Data Security for CA Firms: DPDP-Ready 12-Point Checklist

In this article

Why data security for CA firms matters now
The DPDP Act and Rules in plain words
The 12-point checklist: the whole picture, and where to start
What the DPDP Rules ask for security
When something goes wrong
A first week for a small office
Train the whole team, not just the partner
Questions people ask
Sources

Key points

A small office holds PAN, Aadhaar, bank and salary data for hundreds of people, which makes it a target.
The DPDP Rules 2025 were notified on 13 November 2025; the main duties for firms start eighteen months later, around mid-May 2027.
The Rules list minimum security safeguards: encryption, access control, logs, backups and vendor contracts.
A personal data breach must be reported to the Board and to each affected person, with a detailed report to the Board within 72 hours.
Most of the 12 points cost nothing: a register, a habit and one written policy.

Data security for CA firms is no longer only about a good antivirus. Your office keeps PAN cards, Aadhaar copies, bank statements, salary slips and portal passwords for hundreds of people, and the DPDP Act and Rules bring duties on how you handle that data, coming into force in phases, with most of them due around mid-May 2027. This article gives partners, office managers and staff the 12 points to cover, the four biggest risks and three quick wins you can start this week, and explains in plain words what the DPDP Rules 2025 ask and when.

It is written for a small tax and accounts office: two to twenty people, a few laptops, a shared folder, a WhatsApp number and a cupboard of DSC tokens. Nothing here needs an IT department.

Why data security for CA firms matters now

Criminals go where the data is valuable and the locks are weak. A tax office has both. One shared email password or one DSC left in a drawer can expose dozens of clients at once.

The four biggest risks in small offices are simple ones:

One shared email login, with no second step. If one person clicks a fake link, the whole office inbox is open, and with it the password resets for most portals.
Client portal passwords in an Excel file called "passwords". Anyone who copies that one file has every client's login.
DSC tokens kept with staff, with the PIN written on the cover. A lost bag puts the token and its PIN in a stranger's hands.
No tested backup. A crashed laptop or a ransomware attack in July can stop work for days, right in the busy season.

None of these needs money to fix. They need a list, an owner and a habit.

The DPDP Act and Rules in plain words

The Digital Personal Data Protection Act, 2023 is India's data protection law. In the Act's words, a "Data Principal" is the individual the personal data is about: your staff, individual clients, and the directors, partners and employees of business clients (a company itself is not a Data Principal). Your firm, when it decides why and how that data is used, is a "Data Fiduciary". A cloud storage or software vendor is a "Data Processor" when it handles that personal data on your firm's behalf.

The Act and the Rules start in phases. These dates come from the MeitY notifications of 13 November 2025:

When	What starts
13 November 2025	Definitions, the Data Protection Board and its procedures (Rules 1, 2 and 17 to 21)
One year later, around 13 November 2026	Registration of Consent Managers (Rule 4)
Eighteen months later, around mid-May 2027	The main duties of a Data Fiduciary: notice, security safeguards, breach reporting, erasure, rights of individuals (Rules 3, 5 to 16, 22 and 23)

Within the rules This is a practical summary, not legal advice. Before you plan around mid-May 2027, check meity.gov.in and the e-Gazette for any later notification that changes the dates. The safeguards below are good practice today, whatever the date.

For a small office, the Act asks three things: know what personal data you hold, use it only for the work it was given for, and keep it safe. The penalties in the Schedule to the Act go up to Rs. 250 crore for failing to take reasonable security safeguards. Those are maximums set by the Board case by case. The real lesson for a small firm is to be able to show that you took reasonable care.

Course: Digital Office & Data SafetyTurn this checklist into office habits

Digital Office & Data Safety is 13 short lessons with checklists on passwords, DSCs, phishing, backups, staff access and the DPDP Act, written for small tax and accounts offices.

Try the first lesson free See the course

The 12-point checklist: the whole picture, and where to start

A complete data security checklist for a small office has twelve points. Here they are at a glance, so you can see the whole picture before you start:

Map your office data.
One person, one login.
Passwords in a password manager.
Two-step verification on email.
A DSC register.
Spot phishing.
Backups you have tested.
Locked and updated laptops and phones.
Collect client documents safely.
Joining and leaving checklists.
An incident plan and log.
One written policy, one contact person.

You do not need all twelve this week. Start with three quick wins. They cost nothing and close the holes that cause most trouble in small offices.

Quick win 1: two-step verification on every email

Turn on two-step verification for every email account, starting with the partners. Email is the master key: whoever controls it can reset almost every other password.

Quick win 2: a DSC register

Keep all tokens in one locked box. A simple register records the token, the client, who took it, when, why and when it came back. The PIN is never written on or near the token.

Quick win 3: never log in from a link

Fake "notice" emails and messages that look like they come from a tax portal are common in busy months. Teach one rule: never click a link in a message to log in to a portal; type the address yourself.

The other nine points need more thought: what goes into the data map, how to move portal passwords into a vault without locking anyone out, how often to test a restore, and exactly what the leaving checklist must take back. Done in a hurry, each one leaves a gap. Our Digital Office and Data Safety course gives each point its own short lesson and checklist.

What the DPDP Rules ask for security

Rule 6 of the DPDP Rules 2025 lists the minimum "reasonable security safeguards". In plain words, it asks for:

Encryption, masking or similar protection of personal data.
Control over who can access computer resources.
Logs, monitoring and review to detect unauthorised access.
Measures such as backups to keep working after a problem.
Keeping such logs and data for one year, unless another law requires otherwise.
Security clauses in contracts with Data Processors.
Technical and organisational measures, such as policy and training.

Each of these lines up with one or more of the twelve points above. The firm that can show a register, a tested backup, a policy and a log is in a far better place than the firm that only says it is careful.

Tax and audit records often have to be kept for years under other laws. The DPDP Act does not override that. Your policy should say what you keep, for how long and why.

When something goes wrong

Under Rule 7, once it is in force, a firm that becomes aware of a personal data breach must tell each affected person without delay, in plain words: what happened, what it means for them, what you are doing and what they can do. The firm must also tell the Data Protection Board without delay, and send a detailed report within 72 hours, or a longer period if the Board allows it on request.

Illustrative example Suresh, a junior, emailed a client's bank statements to another client with the same surname. The partner, Meera, did not panic. She called the wrong recipient, asked them to delete the file and confirm by email, noted it in the incident log, and told the client what had happened the same day. Then she changed one office rule: every outgoing attachment now goes from the client folder, not from "Downloads".

For hacking, fraud or online threats, report to the national cyber crime portal, cybercrime.gov.in, and keep screenshots. Having a written plan means nobody has to think from zero on a bad day.

A first week for a small office

A first week can be simple: one small job a day, each with one named owner. Do the three quick wins, then test a restore of one folder and remove the access of anyone who has already left. The other points can follow over the next month.

What makes it last is the follow-up. Registers go stale, backups stop running and leavers keep their logins unless someone checks every month. Data security for CA firms is a set of small habits more than a project.

Tip Make data safety part of onboarding. Our First 90 Days in a CA Office course teaches new joiners the rules on DSCs, passwords and OTPs in their first weeks, and Google Workspace and Microsoft 365 for Tax & Accounts Offices covers shared folders and permissions.

Train the whole team, not just the partner

Many small-office incidents start with a person, not a machine: a click on a fake link, a password shared over the phone, a token lent for "just five minutes". The partner cannot watch every desk, so every person needs the same rules.

Our data safety course for tax and accounts offices gives each staff member short lessons they can finish in a week. With the Office Subscription Plan, the Small office plan is Rs. 1,499 + GST a year for you and 5 staff, about Rs. 4 a day, and includes every course. You can also read the first lesson free before you decide.

Rules change: check the latest notification on meity.gov.in before you act.

Questions people ask

Does the DPDP Act apply to a small CA firm?

The Act applies to the processing of digital personal data in India and sets no general size threshold, though section 17 lets the government exempt some Data Fiduciaries, including startups, from certain provisions by notification. A CA firm that keeps client PAN, Aadhaar, bank or salary data in digital form should plan as if the duties apply to it.

When do the DPDP duties start for firms?

The Rules were notified on 13 November 2025. Notice, security safeguards, breach reporting and most other duties of a Data Fiduciary start eighteen months after that date, around mid-May 2027. Check meity.gov.in for any later notification before you rely on the date.

What should a CA office do if a laptop with client data is lost?

Change the passwords used on that laptop, remote-wipe it if you can, write down what data was on it, and follow your breach steps. Under the DPDP Rules, once the main duties are in force, the Board and each affected person must be told without delay, with a detailed report to the Board within 72 hours.

Is WhatsApp safe for collecting client documents?

It is convenient but hard to control: files stay on personal phones and backups. A shared folder with access only for the client and the office, or your practice software's upload link, is easier to secure and to clean up later.

Who should hold the DSC tokens in an office?

Keep tokens in one locked place with a register of who took which token, when and for what. The PIN should stay with the client or with the one person the client has authorised in writing, never on a sticky note with the token.

Sources

Course: Digital Office & Data SafetyMake data safety part of every new joiner's first week

Start with the first lesson of Digital Office & Data Safety free. On the Office plan, every staff member gets this course and all the others.