
The DPDP Act applies to digital personal data, and to personal data collected on paper and later digitised. A CA firm decides why and how client data is processed: for returns, audits, payroll or advisory work. That makes it a Data Fiduciary. Where a firm processes data on behalf of a corporate client, for example running its payroll, the client may be the Fiduciary and the firm its Data Processor, bound by contract.
Either way, the firm needs to know what personal data it holds, where it sits and who can reach it. Most practices find client data spread across email, shared drives, accounting software, WhatsApp and staff laptops.
The timeline after the 2025 Rules
The Ministry of Electronics and IT notified the DPDP Rules in November 2025. The government describes an eighteen month window for phased compliance, so most duties on Data Fiduciaries, such as notices, security safeguards, breach intimation and rights handling, apply from the end of that window. Firms should treat the window as build time, not waiting time, because a data map, policies and access controls take months in a busy practice.
The client data checklist
Start with a simple register of every type of client data the firm collects and the reason for each. Then set clear retention periods tied to legal and professional requirements, and delete or archive what is no longer needed.
- Data map: PAN, Aadhaar copies, bank statements, salary data, financials, where each is stored.
- Notice: a plain language privacy notice for individual clients, linked from engagement letters.
- Consent or legitimate use: record the basis for each processing purpose.
- Access: named logins only, no shared office accounts, remove leavers the same day.
- Retention: a written schedule per document type, reviewed yearly.
- Vendors: contracts with software and cloud providers that process client data.
Security safeguards that matter most
The largest penalty in the Act, up to ₹250 crore, is for failing to take reasonable security safeguards to prevent a personal data breach. For a CA firm, reasonable usually means multi-factor authentication on email and cloud drives, encrypted laptops, regular backups, patching and an access review at least every quarter.
Email remains the main way client data leaves a firm, through misdirected messages and phishing. A short training session before each filing season, when staff are under pressure, prevents many incidents.
Breach notices and rights requests
If a personal data breach happens, the firm must inform affected individuals without delay in plain language, covering what happened, the likely impact, the steps taken and a contact point, and must also report to the Data Protection Board. Failing to notify carries a penalty of up to ₹200 crore.
Clients can ask to access, correct, update or erase their data. The Rules give a maximum of ninety days to address these requests. A shared inbox, a request log and a named owner are usually enough for a small or mid-size practice.
| Duty | What the firm does | Owner |
|---|---|---|
| Breach notice | Inform clients without delay and report to the Board | Managing partner |
| Rights request | Respond within 90 days, log every request | Practice manager |
| Access review | Quarterly review of all logins | IT lead or partner |
| Retention | Yearly purge per schedule | Practice manager |
Staff use of AI tools
Staff increasingly paste client data into AI tools to draft notes or summarise statements. IBM's 2025 research found shadow AI, meaning unsanctioned AI use, among the top three factors adding to breach costs in India, adding INR 17.9 million on average, and only 42% of organisations had policies to manage AI or detect shadow AI.
A practical policy lists approved tools, says which client data may never be pasted into them, and requires a partner to review any AI-drafted output before it reaches a client.
How to start this month
Pick one owner, build the data map in a spreadsheet, turn on multi-factor authentication everywhere and write the AI use policy. Those four steps cover the largest risks. XDQ Labs offers a free course on data protection, cyber security and AI for CA firms, with short lessons and quizzes, if you want to train your team.
Frequently asked questions
Does the DPDP Act apply to small CA firms?
Yes. The Act applies to any person or firm that processes digital personal data in India, regardless of size. Small practices still hold PAN, bank and salary data for individual clients, so they must give notice, keep reasonable security safeguards and handle breaches and rights requests.
When do CA firms need to comply with the DPDP Rules?
The DPDP Rules were notified in November 2025 with an eighteen month window for phased compliance. Most duties on Data Fiduciaries apply at the end of that window, so firms should use the time to map data, write policies and fix access controls.
What is the maximum DPDP penalty for a breach?
Failing to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to ₹250 crore. Failing to notify the Board or affected individuals of a breach can attract up to ₹200 crore.
Can CA firm staff use AI tools on client data?
Only under a clear policy. List approved tools, ban pasting sensitive client data into tools that are not approved, and require a partner to review AI-drafted work. IBM found that only 42% of organisations had policies to manage AI or detect shadow AI in 2025.
Sources
- India has around 4.23 lakh active CAs, Juris Hour, 2026
- Digital Personal Data Protection Rules, 2025 (backgrounder), Press Information Bureau, 2025
- India Records Highest Average Cost of a Data Breach, IBM India Newsroom, 2025
- 6 Hours To Report Cyber Incidents To CERT-In, Mondaq, 2022
- India's Digital Personal Data Protection Act 2023 brought into force, Hogan Lovells, 2025
- The Digital Personal Data Protection Act, 2023, NeGD, 2023
