Sector guide · Chartered accountants
DPDP Act for chartered accountants
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
A CA firm is a Data Fiduciary for its own clients and staff, and usually a Data Processor for the personal data inside a client engagement, such as an employee payroll or a customer ledger. Both roles carry duties. Beyond that, the Act creates a second line of work: every client the firm serves is itself a Data Fiduciary that needs the compliance done.
From the Gevox Readiness Index: The Readiness Index scanned twenty advisor websites, including CA and GRC practices. Average score 71; eight of twenty had no compliant notice.
Two roles in one practice
For clients and staff the firm decides purpose and means, so Section 5, 6 and 8 apply in full: a notice, consent where the ground is not Section 7, security safeguards, breach intimation, a published contact. For the personal data inside an audit or a tax file, the client is the Fiduciary and the firm processes on its behalf under Section 8(2), which means an engagement letter that covers data processing and security.
Professional secrecy is not an exemption
Section 17 exempts processing necessary for enforcing a legal right or claim and for certain regulatory functions. It does not exempt a firm’s ordinary handling of client data. The ICAI code of ethics governs confidentiality; the Act governs the processing, and both apply.
The opportunity: every client needs this done
A client with a website, a customer list and a payroll has to meet the same obligations. The CA is already the trusted adviser with the client’s data map in hand. The Gevox professionals dashboard was built for this: run each client in its own workspace, scan their website, generate the notice, the processor agreements and the registers cited to the section, and keep the evidence.
First five actions for the practice itself
- Run the free scan on the firm website; fix consent order and headers first.
- Rewrite the client notice to Rule 3 and add the Section 8(9) contact to the site and the engagement letter.
- Add a data processing clause to the engagement letter that meets Section 8(2) and Rule 6(1)(f).
- Put contracts in place with the practice software, cloud and e-filing vendors.
- Write the Rule 7 breach procedure; a misdirected return is a breach.
Questions people ask
- Does the Act apply to a sole practitioner?
- Yes. There is no size threshold. A sole practitioner with client files on a laptop is a Data Fiduciary.
- Is a client’s payroll data our data or theirs?
- Theirs. The client is the Data Fiduciary; you process it on their behalf and need a Section 8(2) contract, usually inside the engagement letter.
- Can we advise clients on DPDP compliance?
- Nothing in the Act reserves the work to lawyers. The documents are deterministic and cited; the judgment is about the client’s processing, which a CA already understands.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.