DPDP by sector
DPDP for chartered accountants and law firms
Last checked 6 Nov 2026
A chartered accountancy firm or law firm that keeps details of clients, staff or the people named in client matters in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). The Act has no separate rule for the professions: each firm works out, for each set of data, whether it decides why and how the data is used, or handles it for someone else. Nearly every duty starts on 13 May 2027.
Is the firm a Data Fiduciary or a Data Processor?
- Data Fiduciary. A firm that decides the purpose and means of processing is a Data Fiduciary for that data (s.2(i)). The firm's own staff records, client contact records and marketing lists usually fall here.
- Data Processor. A firm that processes data on behalf of a client that decides those things is a Data Processor for that data (s.2(k)). The client answers for the processing (s.8(1)), and the work runs under a valid contract (s.8(2)).
- Engagement by engagement. One firm can hold both roles. The Act does not settle which role a given audit, payroll or legal engagement falls into, so the firm records its reading for each kind of engagement and has counsel check it.
Which duties weigh most for a firm?
- Security safeguards. Encryption, masking or tokenisation; control over who can open each computer, phone and app; access logs, reviewed; and backups (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
- Breaches. Each affected person and the Data Protection Board told without delay (Rule 7(1), Rule 7(2)(a)), and the detailed report to the Board within 72 hours of becoming aware of the breach (Rule 7(2)(b)). Penalty up to ₹200 crore (s.33, Schedule item 2).
- Vendors. Practice software, cloud storage and email providers that handle personal data for the firm work under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)).
- Erasure and retention. Personal data goes once the purpose is over, unless a law requires it to be kept (s.8(7)). Personal data and logs are kept for at least one year (Rule 6(1)(e), Rule 8(3)).
- Rights requests. A person can ask for a summary of the data held (s.11), have it corrected (s.12(2)) or erased (s.12(3)), or name a nominee (s.14). Grievances are answered within the period the firm publishes, at most 90 days (Rule 14(3)).
What about data used for a legal claim?
Processing necessary to enforce a legal right or claim is outside Chapter II, other than s.8(1) and s.8(5), and outside Chapter III and s.16 (s.17(1)(a)). The security duty stays. The exemption covers that use only, so a law firm's staff records and marketing lists remain inside the Act.
When do the duties start?
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.
The DPDP compliance checklist lists every duty with its clause and start date.
What does Fohrkast do for a firm?
- A register of each duty that applies to the firm, with its date, its basis and the clause it comes from.
- Fohrkast drafts the notice from the firm's purposes and data map; the firm checks and publishes it (s.5, Rule 3). Consent is recorded per purpose, and withdrawal is as easy as giving it (s.6(4)).
- A rights desk for requests made by email, phone, letter or at the office, with identity checked before any reply. Fohrkast drafts each reply; the firm sends it.
- An incident record with the time the firm became aware of a breach, never prefilled, and drafts of the notices and the 72 hour report. The firm decides and sends.
- A record of each vendor that processes personal data for the firm (s.8(2)).
- Every step is written to a tamper evident record, and the evidence pack can be exported on every plan.
A firm that also advises clients on their own DPDP work runs them from one workspace: see DPDP software for partner firms.
Which plan usually fits?
| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Professional | One business with a few systems: clinics, schools, practices and single site firms | ₹9,999 a month, GST extra | ₹1,19,988 a year, GST extra |
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |
A firm with one office and a few systems usually fits Professional. A firm above a Professional limit usually needs Business.
Questions and answers
Does the DPDP Act apply to a chartered accountancy firm?
Yes, where the firm keeps or uses personal data in digital form (s.3). It is a Data Fiduciary for what it decides, and a Data Processor for what it handles only on a client's behalf (s.2(i), s.2(k)).
Does the DPDP Act apply to a law firm's client files?
Yes, in general. Processing necessary to enforce a legal right or claim is exempt from most of Chapter II and from Chapter III, while the security duty in s.8(5) still applies (s.17(1)(a)).
Who answers for a breach at a firm acting as Data Processor?
The client, as Data Fiduciary, answers for processing done on its behalf (s.8(1)). The firm's contract with the client says how the firm tells the client of a breach (s.8(2)).
How long must a firm keep logs?
At least one year, unless another law says otherwise (Rule 6(1)(e), Rule 8(3)).
Sources
- Digital Personal Data Protection Act, 2023 (22 of 2023): MeitY copy. Read 6 Nov 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: MeitY copy. Read 6 Nov 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: MeitY copy. Read 6 Nov 2026.
Not legal advice.