For chartered accountancy firms
DPDP compliance for CA firms
By Suryansh Sagar, founder of Gevox. Last updated 6 October 2026.
A CA firm already holds what a DPDP engagement needs most: the client relationship, a working knowledge of what the business does, and a recurring reason to be in touch. Gevox gives the firm the rest, a workspace per client for the intake, the examination, the documents and the statutory clocks, and an assessment a partner can review and hand over.
From the Gevox Readiness Index: Across twenty DPDP advisor websites, the notice and the privacy contact were present on three in five. The visible obligations get done; the technical ones, consent before tracking and named processors, mostly do not.
Why your clients will ask you first
Most SME clients will hear about the Act from their CA before they hear about it from anyone else, because the firm is already the adviser they call about anything statutory. The obligations commence on 13 May 2027 under Rule 1, which is 29 weeks away, and the penalty bands in the Schedule run to Rs 250 crore. That combination produces a phone call.
The question is whether the firm answers it, refers it to somebody else, or loses the client to whoever answers it first.
How the work fits a practice that already runs compliance
The rhythm will be familiar, with one difference worth being clear about. Unlike GST, there is no periodic return to file for an ordinary business. The recurring work is operational: requests from individuals answered within ninety days under Rule 14, a breach reported within seventy-two hours under Rule 7, the notice and the website kept in step as the business changes, and the business kept responsible for its processors under Section 8.
So the engagement has two parts. A set-up engagement, priced the way the firm prices any assignment. Then a monthly retainer, which Gevox supports with continuous monitoring and a monthly report of what moved.
Who in the firm does what
The work splits naturally along the lines a CA firm already staffs.
- An article assistant or a junior sends the intake link, chases the document request list and runs the website examination.
- A manager reviews the findings against the client’s facts and prepares the documents from the intake.
- A partner reviews the gap assessment and signs off what goes to the client.
- Across all clients, one list shows every rights request and breach duty due this week, so nothing waits on somebody remembering it.
If the question is about your own firm
A CA firm holds a great deal of personal data itself, and the Act applies to it in its own right. The sector guide for chartered accountants covers what the firm must do for itself. This page is about the service the firm provides to clients.
Questions practitioners ask
- Does a CA firm need legal qualifications to offer DPDP work?
- The Act does not reserve compliance work to any profession. Interpreting a contested point of law is different from running a compliance engagement, and many firms bring in a lawyer for the former while delivering the latter themselves.
- Is there a DPDP return to file each month, like GST?
- No. For an ordinary business there is no periodic return. The recurring work is answering rights requests within ninety days, reporting breaches within seventy-two hours, and keeping the notice and processor arrangements current.
- Can juniors in the firm use it?
- Yes. On the Firm plan, several professionals share one account with roles and client assignment, and every action is recorded in an audit trail. You can open a Firm account yourself from the pricing page.
- What does it cost per client?
- On Suite, Rs 375 per client each month across 40 clients. On Practice, Rs 667 per client across 15.
- Can we try it on a few clients first?
- The Starter Pass is Rs 999 once for thirty days, covering 3 clients with every module.
Read next
Start with three clients
Run a real engagement on Gevox for thirty days, then decide.
The Starter Pass is Rs 999 once, for 3 client workspaces with every module unlocked. After that, Suite is Rs 375 per client each month.
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.