DPDP Act 2023 Checklist for CA Firms
Short answer: The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 apply in phases. The main duties on data fiduciaries start 18 months after the Gazette notification of 13 November 2025, which is around mid-May 2027.[2][3] A CA firm is usually a data fiduciary for its clients' and staff's personal data. Before the deadline it should map its data, issue clear notices, tighten security and logging, prepare to report breaches within 72 hours, set retention periods, check for children's data, and put contracts in place with every vendor that processes personal data for it.
Last updated 22 October 2026. Based on the Act and Rules as published by MeitY and the commencement notification in the Gazette. This is a practical checklist, not legal advice: take advice on your firm's specific services, and check for amendments before relying on any date.
When do the DPDP Act and Rules apply?
MeitY published the Rules (G.S.R. 846(E)) and the commencement notification for the Act (G.S.R. 843(E)) in the Gazette dated 13 November 2025. PIB announced the Rules on 14 November 2025, so some summaries use that date.[2][3][4]
| Phase | When | What comes into force |
|---|---|---|
| 1 | On publication, November 2025 | Definitions, the Data Protection Board and its procedure (Act ss.1(2), 2, 18–26, 35, 38–43; Rules 1, 2, 17–21) |
| 2 | One year after publication, November 2026 | Consent Manager registration (Act s.6(9), s.27(1)(d); Rule 4) |
| 3 | Eighteen months after publication, around mid-May 2027 | The main obligations: notice, consent, legitimate uses, fiduciary duties, children's data, rights, cross-border transfer, penalties (Act ss.3–17, 28–34 and others; Rules 3, 5–16, 22, 23) |
For a CA firm, phase 3 is the one that matters. Count back from the earliest reading of the date (13 May 2027) and check the e-Gazette for amendments.
Is a CA firm a data fiduciary or a data processor?
The Act defines a data fiduciary as the person who decides the purpose and means of processing personal data, and a data processor as anyone who processes personal data on a fiduciary's behalf.[1]
- Your own staff, partners and article assistants: you are the fiduciary.
- Client contacts, proprietors, directors, partners and individual taxpayers: usually the fiduciary, because you decide what you collect to deliver the service.
- Data you process purely on a client's instructions (for example, the client's employee data for a payroll service): possibly a processor for that client. Agree the role in writing.
- Your software vendors (practice management, cloud storage, email): usually your processors.
The Act applies to digital personal data, and to paper records once they are digitised, so scanned KYC documents count.[1]
The DPDP checklist for CA firms
| # | Action | Owner | Evidence | Act / Rules |
|---|---|---|---|---|
| 1 | Map the personal data you hold: whose, what, where, why, which vendor | Partner, IT | Data inventory | s.8(1), s.8(4) |
| 2 | Decide the ground for each use: consent or a legitimate use such as a legal obligation | Partner | Purpose register | s.4, s.7 |
| 3 | Issue a standalone notice with an itemised list of data and purposes | Partner | Notice text, delivery record | s.5; Rule 3 |
| 4 | Make withdrawing consent as easy as giving it | Admin | Withdrawal process | s.6; Rule 3(c) |
| 5 | Send notices to existing clients whose consent predates commencement | Admin | Notice log | s.5(2) |
| 6 | Apply security safeguards: encryption or masking, access control, logs, backups | IT | Security policy, access review | s.8(5); Rule 6 |
| 7 | Keep access logs for at least one year | IT, vendors | Log retention setting | Rule 6(1)(e); Rule 8(3) |
| 8 | Write a breach response plan with the 72-hour Board report | Partner | Breach plan, contact list | s.8(6); Rule 7 |
| 9 | Set retention periods and erase data when the purpose ends, unless law requires keeping it | Partner | Retention schedule | s.8(7); Rule 8 |
| 10 | Publish a contact for data questions and a grievance process | Admin | Website page | s.8(9), s.8(10); Rules 9, 14 |
| 11 | Respond to access, correction and erasure requests within 90 days | Admin | Request log | ss.11–14; Rule 14 |
| 12 | Identify children's data and obtain verifiable parental consent where needed | Partner | Consent records | s.9; Rule 10 |
| 13 | Check where vendors store and process data | Partner, IT | Vendor register | s.16; Rule 15 |
| 14 | Sign contracts with every processor, including security and erasure terms | Partner | Signed agreements | s.8(2); Rule 6(1)(f) |
| 15 | Train staff on handling, sharing and reporting incidents | Partner | Training record | s.8(4) |
Try MyPract free for 3 months
No card required, and the trial never converts to a paid plan automatically.
Start your free trialWhat must the notice say?
Every request for consent must be accompanied or preceded by a notice. The Rules require it to stand on its own, in clear and plain language, with an itemised description of the personal data, the specific purposes, and how the person can withdraw consent, exercise their rights and complain to the Board.[1][2] Withdrawal must be comparable in ease to giving consent.
Not everything a CA firm does needs consent. Section 7 allows processing for certain legitimate uses, including fulfilling an obligation under any law to disclose information to the State.[1] Map each purpose to its ground; don't ask for consent you can't let people withdraw.
What security safeguards do the Rules require?
Rule 6 sets the minimum for reasonable security safeguards, covering processing by you and by your processors:[2]
- encryption, obfuscation, masking or tokenisation of personal data;
- access control over the computer resources used;
- logs, monitoring and review to detect and investigate unauthorised access;
- measures such as backups to keep processing going after an incident;
- retention of those logs and personal data for one year, unless another law requires otherwise;
- security terms in the contract with each data processor.
For a typical firm this means: no shared logins, role-based access, client files out of personal email and WhatsApp, and a vendor that can show you access logs.
How do you handle a personal data breach?
Under rule 7, on becoming aware of a breach you must tell each affected person, without delay, what happened, the likely consequences, what you are doing and what they can do, with a contact. You must also tell the Data Protection Board without delay, and send a detailed report within 72 hours, unless the Board allows longer on a written request.[2]
Penalties are steep. PIB's summary of the framework puts the maximum at ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for failing to notify a breach.[4] Write the plan now: who decides, who notifies, and which vendor contacts you need at 2 a.m.
How long can a CA firm keep client data?
The Act requires erasure once consent is withdrawn or the purpose is no longer served, unless retention is necessary for compliance with a law in force, and you must make your processors erase it too.[1] CA firms have real retention duties. For example, ICAI's SQC 1 requires audit documentation to be kept ordinarily for at least seven years from the date of the auditor's report.[5] Build a retention schedule by record type and name the law or standard behind each period. Separately, rule 8(3) requires processing logs to be kept for at least one year.[2]
Do CA firms process children's data?
Often, without noticing: minors' income clubbed with a parent's return, PAN applications for minors, beneficiaries of family trusts, members of an HUF. The Act treats anyone under 18 as a child and requires verifiable consent from a parent before processing a child's personal data. It also bars tracking, behavioural monitoring and targeted advertising directed at children.[1] Rule 10 sets out how to check that the person consenting is an identifiable adult.[2] Flag minors in your client records and record the parent's consent.
Can client data be stored outside India?
The Act doesn't require data to stay in India. It lets the government restrict transfers to countries it notifies, and sector laws with stricter rules still apply.[1] Rule 15 adds that transfers must meet any government requirements on making data available to a foreign State.[2] In practice, know where every vendor stores and processes your data, including backups and support access, so you can respond if a restriction is notified. Many firms simply prefer India-hosted tools.
What should your vendor (processor) contracts say?
The Act says a fiduciary may use a processor only under a valid contract, and the fiduciary stays responsible for what the processor does.[1] Each contract should cover:
- processing only on your instructions and for your purposes;
- the security safeguards in rule 6, including access logs kept for a year;
- prompt notice to you of any breach, with the details you need for the Board's 72-hour report;
- erasure or return of data at the end of the contract, subject to legal retention;
- sub-processors and the countries they operate in.
What questions should you ask software vendors?
| Question | Why it matters |
|---|---|
| Where are the database, file storage and backups hosted? | Cross-border exposure (s.16) |
| Which sub-processors do you use, and where? | Your processor's processors are your risk too |
| How is one firm's data isolated from another's? | Security safeguards (Rule 6) |
| What roles and permissions exist? Can staff see only what they need? | Access control (Rule 6) |
| Is there an activity or access log, and can we export it? | Logs and investigation (Rule 6) |
| How fast will you tell us about a breach, and with what detail? | Your 72-hour report (Rule 7) |
| Can we export all our data, and how is it erased when we leave? | Erasure duties (s.8(7)) |
| Will you sign a data processing agreement? | Valid contract (s.8(2)) |
Our own answers for MyPract, a global, AI-native practice management platform for accounting, audit, tax and advisory teams, come from our facts page. Data domicile by country: a paying firm outside India gets its own instance in its country, so its database, files and server functions stay in-country. Today, with customers in India, everything runs in Mumbai (AWS ap-south-1) through Supabase. Every row belongs to a workspace and access is enforced in the database with row-level security; there are six roles (Owner, Admin, Manager, Staff, Viewer, Client), which bind the AI assistant as well as people; there is an activity log with CSV export; documents use signed, expiring download links; when an AI feature is used, the text it works on goes to Anthropic's API outside that hosting, and Owners and Admins can switch AI off; and the privacy policy is written for the DPDP Act 2023. Ask us the remaining questions directly, as you would any vendor. Our comparison hub and the best practice management software for CA firms cover where other tools host data; MyPract vs TaxDome compares the two tools, including where each hosts data. Prices are on the pricing page.
How we checked
We read the DPDP Act 2023 and the DPDP Rules 2025 as published by MeitY, the commencement notification G.S.R. 843(E), PIB's November 2025 backgrounder on the Rules and ICAI's SQC 1 retention announcement, all on 13 October 2026. Section and rule numbers are from those texts. Dates "after publication" are counted from the Gazette of 13 November 2025. We didn't find an amending notification, but check MeitY and the e-Gazette before relying on any date. No prices or exchange rates are used.
Frequently asked questions
When do CA firms have to comply with the DPDP Act?
Most obligations on data fiduciaries (notice, consent, security, breach intimation, retention, children's data and data principal rights) come into force 18 months after the Gazette notification of 13 November 2025, which is around mid-May 2027. Check MeitY and the e-Gazette for any amendment before relying on the date.
Is a CA firm a data fiduciary or a data processor?
For its own staff and its relationships with clients, a CA firm decides why and how personal data is processed, so it is a data fiduciary. Where it processes personal data purely on a client's instructions, for example running a client's payroll, it may act as that client's processor. Take advice on each service line.
How quickly must a personal data breach be reported?
Under rule 7 of the DPDP Rules, the fiduciary must inform each affected person and the Data Protection Board without delay, and give the Board a detailed report within 72 hours of becoming aware, unless the Board allows longer on a written request.
Can a CA firm keep client records after the engagement ends?
Yes, where another law or professional standard requires it. The Act's erasure duty applies unless retention is necessary for compliance with a law in force. Write down which law or standard sets each retention period.
Is MyPract DPDP compliant?
No software makes a firm compliant by itself, because the firm is the data fiduciary. MyPract is a global platform. Data domicile by country: a paying firm outside India gets its own instance in its country, so its database, files and server functions stay in-country. Today, with customers in India, everything runs in Mumbai (AWS ap-south-1) through Supabase. It enforces workspace isolation with row-level security, offers six roles and an activity log, and has a privacy policy written for the DPDP Act 2023. Ask us, and every other vendor, the questions in this checklist.
Keep client data in India with MyPract
A global, AI-native practice management platform with data domicile by country (today Mumbai for Indian firms), role-based access, an activity log and a privacy policy written for the DPDP Act. Three months free, no card.
Try MyPract free for 3 months
No card required, and the trial never converts to a paid plan automatically.
Start your free trialSources
[1] Ministry of Electronics and Information Technology, "The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)", checked 13 October 2026.
[2] Ministry of Electronics and Information Technology, "Digital Personal Data Protection Rules, 2025", G.S.R. 846(E), Gazette of India dated 13 November 2025, checked 13 October 2026.
[3] Ministry of Electronics and Information Technology, "Notification G.S.R. 843(E): commencement of the Digital Personal Data Protection Act, 2023", 13 November 2025, checked 13 October 2026.
[4] Press Information Bureau, "DPDP Rules, 2025 Notified", 17 November 2025, checked 13 October 2026.
[5] ICAI, "Announcement on amendment to SQC 1: retention period for engagement documentation", 21 August 2009, checked 13 October 2026.
Related reading
- MyPract vs TaxDome: All-in-One Breadth or AI-Native Value?Looking for a TaxDome alternative? MyPract is a global, AI-native platform that costs under 6% of TaxDome Pro for 10 users, with no multi-year lock-in.
- MyPract vs Zoho Practice: Which Is Better for Indian CA Firms in 2026?Looking for a Zoho Practice alternative? MyPract works whatever ledger your clients use, includes a client portal and bills approved time.
- MyPract vs Karbon: Collaboration-First Workflow at a Fraction of the PriceLooking for a Karbon alternative? MyPract costs US$490/yr for 10 users, offers a 3-month trial instead of a demo, and adds time approvals.
Start with the best practice management software for CA firms, or see every comparison, MyPract pricing, all features or MyPract at a glance.