How to Collect Client Documents Without WhatsApp

Short answer: To collect client documents without WhatsApp, give every engagement a written checklist of what you need, one place for the client to upload it (a client portal or a firm-controlled email address), a fixed file-naming rule, version history instead of "final_v3" files, and a named person who follows up on fixed days. WhatsApp is risky because files sit on personal phones, access can't be withdrawn when someone leaves, and there is no audit trail the firm controls, which matters under the DPDP Act's security and logging duties.

Last updated 22 October 2026. DPDP references are to the Act and the DPDP Rules 2025 as published by MeitY; MyPract details are from our facts page and the product. This is practical guidance, not legal advice.

In most Indian CA offices, documents arrive the way clients find easiest: a photo of a Form 16 on WhatsApp, a bank statement forwarded to an article assistant's personal number, a zip file on email at 11 p.m. before a due date. The work gets done, but nobody can say later who received what, where the latest copy is, or who still has a client's Aadhaar on their phone. This guide sets out a document request process that works with or without software, then shows how it runs in a practice management tool. For the wider tool choice, see our guide to the best practice management software for CA firms.

Why is WhatsApp risky for collecting client documents?

WhatsApp is a good messaging app. It is a poor filing system for a firm that holds bank statements, PAN and Aadhaar copies, salary details and financial statements for hundreds of people.

• Files live on personal phones. Media often saves to the phone's gallery and backs up to a personal cloud account. The firm doesn't control either.
• You can't withdraw access. When an article assistant finishes training or a staff member leaves, the chats and files leave with them.
• No access control. Anyone in a group sees everything sent to it. One file sent to the wrong group reaches every member.
• No audit trail the firm owns. You can't produce a log of who received a document, who opened it or where it was forwarded.
• No versions. "Use the revised one" means scrolling up a chat to guess which file is current.

The legal angle is the DPDP Act 2023. A CA firm is usually the data fiduciary for its clients' personal data, and the Act requires reasonable security safeguards to prevent a personal data breach.^[1] Rule 6 of the DPDP Rules 2025 spells these out: encryption or masking, access control, logs and monitoring to detect unauthorised access, and keeping those logs for a year.^[2] Rule 7 requires a detailed breach report to the Data Protection Board within 72 hours of becoming aware of a breach.^[2] Most of these duties apply from around mid-May 2027; our DPDP Act checklist for CA firms has the dates. It is hard to show access control and logs for documents scattered across a dozen phones.

What does a good document request process look like?

The point is one channel and one owner per engagement. Clients adapt quickly when every request comes the same way and every reply goes to the same place.

What should a document checklist for each engagement include?

Write a standard checklist for each service line and copy it into each new engagement. Keep it in plain language the client can follow. Typical items:

Two habits help. First, state the period for every item ("April 2025 to March 2026"), so you don't receive the wrong year. Second, mark items the client has already given you once, such as PAN or registration certificates, so you don't ask again. For audits, our statutory audit engagement checklist lists the full set.

How should you name and version client files?

A naming rule saves hours at deadline time, because anyone in the firm can find a file without opening it. One pattern that works:

CLIENTSHORTNAME_FY_DocumentType_Detail_Period

For example, SHARMATEX_FY2025-26_BankStmt_HDFC_Apr-Mar.pdf or KAPOOR_FY2025-26_Form16_Infosys.pdf.

• Use the same short name for a client everywhere, ideally the one in your client list.
• Use the financial year format your firm already uses, and never mix "2025" and "FY2025-26".
• Don't add "final", "v2" or "revised" to names. When a client sends a corrected file, upload it as a new version of the same document, so the old one stays in the history and the name stays the same.
• Rename on the day of receipt. A folder of "IMG_2041.jpg" files is where a missed document hides.

How do you chase missing documents without automated reminders?

Many practice tools, including MyPract, do not send automated client reminders, so the follow-up has to be a routine. A simple one:

1. Day 0: send the checklist with a due date at least a week before you need it.
2. Day 3: one message listing only what is still missing.
3. Day 7: a phone call from the engagement manager, not the article assistant.
4. Due date: record what is still outstanding on the engagement, so the delay is visible in your reports and in any later fee conversation.

Create each follow-up as a task with a due date and an owner, so it appears in that person's work list and doesn't depend on memory. If chasing is your biggest problem, a tool with built-in reminders may suit you better; our client portal comparison lists which ones include them.

How does this work in MyPract?

MyPract runs the process above inside each engagement:

• A portal per engagement. Each engagement has its own link. It opens only for the client contacts you have mapped to that engagement, after a 6-digit code sent to their email, so there is no password to forget. Portal clients are not charged as users.
• Uploads and messages in one place. Clients upload files of up to 50 MB each and send messages. Uploads land in the engagement's documents, marked as client uploads.
• Status the client can see. The portal shows the engagement's status and its task list, so a checklist kept as tasks doubles as the client's to-do list. Because clients see every task title in the engagement, write titles a client can read.
• Versions and links. Documents sit in folders by client and engagement with version history and in-browser preview, and downloads use signed links that expire.
• Who saw what. An activity log records changes, and Owners and Admins can limit team members to selected clients, so an article assistant sees only the clients they work on.
• Where the data is. Data domicile by country: a paying firm outside India gets its own instance in its country, so its database, files and server functions stay in-country. Today, with customers in India, everything runs in Mumbai (AWS ap-south-1) through Supabase. Access is enforced with row-level security per workspace.

What it doesn't do: MyPract does not integrate with WhatsApp, has no native mobile app (the portal is a web page that works in a phone browser), sends no automated client reminders, and gives each engagement its own link, so a client with three engagements has three links. Details are on our facts page.

What if a client insists on WhatsApp?

Some will, especially older proprietors and family clients. Don't fight every case; contain it:

• Use a firm-owned number on a firm-owned phone, never a staff member's personal number.
• Upload what arrives to the engagement the same day, renamed to your convention, and then delete it from the phone.
• Never forward client documents between staff on WhatsApp; share the link to the stored file instead.
• Send the portal link in reply each time ("Received, thank you. Next time please upload here"). Most clients switch within a filing season.

Firms planning a broader move away from spreadsheets and chat can use our one-week migration plan.

How we checked

We relied on the DPDP Act 2023 and the DPDP Rules 2025 as published by MeitY, which we checked on 13 October 2026 for our DPDP checklist; MeitY's site blocked our automated re-check on 14 October 2026, and we found no amending notification. MyPract details, including the 50 MB upload limit and how portal access works, were checked against the product and our facts page on 14 October 2026. Competitor reminder features come from our client portal comparison, checked on 13 October 2026. No prices or exchange rates are used; MyPract's prices are on the pricing page.

Frequently asked questions

Is it illegal for a CA firm to collect documents on WhatsApp?

No law we know of bans it. But under the DPDP Act 2023 the firm is usually the data fiduciary for its clients' personal data and must keep reasonable security safeguards, including access control and logs. Files spread across staff phones make that hard to show. See our DPDP checklist.

Does MyPract integrate with WhatsApp?

No. MyPract has no WhatsApp integration. Clients upload documents and send messages through the engagement's portal, which opens in any browser, including a phone browser, after a 6-digit code sent to their email.

Does MyPract send automatic reminders to clients for missing documents?

No. MyPract does not send automated client reminders. Use a task with a due date for each follow-up and send the reminder yourself. Content Snare, Karbon and Financial Cents include automated client reminders on some plans; see our client portal comparison.

What is a good file-naming convention for client documents?

Client short name, financial year, document type and period, for example SHARMATEX_FY2025-26_BankStmt_HDFC_Apr-Mar.pdf. Keep versions in the document's version history rather than adding 'final' or 'v2' to the name.

How large can client uploads be in MyPract's portal?

Up to 50 MB per file. Uploads land in the engagement's documents, marked as client uploads, so the team sees them in the same place as their own files.

Try a WhatsApp-free engagement in MyPract

Pick one engagement, map the client's contacts, send the portal link with your checklist, and see how many documents arrive in the right place. Three months free, no card, and the trial never converts automatically.

Sources

[1] Ministry of Electronics and Information Technology, "The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)", checked 13 October 2026.

[2] Ministry of Electronics and Information Technology, "Digital Personal Data Protection Rules, 2025", G.S.R. 846(E), Gazette of India dated 13 November 2025, checked 13 October 2026.