Industry Guide

DPDPA for CA Firms and Accounting Practices

CA firms handle some of the most sensitive personal data in routine business operations: PAN, Aadhaar, payroll records, bank details, tax files, and employee documents. DPDPA adds practical obligations around access control, vendor governance, retention, rights handling, and internal accountability. This guide helps CA firms move from professional confidentiality to operational privacy discipline.

If everyone in the office can open every client folder, that is not collaboration. It is exposure with good lighting.

Key Risk Areas

PAN and Aadhaar Documents

High Risk

Physical and digital copies of PAN, Aadhaar, and passport documents collected for tax filings and KYC create significant exposure if not handled with strict controls.

Action: Collect only what is necessary. Define retention limits. Store with access restrictions. Consider whether physical copies need to be retained or can be destroyed post-filing.

Client Payroll Data

High Risk

Processing payroll means handling salary details, bank account numbers, PF/ESI data, and personal employment information of multiple individuals per client.

Action: Implement role-based access so only payroll team members can access employee records. Define retention periods. Sign DPAs with payroll software vendors.

Cloud Storage and Shared Drives

High Risk

Google Drive, Dropbox, or Tally on cloud with broad team access creates unmanaged exposure of sensitive client personal data.

Action: Audit who has access to what. Implement folder-level access controls. Ensure cloud vendors have signed DPAs and hold appropriate certifications.

Third-Party Contractors

Medium Risk

Outsourced accounting staff, IT vendors, or back-office processors who access client data without formal agreements create liability.

Action: Sign Data Processing Agreements with all contractors accessing client personal data. Restrict access to minimum necessary data.

Retention of Client Files

Medium Risk

Keeping digital copies of client documents indefinitely without a defined deletion process creates both legal risk and security exposure.

Action: Define retention periods for each document category (ITR copies: 7 years; employee documents: 5 years from exit). Implement annual deletion reviews.