DPDP for Chartered Accountants: A Compliance Guide for CA Firms

Chartered Accountants sit on a mountain of sensitive personal data — client PANs, bank statements, financials, payroll, employee records. Under India's DPDP Act 2023, a CA firm is a Data Fiduciary, with the full weight of the law's obligations. This guide covers how the Act applies to your practice, what you must do, and how to advise your clients.

Quick Answer: How Does DPDP Apply to a CA Firm?

A CA firm collecting client PAN, financials and payroll decides the purpose and means of processing, so it is a Data Fiduciary under Section 2(i) and must meet the Act's obligations — lawful basis, notice, security, breach reporting and deletion. Its software vendors are Data Processors, but responsibility stays with the firm. Larger practices may be designated Significant Data Fiduciaries (Section 10).

Why Your Firm Is a Data Fiduciary

You decide what client data to collect, why, how long to keep it, and who to share it with. That makes your firm a Data Fiduciary under Section 2(i), and the primary obligations of the Act fall on you. It doesn't matter whether you're a sole practitioner or a multi-partner firm.

Fiduciary vs Processor: Where Your Vendors Sit

When you use cloud accounting software, a document-management system, or a payroll tool, those vendors typically act as Data Processors on your behalf. You remain the Data Fiduciary and stay legally responsible — so you need data-processing terms with each vendor and should confirm they apply reasonable safeguards. Large firms holding substantial financial data could be notified as Significant Data Fiduciaries (Section 10), triggering extra duties: an India-based Data Protection Officer, an independent data auditor, and periodic impact assessments.

Your Core Obligations as a CA Firm

• Notice & consent (Sections 5, 6): give clients a clear, itemised notice and obtain valid consent for processing that isn't covered by a legitimate use. See our consent notice template.
• Security (Section 8(5), Rule 6): encrypt or mask stored client data, control access firm-wide, keep access logs, and contract your processors to do the same.
• Breach reporting (Section 8(6)): have a plan to intimate the Board and affected clients — see the 72-hour breach rule.
• Erasure (Section 8(7)): delete personal data once its purpose ends — but only after statutory retention periods (below) have passed.
• Client rights (Sections 11–14): be ready to handle access, correction and erasure requests — including from your clients' employees whose payroll you process.

Retention: DPDP vs Your Statutory Duties

DPDP says delete data when the purpose ends — but other laws require you to keep records:

The practical rule: keep what a statute requires you to keep, and delete the rest once the engagement is over.

A Note on Sensitive Data

Unlike the GDPR or the old IT Act SPDI rules, the DPDP Act has no separate "sensitive personal data" category — financial data is treated under the same baseline obligations as any other personal data. If your firm ever processes data of individuals under 18 (uncommon in practice), the stricter children's-data rules in Section 9 also apply.

Advising Your Clients

DPDP is also an advisory opportunity. Your SMB clients look to you to interpret compliance obligations, and many will need help with notices, consent and record-keeping. ICAI has recognised this by launching a Data Protection Compliance & Audit Certification programme and DPDP tooling for members — so upskilling here is well supported. Point clients to our SMB checklist and applicability guide, and use the free DPDP checker in client conversations.