In this article
- A small office holds PAN, Aadhaar, bank and salary data for hundreds of people, which makes it a target.
- The DPDP Rules 2025 were notified on 13 November 2025; the main duties for firms start eighteen months later, around mid-May 2027.
- The Rules list minimum security safeguards: encryption, access control, logs, backups and vendor contracts.
- A personal data breach must be reported to the Board and to each affected person, with a detailed report to the Board within 72 hours.
- Most of the 12 points cost nothing: a register, a habit and one written policy.
Data security for CA firms is no longer only about a good antivirus. Your office keeps PAN cards, Aadhaar copies, bank statements, salary slips and portal passwords for hundreds of people, and the DPDP Act and Rules bring duties on how you handle that data, coming into force in phases, with most of them due around mid-May 2027. This article gives partners, office managers and staff a 12-point checklist you can start this week, and explains in plain words what the DPDP Rules 2025 ask and when.
It is written for a small tax and accounts office: two to twenty people, a few laptops, a shared folder, a WhatsApp number and a cupboard of DSC tokens. Nothing here needs an IT department.
Why data security for CA firms matters now
Criminals go where the data is valuable and the locks are weak. A tax office has both. One shared email password or one DSC left in a drawer can expose dozens of clients at once.
The common problems in small offices are simple ones:
- One email login shared by the whole office, with no second step.
- Client portal passwords in an Excel file called "passwords".
- DSC tokens kept with staff, with the PIN written on the cover.
- No backup, or a backup on a drive that sits next to the computer.
- A staff member leaves, and their logins still work three months later.
None of these needs money to fix. They need a list, an owner and a habit.
The DPDP Act and Rules in plain words
The Digital Personal Data Protection Act, 2023 is India's data protection law. In the Act's words, your clients and staff are "Data Principals", and your firm, which decides why and how their data is used, is a "Data Fiduciary". Your cloud storage or software vendor is a "Data Processor".
The Act and the Rules start in phases. These dates come from the MeitY notifications of 13 November 2025:
| When | What starts |
|---|---|
| 13 November 2025 | Definitions, the Data Protection Board and its procedures (Rules 1, 2 and 17 to 21) |
| One year later, around 13 November 2026 | Registration of Consent Managers (Rule 4) |
| Eighteen months later, around mid-May 2027 | The main duties of a Data Fiduciary: notice, security safeguards, breach reporting, erasure, rights of individuals (Rules 3, 5 to 16, 22 and 23) |
For a small office, the Act asks three things: know what personal data you hold, use it only for the work it was given for, and keep it safe. The penalties in the Schedule to the Act go up to Rs. 250 crore for failing to take reasonable security safeguards. Those are maximums set by the Board case by case. The real lesson for a small firm is to be able to show that you took reasonable care.
Digital Office & Data Safety is 13 short lessons with checklists on passwords, DSCs, phishing, backups, staff access and the DPDP Act, written for small tax and accounts offices.
The 12-point data security checklist
Work through these in order. Each one has an owner in the office and a date by which it is done. If you run the full set in our Digital Office and Data Safety course, each point has its own lesson and a ready checklist.
1. Map your office data
Write one page: what personal data you collect, where it sits (laptops, email, cloud folder, practice software, phones, paper files) and who can open it. You cannot protect what you have not listed.
2. One person, one login
Every staff member gets their own email and their own login to the computer and the shared folder. Shared logins make it impossible to know who did what, and impossible to cut off one person.
3. Passwords in a password manager
Move client portal passwords out of Excel and WhatsApp notes into a password manager with an office vault. Give each staff member access only to the clients they handle.
4. Two-step verification on email
Turn on two-step verification for every email account, starting with the partners. Email is the master key: whoever controls it can reset almost every other password.
5. A DSC register
Keep all tokens in one locked box. A simple register records the token, the client, who took it, when, why and when it came back. The PIN is never written on or near the token.
6. Spot phishing
Fake "notice" emails and messages that look like they come from a tax portal are common in busy months. Teach one rule: never click a link in a message to log in to a portal; type the address yourself.
7. Backups you have tested
Keep at least one copy of client data away from the office, for example in a cloud backup, and one copy offline. Once a quarter, restore one folder to check the backup really works.
8. Laptops and phones
Screen lock after a few minutes, disk encryption switched on, updates installed, and the office email on phones only with a passcode. A lost laptop then becomes an inconvenience, not a breach.
9. Collect documents safely
Ask clients to upload to a client folder or your software's upload link instead of personal WhatsApp numbers. Delete downloaded copies from personal phones after filing them.
10. Joining and leaving
A joining checklist gives access; a leaving checklist removes it on the last day: email, shared folder, password vault, practice software, WhatsApp groups and DSC box key. New joiners sign a confidentiality undertaking on day one.
11. An incident plan and log
Write half a page on what to do if a laptop is lost, an email is hacked or a file goes to the wrong client: who to tell, which passwords to change, and how to record it. Keep a simple incident log.
12. One written policy, one contact person
Put all of the above in a two-page data safety policy. Name a partner as the contact person for data questions. Add a short data notice to your engagement letter, and a confidentiality clause in contracts with vendors who handle client data.
- Data map written and owner named
- Own logins for every person, two-step on all email
- Passwords moved to a manager, DSC register started
- Backup tested this quarter
- Joining and leaving checklists in use
- Incident plan, policy and data contact person in place
What the DPDP Rules ask, mapped to the checklist
Rule 6 of the DPDP Rules 2025 lists the minimum "reasonable security safeguards". Here is how the 12 points line up with it.
| Rule 6 asks for | Checklist points |
|---|---|
| Encryption, masking or similar protection of personal data | 3, 8 |
| Control over who can access computer resources | 2, 4, 10 |
| Logs, monitoring and review to detect unauthorised access | 5, 11 |
| Measures such as backups to keep working after a problem | 7 |
| Keeping such logs and data for one year, unless another law requires otherwise | 11 |
| Security clauses in contracts with Data Processors | 12 |
| Technical and organisational measures, such as policy and training | 1, 6, 12 |
Tax and audit records often have to be kept for years under other laws. The DPDP Act does not override that. Your policy should say what you keep, for how long and why.
When something goes wrong
Under Rule 7, once it is in force, a firm that becomes aware of a personal data breach must tell each affected person without delay, in plain words: what happened, what it means for them, what you are doing and what they can do. The firm must also tell the Data Protection Board without delay, and send a detailed report within 72 hours, or a longer period if the Board allows it on request.
For hacking, fraud or online threats, report to the national cyber crime portal, cybercrime.gov.in, and keep screenshots. Having a written plan means nobody has to think from zero on a bad day.
A one-week plan for a small office
| Day | Do this | Owner |
|---|---|---|
| Monday | Write the data map (point 1) | Office manager |
| Tuesday | Two-step verification on every email (point 4) | Each person, checked by manager |
| Wednesday | Start the DSC register and lock the box (point 5) | Front office |
| Thursday | Check the backup by restoring one folder (point 7) | Partner or IT person |
| Friday | Remove access of anyone who has left (point 10) | Office manager |
| Saturday | Fifteen-minute team talk on phishing (point 6) | Partner |
The other points can follow over the next month. Data security for CA firms is a set of small habits more than a project.
Train the whole team, not just the partner
Many small-office incidents start with a person, not a machine: a click on a fake link, a password shared over the phone, a token lent for "just five minutes". The partner cannot watch every desk, so every person needs the same rules.
Our data safety course for tax and accounts offices gives each staff member short lessons they can finish in a week, with a certificate when all lessons are read. With the Office Subscription Plan, the Small office plan is Rs. 1,499 + GST a year for you and 5 staff, about Rs. 4 a day, and includes every course. You can also read the first lesson free before you decide.
For related reading, see 10 Things to Improve Your CA Office This Year and AI Automation for CA Firms: 10 Jobs to Automate Now. New staff can start with Articled Assistant's First Week: 13 Rules of a CA Office.
Rules change: check the latest notification on meity.gov.in before you act.
Questions people ask
Does the DPDP Act apply to a small CA firm?
The Act applies to the processing of digital personal data in India and sets no general size threshold, though section 17 lets the government exempt some Data Fiduciaries, including startups, from certain provisions by notification. A CA firm that keeps client PAN, Aadhaar, bank or salary data in digital form should plan as if the duties apply to it.
When do the DPDP duties start for firms?
The Rules were notified on 13 November 2025. Notice, security safeguards, breach reporting and most other duties of a Data Fiduciary start eighteen months after that date, around mid-May 2027. Check meity.gov.in for any later notification before you rely on the date.
What should a CA office do if a laptop with client data is lost?
Change the passwords used on that laptop, remote-wipe it if you can, write down what data was on it, and follow your breach steps. Under the DPDP Rules, once the main duties are in force, the Board and each affected person must be told without delay, with a detailed report to the Board within 72 hours.
Is WhatsApp safe for collecting client documents?
It is convenient but hard to control: files stay on personal phones and backups. A shared folder with access only for the client and the office, or your practice software's upload link, is easier to secure and to clean up later.
Who should hold the DSC tokens in an office?
Keep tokens in one locked place with a register of who took which token, when and for what. The PIN should stay with the client or with the one person the client has authorised in writing, never on a sticky note with the token.
Sources
- The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), Gazette of India, 11 August 2023, sections 8, 17 and 33 and the Schedule (MeitY PDF)
- MeitY notifications of 13 November 2025: G.S.R. 843(E) (commencement dates of the Act) and the Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Rules 1, 6 and 7 (Gazette PDF)
- PIB backgrounder on the DPDP Rules, 2025, 17 November 2025 (PDF)
Start with the first lesson of Digital Office & Data Safety free. On the Office plan, every staff member gets this course and all the others.
