CA, Tax and Accounting Firms: A DPDP Act Impact Study

Executive summary

Overall impact: High.

This study covers chartered accountancy firms, tax and GST practitioners, bookkeeping and payroll outsourcers, and company secretaries in practice. From sole practices to national networks, each holds dense financial data about many people, and often the passwords and signing keys those people use to deal with the State.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) has no professional-services carve-out and no size threshold. Six of the twelve areas in our scorecard rate High.

Three changes matter most.

• A firm's role depends on the client. Running a company's payroll or books, a firm acts on instructions as a data processor. Preparing an individual's return, or forming its own audit opinion, it decides why and how data is used and is, in our view, a data fiduciary with the full set of duties.
• Credentials become the main security risk. Portal passwords and digital signature tokens held for clients are the most sensitive data in the office. Security safeguards under s.8(5) carry penalties of up to ₹250 crore and survive the s.17(1) exemptions.
• Retention needs a schedule, not a habit. Auditing standards, company, GST, anti-money-laundering and income-tax law set different periods. The Act allows retention the law requires, and expects erasure after it.

The Act's main obligations commence on 13 May 2027. The Central Government has not notified any exemption for startups or small entities under s.17(3), so a three-person practice carries the same duties as a network firm.

Background

• Audit. Statutory, tax and internal audits, and forensic reviews. Working papers hold extracts of payroll, customer and vendor ledgers, and related-party lists naming directors' relatives.
• Tax. Individual returns, TDS statements, GST returns, and assessments and appeals. Individual clients send bank statements, salary slips, capital gains statements, rent receipts carrying the landlord's PAN, and medical and insurance bills.
• Bookkeeping and payroll. Outsourced accounting, salary processing, and provident fund and ESI filings, all about the client's employees.
• Company secretarial. Registers of members and directors and filings with the Registrar of Companies. Practices often keep directors' digital signature certificate (DSC) tokens.

The data principals, the people the data is about, include individual clients and their families; the employees, customers and vendors of business clients; directors and shareholders; and the firm's own staff, articled assistants and prospects.

Data arrives by email, messaging apps, shared drives and client portals, moves through tax utilities, accounting and payroll software, practice-management tools and, increasingly, AI tools, and goes out to the income-tax, GST, company-law and social-security portals. Typical vendors are cloud software, storage and email providers, DSC issuers and IT support firms.

Legal framework

The DPDP Act and Rules

• Roles (ss.2(i), 2(k)). A data fiduciary "determines the purpose and means of processing"; a data processor processes "on behalf of" a fiduciary. The fiduciary answers for its processors (s.8(1)) and may use them only under a valid contract (s.8(2)).
• Grounds (ss.4, 7). Consent, or a listed legitimate use. Three matter here: s.7(a), data voluntarily provided for a specified purpose; s.7(d), fulfilling an obligation under law "on any person to disclose any information to the State or any of its instrumentalities"; and s.7(i), employment.
• Security and breach (ss.8(5), 8(6); Rules 6, 7). Encryption or masking, access control, logs kept for a year and processor contract terms; breach notice to the Data Protection Board and each affected person, with a detailed report to the Board within 72 hours.
• Erasure and rights (ss.8(7), 11, 12). Erase when the purpose is served "unless retention is necessary for compliance with any law", and make processors erase. Access and correction run only against a fiduciary holding data on consent or under s.7(a).
• Exemptions (s.17). Most of the Act does not apply to processing necessary for enforcing a legal right or claim (s.17(1)(a)), or by tribunals and regulators performing judicial, quasi-judicial or supervisory functions (s.17(1)(b)); ss.8(1) and 8(5) still apply. No exemption for startups or other fiduciaries has been notified under s.17(3).

Profession and sector instruments

How the layers fit

Section 38 makes the DPDP Act additional to other laws; it prevails only in a conflict. Professional confidentiality and the Act mostly point the same way, and the confidentiality clause itself allows disclosure "as required by any law", which covers reports to the Board and to CERT-In, which expects listed cyber incidents within six hours. Section 8(7) lets statutory retention periods override erasure, and s.16(2) preserves stricter location rules such as rule 3's India backup.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Processor or fiduciary: map the practice first

The definitions turn on who decides purpose and means. Applied to a typical practice, in our view the map looks like this.

Two consequences follow. First, a processor's duties arrive through contract, and a firm without its own standard terms will sign whatever business clients send. Trayambic's vendor contracts checklist sets out the clauses, and its HR tech and staffing study covers payroll outsourcing.

Second, an individual tax practice is fiduciary business. Access and correction rights apply, and breach notices go directly to each affected client. Family data travels with the return: a spouse's investments, a landlord's PAN. Section 7(a) covers what the client supplies for the return; reusing it to sell insurance or investments needs separate consent after a Rule 3 notice.

The audit gap. The GDPR has a ground for processing needed to comply with a legal obligation; the DPDP Act does not. On our reading, a statutory auditor cannot be the company's processor, because it must decide scope and evidence independently. In our view its processing can rest on s.7(d) to the extent the audit is needed for financial statements and tax audit reports that must be filed with the Registrar or the tax department. That reading is untested, so firms should reduce the dependency: ask clients to mention audit and tax filing in their privacy notices, keep sample references rather than copies of payslips and identity documents, and record the ground in the engagement letter. Producing working papers to NFRA is, in our view, also a disclosure to a State body under law.

Disputes. Representing a client in an appeal is, in our view, processing necessary for enforcing a legal right or claim, so s.17(1)(a) lifts notice, erasure and rights duties for that file while the dispute runs. Routine filing is not covered. The same clause, with the ICAI Code's permission to disclose information to protect a member's interests in legal proceedings, supports keeping papers needed to answer a negligence claim or disciplinary complaint while that risk is live.

Credentials, signing keys and client portals

Many firms keep clients' income-tax, GST and company-law portal passwords in a shared spreadsheet, and directors' DSC tokens in a drawer with the PIN on a label. Those credentials are personal data of the client or director, and the firm's custody of them is the clearest test of "reasonable security safeguards".

The law already offers better routes.

• Income tax. The e-filing portal lets a taxpayer add a chartered accountant for a chosen validity period, assign forms and deactivate the CA at any time. A registered e-return intermediary (ERI) adds a client only after the taxpayer approves a request sent to their email and mobile within seven days, for validity dates the ERI sets, and the ERI must confirm it holds the client's signed consent. Section 515 of the Income-tax Act, 2025 lets accountants and legal practitioners appear as authorised representatives.
• GST. Under rule 83 of the CGST Rules, a client authorises a GST practitioner on the portal and can withdraw that authority at any time. The practitioner verifies statements with its own credentials, and the client confirms what is filed.
• DSCs. Section 42(1) of the IT Act requires the certificate holder to "exercise reasonable care to retain control of the private key". Section 42(2) requires the holder to tell the certifying authority without delay if the key is compromised.

Delegated access cuts what a firm holds and leaves a record on the portal. Credentials a firm must still hold belong in an access-controlled vault, limited to named staff, with retrievals logged and access revoked when the engagement ends. DSC tokens belong in a custody register, with PINs held by the director, and the incident plan must reach directors within hours, because only they can alert the certifying authority.

Retention: one schedule, five clocks

Section 8(7) lets a firm keep data as long as the law requires, and no longer. Each law runs its own clock.

Three points need care. First, for company audits, s.143(9) of the Companies Act makes compliance with auditing standards a legal duty, so in our view SA 230's period is retention "necessary for compliance with any law". For other engagements, firms can apply the same period but should record why.

Second, a processor should not lean on its client's retention duty. When a bookkeeping or payroll engagement ends, the firm should return the books and erase its copies, as s.8(7)(b) contemplates, keeping only what its own professional or legal needs require.

Third, rule 3 of the Companies (Accounts) Rules requires an audit trail that cannot be disabled, and electronic records may not be disposed of unless the law permits. A firm hosting a client's books should not purge edit logs to meet an erasure request; it should keep personal data out of narration fields from the start. Its cloud tool also becomes part of the company's record-keeping, reportable to the Registrar and backed up daily in India. Trayambic's SaaS and IT services study covers the vendor side.

Small firms and the exemption that has not arrived

Section 17(3) lets the Centre exempt notified fiduciaries, including startups, from notice, the accuracy and erasure duties in ss.8(3) and 8(7), the SDF regime and access rights. Nothing has been notified. Any notification would leave security and breach duties untouched, and the Explanation limits "startup" to private limited companies, partnerships and LLPs recognised under the Centre's startup criteria, which in our view a conventional practice is unlikely to meet.

Small firms should plan for full compliance, proportionately: one named contact under s.8(9), one data register, standard terms, a credential vault, a retention schedule and a tested incident plan.

Worked example: a nine-partner firm in Indore

The figures are illustrative. The firm audits 60 companies, files 1,800 individual returns, runs payroll for 30 small businesses with about 3,000 employees, files GST returns for 250 clients and holds 400 DSC tokens for its secretarial clients.

A partner's email account is taken over through a phishing link. The attacker forwards a folder of Form 16s and the firm's password spreadsheet.

1. 1.First six hours. The firm reports to CERT-In, resets every credential in the spreadsheet and asks affected directors to contact their certifying authorities.
2. 2.Sorting roles. The individual clients' data was held as fiduciary, so the firm notifies each affected client and the Board itself. The payroll data was held as processor, so the firm alerts each business client the same day, with a list of affected employees, so that each can notify its staff and file its own report.
3. 3.Within 72 hours. The firm sends the Board its detailed report on facts, cause, mitigation and notices sent.
4. 4.Afterwards. It moves to delegated portal access, puts DSCs into a custody register, deletes client copies that no law or live dispute requires, and adds multi-factor authentication to partner email.

Had step 4 come first, the incident would have stayed in one mailbox.

Compliance framework

Phased roadmap

• Now to December 2026: role map; inventory of credentials, DSCs and shared folders; choose a vault.
• January to March 2027: standard terms for business clients and vendors; delegated portal access; DSC register; engagement letter notices.
• April to May 2027: retention purge; incident rehearsal; rights process and published contact.
• Ongoing: review each new engagement; track Board guidance, any s.17(3) notification and ICAI and CBDT changes.

Recommendations

1. 1.Map every service line as processor or fiduciary before drafting a notice.
2. 2.Stop holding client passwords where portals offer delegated access; vault the rest.
3. 3.Treat DSC tokens as keys to a client's legal identity.
4. 4.Build one retention schedule from the five legal clocks, and delete what falls outside it.
5. 5.Keep audit working papers lean: references, not copies of identity documents.
6. 6.Sign data processing terms with business clients and your own vendors, including AI tools.
7. 7.Do not wait for a small-entity exemption.

Key takeaways

• A firm is usually a processor when it keeps a company's books, payroll or registers, and in our view a fiduciary when it prepares an individual's return or forms its own audit opinion.
• The DPDP Act has no legal-obligation ground; on our reading, statutory and tax audits can lean on s.7(d), but firms should keep working papers lean and record the ground.
• Client portal passwords and DSC tokens are the firm's biggest security exposure; the income-tax and GST portals already offer delegated access that removes most of them.
• SA 230, the Companies Act, the CGST Act, PMLA and income-tax rules set different retention periods; s.8(7) allows each, and erasure after.
• No s.17(3) exemption has been notified, so small practices carry full duties from 13 May 2027.