A CA practice already lives by confidentiality. Disclosing information from an engagement without the client's consent, unless a law requires it, is professional misconduct under the Chartered Accountants Act (Second Schedule, Part I, clause 1). India's DPDP Act adds something the profession's rules never spelt out: specific security measures, a 72-hour breach report and a duty to delete.

The general duties are in our DPDP Act checklist for small businesses. This page covers what is specific to a CA or tax practice. It is practical guidance, not legal advice.

When the duties start

The DPDP Rules were published on 13 November 2025. Notice, security, breach reporting, erasure and the Data Protection Board's power to fine start 18 months later: mid-May 2027, or 13 May 2027 on a plain count (G.S.R. 843(E)). That puts the first fully covered filing season in July 2027. The data you collect in the coming season will still be on your systems then.

Are you a fiduciary or a processor?

The Act calls whoever decides why and how personal data is used a Data Fiduciary (section 2(i)).

  • Returns, audits, tax advice, company filings: you decide what data the job needs and how to use it, so you are a Data Fiduciary for that client data. All the duties are yours.
  • Outsourced bookkeeping or payroll done strictly on the client's instructions: you may be the client's Data Processor for that work. The client then needs a contract with you that covers security safeguards (section 8(2), Rule 6(1)(f)).
  • Your own staff and articled assistants: you are their employer, so you are a Data Fiduciary for their data.

Retention: the Act yields to SA 230

Section 8(7) says to erase personal data once its purpose is served, except where keeping it is necessary to comply with a law. For audits, ICAI's SA 230 sets a retention period for engagement documentation of at least seven years from the date of the auditor's report. Keep those working papers for that period, secured.

What SA 230 does not cover is everything around the file: the WhatsApp photos of a PAN card, the bank statements emailed to an article's personal Gmail, the three copies of Form 16 in Downloads. Those have no legal reason to stay once they are in the working papers. Rule 8(3) separately asks every business to keep personal data and processing logs for at least one year from processing, so the simple rule is: the working-paper copy stays for the period your standards and laws set; stray copies go after a year at most.

The CA practice checklist

  1. Map client data by engagement type. ITR, GST, audit, company filings, payroll. For each, list what you collect (PAN, Aadhaar, bank statements, Form 16, salary slips, investment proofs) and where copies end up: email, WhatsApp, Drive, Tally, the server, staff laptops, pen drives.
  2. Give clients one upload route before the season starts. A shared folder per client or a one-open link, not a partner's personal WhatsApp. The workflow is in how to collect documents from clients securely.
  3. Ask for less. Interest certificates instead of full bank statements where they do the job; a masked Aadhaar unless the filing needs the full number.
  4. Move portal logins into a password manager. Income tax, GST, TRACES and MCA credentials should not sit in an Excel sheet or a chat. Give each staff member access only to the clients they handle, and change the passwords when an article leaves.
  5. Control OTPs and DSC tokens. Note which phone receives each client's OTPs, and keep DSC tokens locked away with a sign-out register. Both are access control under Rule 6.
  6. Run a leaver routine for articles and staff. Same day: remove email, Drive, software and portal access; collect devices and pen drives; check their phone has no client WhatsApp groups left.
  7. Keep access logs for a year. Rule 6(1)(e) asks for logs that can detect unauthorised access, kept for a year. Check that your email, cloud storage and practice software actually record who opened what.
  8. Sign contracts with your vendors. Practice-management software, cloud backup and anyone else who processes client data for you need a valid contract with security terms (section 8(2)). You remain responsible for what they do (section 8(1)).
  9. Write a retention list. Working papers per SA 230 and any other law that applies; everything else deleted after the engagement and the one-year minimum. Put a recurring reminder after each filing season.
  10. Write the breach plan. A return emailed to the wrong client, a stolen laptop, a former article still logged into a portal. Under Rule 7 you tell the affected client and the Board without delay, and send the Board a detailed report within 72 hours. Decide in advance who makes each call.

Also publish a contact person for data questions on your website, with a grievance response time of no more than 90 days (Rule 9, Rule 14(3)).

Aadhaar and PAN copies

The UIDAI's Aadhaar (Sharing of Information) Regulations already apply to every Aadhaar copy you hold, paper included: collect it for a lawful purpose, tell the client why and whether it is mandatory, get consent, never display it, keep it secure and don't keep it longer than needed (regulations 5 and 6). PAN has no equivalent regulation, but under the DPDP Act it is personal data like any other; see is it safe to share a PAN card.

Where NO SUS fits

Clients can send documents as a one-open link from nosus.foo: encrypted in their browser, no account and no phone number exchange, and the server copy is gone after you open it once. When you send a computation or a draft return back, a watermarked link stamps the viewer's email on it, so a forwarded copy shows whose it was.

Want help setting this up for a CA practice in Mumbai (data map, retention list, leaver routine, breach plan) before the next filing season? Email shubhamsahu@nosus.foo. It's practical setup help, not legal advice.