Most CA firms don't have a tax knowledge problem. They have a client-document control problem.

Yes. CA firms process substantial personal data including PAN, Aadhaar, bank details, salary records, and tax documents. This makes them Data Fiduciaries under the Digital Personal Data Protection Act, 2023. Obligations apply to all firms regardless of size, including sole practitioners.

You can, but with controls. Cloud storage platforms like Google Drive are Data Processors under DPDPA. You must have a Data Processing Agreement in place, restrict folder access to only those who need it, and disclose this storage in your client engagement terms or privacy notice.

DPDPA requires deletion once purpose is served. For CA firms, practical retention periods are: ITR copies and supporting documents — 7 years; employee records — 5 years after employment end; KYC documents — as required by applicable law (Income Tax Act, PMLA). Define these periods formally and implement annual deletion reviews.

Yes. Any contractor or outsourced vendor who accesses client personal data on your behalf becomes a Data Processor under DPDPA. You must sign a Data Processing Agreement that restricts their use of the data, requires them to follow your instructions, and mandates adequate security measures.

Yes. Under Section 13 of the DPDPA, individuals have a right to erasure of personal data that is no longer needed for the original purpose. However, if you are legally required to retain records (e.g., under the Income Tax Act), you can decline deletion for that specific data. You must inform the client of the legal basis for continued retention.