DPDP Compliance for Accounting Firms

Accounting and the DPDP Act: Why it Matters

If you run an accounting firm in India, you are sitting on a goldmine of personal data. Every day, you handle PAN cards, Aadhaar numbers, bank statements, salary slips, and investment details. Under the new Digital Personal Data Protection (DPDP) Act, 2023, your firm is considered a Data Fiduciary.

Wait, what does that mean? In simple words, a Data Fiduciary is any person or business that decides why and how personal data is processed. Since you decide how to use your client’s data to file their taxes or perform an audit, the responsibility (and the legal risk) sits squarely on your shoulders. Your clients are the Data Principals—the individuals whom the data belongs to.

The stakes are high. If there is a major data breach or if you handle data carelessly, the government can impose penalties of up to ₹250 Crore. For a small or medium-sized accounting firm, that’s not just a fine; it’s a business-ending event. But don’t worry—getting compliant isn’t about hiring a team of lawyers; it’s about changing how you handle files over your morning chai.

The Accounting Data Landscape

Before we dive into the “how-to,” let’s look at what you’re actually protecting. Accounting involves more than just numbers; it involves identities.

Data Category	Examples	DPDP Risk Level
Identity Documents	Aadhaar, PAN, Passport, Voter ID	High
Financial Records	Bank statements, Credit card bills, Loan papers	Very High
Payroll Data	Salary, PF details, Employee addresses	High
Investment Data	Mutual fund statements, Equity holdings, Insurance	High
Contact Details	Phone numbers, Personal emails, Residential addresses	Medium

Getting Consent Right

In the old days, a client would just WhatsApp you their Form 16 and you’d get to work. Under DPDP, you need a formal “Notice” and “Consent.”

Consent means the client gives you clear, affirmative permission to use their data. You cannot bury this in 50 pages of fine print. It must be in plain, simple language. Imagine you are onboarding a new tax client. You need to provide them with a notice that says: “We are collecting your PAN and Bank Statements to file your ITR-1 for FY 2023-24. We will store this on our secure server and won’t share it with anyone except the Income Tax Department.”

For existing clients, you’ll need to send out a fresh notice. You can’t just assume they are okay with it because they’ve been with you for ten years. If you want to see how other professional service firms are handling this, check out our DPDP consent management guide.

Data Access Controls: Who Sees What?

Think about your office right now. Does the summer intern have the same access to the “Master Client Folder” as your senior partner? If the answer is yes, you have a DPDP problem.

Data Access Control is a fancy way of saying “Only people who need to see the data should be able to see it.” If a junior accountant is only working on GST filings for Client A, they should not have the login credentials for Client B’s private payroll records.

Practical steps include:

• Using folder-level passwords on your office server.
• Moving away from shared office passwords (everyone should have their own login).
• Enabling Two-Factor Authentication (2FA) on all tax and accounting software.
• Setting up a “clean desk” policy where physical PAN copies aren’t left lying around overnight.

For example, when a client sends sensitive documents via email, don’t just leave them in the general “info@firm.com” inbox. Move them to a secure client portal or an encrypted folder immediately. You can see how modern firms are scoring on our DPDP analysis for digital platforms.

Third-Party Data Sharing: The “Data Processor”

Most accounting firms use third-party tools—think Tally on the cloud, Zoho Books, or even outsourced payroll providers. In the eyes of the law, these are Data Processors.

A Data Processor is anyone who processes data on behalf of the Data Fiduciary (you). The DPDP Act says that if your software provider loses your client’s data, you are still responsible to the client. This means you need a solid contract with every vendor.

Ensure your software providers are DPDP compliant. Ask them: “Where is our data stored? Is it in India? What happens if there is a breach?” If you use a freelance accountant to help during tax season, they are also a processor. You must have a simple written agreement with them stating they will protect the data and delete it once the job is done. This is a critical part of DPDP for startups and small firms that rely on lean teams.

Data Retention: When to Say Goodbye

Accountants love keeping records. “Keep it for 8 years for the IT Act,” is the standard advice. However, the DPDP Act introduces a conflict: it says you must delete personal data as soon as the purpose for which it was collected is fulfilled.

So, how do you balance this? If the Income Tax Act requires you to keep records for 7 years, you are legally allowed to keep them. That is a “legal obligation” which overrides the general deletion rule. However, once that 7-year window passes, or if a client leaves your firm and asks for their data to be purged, you must have a process to delete it.

Don’t keep “just in case” data. If a lead contacted you three years ago for a quote but never became a client, you shouldn’t still have their Aadhaar copy in your “Downloads” folder.

Employee Data: Your Internal Compliance

Your employees are also Data Principals. You hold their bank details, addresses, and perhaps even medical records for insurance purposes.

You must treat your staff’s data with the same respect as your clients’. Update your employment contracts to include a privacy clause. Explain why you are collecting their data (for payroll, PF, and taxes) and ensure that only the HR or admin person has access to those files. If an employee leaves, ensure their personal files are archived securely and not left accessible to their former colleagues.

6 Quick Actions to Start This Week

You don’t need to fix everything by Monday, but you do need to start. Here are five things you can do right now:

1. Inventory Your Data: Spend one hour listing where you keep personal data (Excel sheets, Tally, Gmail, Physical files).
2. Update Your Engagement Letter: Add a simple paragraph explaining what data you collect and that you are committed to DPDP compliance.
3. Secure Your Folders: If you use Google Drive or Dropbox, audit the “Shared” settings. Remove access for former employees immediately.
4. Talk to Your Vendors: Send a quick email to your cloud software providers asking for their DPDP compliance statement.
5. Staff Training: Gather your team for 15 minutes. Explain the ₹250 Crore penalty and tell them: “No more sharing client passwords on WhatsApp.”
6. Create a Breach Plan: Decide who will call the authorities and the clients if your system ever gets hacked. Having a plan is half the battle.

Compliance might feel like a burden, but in the long run, it builds trust. Clients will prefer a firm that can prove their financial secrets are safe. If you’re looking for more industry-specific tips, check out our guide for financial services.