DPDP for CAs, law firms, consultants and recruiters

Professional firms are built on files. A CA’s file holds a client’s bank statements, salary registers, investor details and tax notices. A law firm’s file holds witness statements, medical reports, opposing parties’ data and family details. A recruiter’s database holds thousands of CVs, salary histories and reference notes. Most of this data is about people who are not your client and who have never heard of you. That is what makes professional services different: your duties to the client (confidentiality, privilege, professional ethics) sit on top of DPDP duties to everyone named in the file.

The risk sits in who you are in each engagement, in files that never close, and in unmanaged channels: client documents on WhatsApp, partners’ personal Gmail, laptops that leave with associates, and CV databases built from scraped or forwarded profiles. This guide applies the Data Fiduciary playbook to professional practices.

Are you a Data Fiduciary, a processor, or both?

The answer changes with the engagement. The test is the one in section 2(i): who decides why and how the data is processed?

• For your own operations, you are always a Data Fiduciary: your staff, partners, articled assistants and interns, your leads and marketing lists, your own client contacts, visitors and CCTV.
• Advisory and representation work (law firms, CA advisory, tax representation, consultants): you usually decide how to use the client’s data to give professional advice, using your own judgement and methods. You are generally a separate Data Fiduciary for that processing, alongside your client. Your engagement letter should say so.
• Outsourced processing you run on the client’s instructions (payroll processing, bookkeeping, GST return preparation from the client’s data, background verification for an employer, an HR consultant running an engagement survey): you are usually the client’s Data Processor. You process only as the client instructs, under a valid contract (section 8(2)), and the client stays responsible (section 8(1)).
• Statutory and internal audit: the auditor’s judgement is independent by law, which points to fiduciary status for audit work. Treat the audit file as yours, with its own retention, and agree the position with the client. Confirm the position for your practice with counsel.
• Architects and interior designers: you are a fiduciary for client and site-occupant data you collect for the project. Contractors and site supervisors you appoint are your processors, or independent fiduciaries if they deal with the client directly.
• Recruiters and executive search: you are a Data Fiduciary for candidates in your talent database. When you shortlist and share a candidate with a client, the client becomes a separate fiduciary for what it receives. When an employer outsources its own hiring pipeline to you (RPO), you may be its processor for that pipeline.
• Staffing and contract-manpower agencies: associates on your payroll are your employees, so you are their fiduciary under 7(i). The client where they are deployed is a separate fiduciary for attendance, access and site security data it collects.
• Non-resident clients: where you process data of people outside India under a contract with a foreign client, section 17(1)(d) disapplies most of Chapter II, Chapter III and section 16. Sections 8(1) and 8(5) still apply, so security duties remain.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Client contacts and KYC (PAN, address, IDs)	Practice management software, CRM, email	Engagement, billing, professional-body or AML-type checks	Medium to high	During the engagement, then the period your professional or tax rules require
Client financials: bank statements, ITR data, salary, investments	Tax software, shared drives, email, WhatsApp	Tax filing, audit, advisory	High (financial)	Per the engagement type and tax rules; legal holds for assessments
Client employees’ payroll and HR data	Payroll software, Excel, client portals	Payroll processing, labour compliance (as processor)	High	As the client instructs; return or delete at exit
Litigation files: pleadings, evidence, witness statements	DMS, physical files scanned, email	Representation	High (can include health, criminal, family)	Until the matter and appeals end, plus a limitation period for claims
Opposing parties’ and third parties’ data	Litigation and due-diligence files	Representation, due diligence	Medium to high	Tied to the matter
Due-diligence data rooms (employees, customers, directors)	Virtual data room, email	M&A, investment, lending advice	High	Until the deal closes or fails; return or destroy per NDA
Medical and accident records (injury, insurance, family law)	Litigation files	Representation	High (health)	Tied to the matter
Candidate CVs, salary history, notice periods, references	ATS, job-portal accounts, email, LinkedIn exports	Matching candidates to roles	Medium to high	Set a limit (for example 12–24 months) and refresh consent
Background-verification reports	BGV vendor portals, email	Employer checks (often as processor)	High	As the employer instructs
Associates’ records (staffing): ID, bank, PF and ESI details, attendance	HRMS, payroll, client timesheets	Employment, statutory contributions	High	During employment, then as labour and tax law require
Site and project data: floor plans, occupant names, photographs	CAD files, project drives, WhatsApp groups	Design, construction	Medium	Project period, then as professional records need
Interview recordings, assessment results	Video tools, assessment platforms	Selection	Medium to high	Short; delete after the decision unless disputed
Billing, time records and correspondence	Practice software, email	Fees, recovery	Medium	Accounting and limitation periods

Risk hotspots

1. Not knowing your role per engagement. Firms sign client data processing agreements as processors for advisory work, or treat payroll processing as their own data. Failure: wrong contract terms, wrong retention and confused responses to rights requests. Control: a role matrix by engagement type, written into engagement letters.
2. Third-party data in client files. Opposing parties, client employees, counterparties and witnesses never gave you their data. Failure: no clear ground, and a request you cannot answer. Control: identify the basis per matter type: section 17(1)(a) for enforcing or defending legal rights and claims; the client’s ground and your processor contract for outsourced work; retention required by law for statutory records. Collect only what the matter needs.
3. Email and WhatsApp as the file system. Clients send bank statements and Aadhaar copies on WhatsApp to a partner’s personal phone. Failure: no access control, no retention, no record of who saw what. Control: a secure client portal or upload link, firm-controlled devices, a rule that client documents are saved to the DMS and deleted from chat.
4. Files that never close. Decades of matter files, old audit working papers and CV databases sit on shared drives. Failure: section 8(7) erasure duty breached, and a bigger breach when it comes. Control: retention by matter type, closure checklists, and annual purge runs with partner sign-off.
5. Departing staff and laptops. Associates and recruiters leave with client folders or the candidate database. Control: firm-managed devices, DLP on email and USB, no personal cloud sync, exit checklists that remove access on the last day.
6. Due-diligence data rooms. Employee and customer data from the target company flows to many advisers. Failure: over-sharing, and data kept after the deal. Control: insist on redacted or aggregated data where possible, NDA return-or-destroy clauses, access logging in the data room, and confirmation of destruction. Section 17(1)(e) covers schemes of arrangement, mergers and similar restructurings approved by a court, tribunal or competent authority; it does not cover every private deal.
7. Recruiter databases built without consent. CVs forwarded by friends, scraped from portals or kept from old mandates. Failure: processing without a ground; the “publicly available” exclusion in section 3(c)(ii) covers only data the person made public, and a CV on a paid portal is not clearly public. Control: candidate consent for your database with a validity period, consent per client before sharing a profile, and deletion on request.
8. Background checks and references. Recruiters and staffing firms collect criminal-record checks, credit checks and former-employer references. Control: only checks the role needs, with the candidate’s informed consent; employer as fiduciary and you as processor where you act for it; short retention.
9. Aadhaar in staffing. Agencies collect full Aadhaar copies for every associate. Control: collect Aadhaar only where a law requires it (for example statutory schemes that require Aadhaar seeding), prefer masked copies and offline e-KYC or DigiLocker, and never share copies with clients. Confirm the current requirement with counsel.
10. Privilege and confidentiality versus rights requests. A counterparty asks a law firm for access to “all data you hold about me”. Control: a playbook that applies section 17(1)(a) where processing is necessary for a legal claim, respects privilege and client confidentiality, and still answers requests that do not engage those grounds.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Onboarding a client who is an individual, and delivering the service they asked for	7(a)	Tax filing, advice, design work. Use the data only for that engagement.
Client KYC required by professional rules or other law	Retention required by law; 7(d) where you must report to the State	Prefer masked Aadhaar or DigiLocker. Confirm the current requirement with counsel.
Litigation, arbitration and enforcing or defending legal claims	17(1)(a)	Chapter II (except sections 8(1) and 8(5)), Chapter III and section 16 do not apply where processing is necessary for enforcing a legal right or claim. Security still applies.
Opposing parties’ and witnesses’ data in a matter	17(1)(a)	Only what the matter needs. Delete when the matter and the limitation period end.
Complying with a court order or summons	7(e)	Disclose only what the order covers.
Filing returns, forms and reports with tax or regulatory authorities for a client	7(d) for the disclosure; 7(a) for the individual client’s data	Where you act for a company, its employees’ data usually reaches you as its processor.
Payroll, bookkeeping or HR processing for a client	Client’s ground (often 7(i)); you act as processor	Process only on instructions under a valid contract (section 8(2)).
Due diligence for a court- or tribunal-approved scheme of arrangement or merger	17(1)(e)	Only for schemes approved by a competent authority. For other deals, rely on the target’s grounds and minimise.
Candidate database (talent pool)	Consent	With a validity period; refresh or delete.
Sharing a candidate’s profile with a specific client	Consent, per client or per role	Name the client or describe the role before you share.
Background verification and references	Consent of the candidate, collected for the employer	You are often the employer’s processor.
Staffing associates’ employment, payroll, PF and ESI	7(i); retention required by law	Share with the deployment client only what it needs for attendance and site access.
Newsletters, event invitations and marketing to contacts	Consent	Business contacts are individuals too.
Publishing case studies, deal tombstones or project photos naming people	Consent	Anonymise by default.

Notices and consent: getting the screens right

Channel	Do	Don’t
Engagement letter and onboarding form	Include the notice: data collected, purposes, your role (fiduciary or processor), retention, rights, contact person.	Bury data terms in standard terms nobody reads, or make marketing a condition of engagement.
Client portal or upload link	Show a short notice at upload; tell clients not to send documents on WhatsApp.	Accept full bank statements and IDs on a partner’s personal number.
Website contact and enquiry forms	Collect only what the enquiry needs; separate unticked newsletter opt-in.	Add every enquiry to the newsletter.
Job portals, LinkedIn and referrals (recruiters)	On first contact, send the notice and a link to give consent for your database. Record the source of the profile.	Keep forwarded CVs without telling the candidate.
Sharing a profile with a client	Get the candidate’s consent for that client or role, and log it.	“Blind” submissions of full CVs to many clients.
Interviews and assessments	Tell candidates before recording; explain how long recordings are kept.	Record interviews by default without notice.
Staffing onboarding (field and site)	Give associates a notice in their language explaining what is shared with the client.	Collect full Aadhaar copies and photographs and hand them to clients.
Site visits (architects, valuers)	Tell occupants what you photograph and why.	Post site photos with residents’ faces or name plates on social media.
Existing clients and candidates	Send a section 5(2) notice with a way to manage choices; for candidates, ask for fresh consent or delete.	Assume old CV submissions mean consent forever.

Rule 3 requires each notice to stand on its own, give an itemised list of personal data with the purpose for each, describe the services or uses involved, and give a link and other means to withdraw consent, exercise rights and complain to the Board. Notices must be available in English and any of the 22 Eighth Schedule languages (section 5(3)). Client-facing firms can start with English and Hindi; staffing agencies should add the languages of their associates.

Other laws you must line up with

• Bharatiya Sakshya Adhiniyam, 2023 (which replaced the Indian Evidence Act) and the Advocates Act, 1961 with Bar Council of India rules: professional communications between advocate and client are protected, and advocates owe duties of confidentiality. DPDP does not override privilege; rights requests that touch privileged material need careful handling. Confirm the current requirement with counsel.
• Chartered Accountants Act, 1949 and the ICAI Code of Ethics, Company Secretaries Act and ICSI rules: confidentiality of client information and requirements on audit documentation and working papers. These support retention of audit files for the period professional standards set.
• Companies Act, 2013: statutory audit, auditor independence and the auditor’s access to records. Relevant to whether you are a fiduciary for the audit file.
• Income-tax Act and GST law: filing on behalf of clients, retention of records and the clients’ own retention duties.
• PMLA, 2002: some professionals carrying out specified activities for clients may have reporting-entity obligations. Confirm the current requirement with counsel.
• Council of Architecture rules: professional conduct and records for architects.
• Labour codes, EPF and ESI law, and contract-labour licensing: registers, contributions and licences for staffing agencies, which require retention of associate data.
• Private placement agency rules and the Emigration Act, 1983 for overseas recruitment: licensing and records for certain recruiters. Confirm the current requirement with counsel.
• IT Act, 2000 and CERT-In Directions (2022): cyber incidents may need reporting to CERT-In on a much shorter clock than DPDP. Confirm the current requirement with counsel.

Retention and erasure

1. Section 8(7): erase personal data when consent is withdrawn or the purpose is clearly over, whichever is earlier, unless a law requires you to keep it. For each matter type, define when the purpose ends: the return is filed and the assessment window closes; the matter and appeals end; the deal closes or fails; the candidate is placed or the database consent expires.
2. The one-year minimum: rule 8(3) requires you and your processors to keep personal data, associated traffic data and processing logs for at least one year from the processing, then erase them unless another law requires longer. Keep DMS and portal access logs for at least a year (rule 6(1)(e)).
3. Legal holds: pending litigation, tax assessments, regulatory inquiries, disciplinary proceedings and fee disputes justify keeping the relevant files. Record each hold, its owner and when to review it. Professional standards on working papers and limitation periods for claims against the firm are common reasons to retain; write them into your policy. Confirm the current periods with counsel.
4. Processor engagements: at the end of a payroll or bookkeeping engagement, return or delete the client’s data as the contract says, and confirm it in writing. Section 8(7)(b) puts the duty on the client to make you erase; make it easy for them.
5. Third Schedule: the three-year inactivity rule applies only to large e-commerce, online gaming and social media platforms. It does not apply to professional firms or recruiters.
6. Your own processors and backups: DMS vendors, cloud email, data-room providers, ATS providers and BGV vendors must erase on instruction. Document backup retention and make sure restores replay deletions.

Rights requests and grievances

• Channels: a privacy email, a web form and the engagement partner. Publish them with the identifier you need (client code, candidate ID or registered email) under rule 14(1).
• Identity: verify through the registered email or phone. Do not ask a candidate or counterparty for ID documents you do not already hold.
• Access (section 11): give clients and candidates a summary of the data you hold and how you use it, and list the fiduciaries and processors you shared it with (clients you submitted a candidate to, BGV vendors, co-counsel, experts, cloud providers).
• Where exemptions apply: if the requester is an opposing party or witness and the processing is necessary for a legal claim, section 17(1)(a) disapplies Chapter III. Record the reason and reply briefly; do not disclose privileged or client-confidential material.
• When you are a processor: forward the request to your client within a set time and help them answer. Do not answer on the client’s behalf unless the contract says so.
• Correction and erasure (section 12): correct contact and profile data promptly. Erase talent-pool records on request. Refuse erasure of records you must keep by law or professional rules, files under a legal hold, and data needed for the matter. Tell the person what you kept and why.
• Grievances: publish a resolution period within the 90-day ceiling in rule 14(3); 15–30 days is good practice. Name the contact person in every reply (rule 9).
• Nomination (section 14): let individual clients nominate someone to act if they die or are incapacitated. This matters for individuals whose tax or estate matters you handle.

Breach readiness

Likely scenarios:

• a phishing compromise of a partner’s mailbox holding client files
• a lost or stolen laptop
• a misconfigured shared drive or data-room link
• a recruiter leaving with the candidate database
• a compromised ATS or payroll tool
• ransomware on the file server
• a vendor breach at a BGV or cloud provider

Run-book:

1. Contain: revoke sessions and tokens, wipe the device, disable the link, lock the departing user’s accounts.
2. Assess: whose data, which files, how many people, and the harm (financial fraud, identity theft, prejudice in litigation, embarrassment from medical or family details).
3. Agree roles with the client: where you are a processor, tell the client at once so it can meet its duties; where you are a fiduciary, you notify.
4. Notify each affected person without delay, through their registered contact, covering every point in rule 7(1): a description of the breach, its nature, extent and timing; likely consequences for them; what you are doing; what they can do (for example, watch for fake tax-refund messages); and a contact who can answer queries.
5. Notify the Board without delay, then send the detailed report within 72 hours of becoming aware (rule 7(2)): updated facts, circumstances and reasons, mitigation, findings about who caused it, remedial steps, and a report on the notices sent.
6. Report to CERT-In where its directions apply, and consider professional-body and client contractual notification duties.
7. Learn: fix the cause, review access, and update engagement letters and vendor contracts.

The checklist

Phase 1: discover (days 0–30)

• [Partners] Name a DPDP owner at partner level and a working group: IT, HR, practice heads, recruitment head.
• [Legal] Build a role matrix: for each engagement type, fiduciary or processor, and why.
• [IT] Inventory systems: DMS, shared drives, email, practice software, tax and payroll software, ATS, data rooms, backups.
• [IT] Find client documents on WhatsApp, personal email and personal cloud accounts used by partners and staff.
• [Partners] List matter types that contain third-party data (litigation, due diligence, payroll, audits) and the basis for each.
• [Ops] Measure the age of stored files and find matters closed years ago.
• [Recruitment] Find the source of every candidate profile in the ATS: applied, portal, referral, scraped, old mandate.
• [HR] List where staffing associates’ IDs, Aadhaar copies and bank details are kept, and what is shared with clients.
• [Legal] List vendors and sub-contractors (cloud, DMS, BGV, assessment, payroll, experts, co-counsel) and collect contracts.
• [Legal] Find engagements involving non-resident data under foreign contracts, where section 17(1)(d) may apply.

Phase 2: design and build (days 31–90)

• [Legal] Update engagement-letter templates with the notice, the role per engagement, retention and return-or-delete terms.
• [Legal] Write a processor addendum for payroll, bookkeeping and BGV engagements: instructions only, security, breach notice, erasure, sub-processors, audit.
• [Legal] Write the firm’s privacy notice and translate it into Hindi and the languages of staffing associates.
• [IT] Roll out a secure client portal or upload link and tell clients to stop sending documents on WhatsApp.
• [IT] Move client files from chat and personal accounts into the DMS; delete the chat copies.
• [IT] Enforce MFA on email, DMS, practice software and the ATS.
• [IT] Encrypt laptops, enable remote wipe, and block personal cloud sync and USB copying of client files.
• [IT] Set matter-level access so only the team on a matter can open its files.
• [IT] Keep DMS, email and portal access logs for at least one year.
• [Partners] Approve a retention schedule by matter type with legal-hold rules.
• [Ops] Add a closure step to every matter: archive what professional rules require, delete the rest, record it.
• [Legal] Add return-or-destroy and access-logging terms to data-room and NDA templates.
• [Partners] Write a playbook for rights requests from counterparties and witnesses, covering section 17(1)(a) and privilege.
• [Recruitment] Send the notice to candidates in the database and ask for consent with a validity period; delete those who do not respond.
• [Recruitment] Add per-client or per-role consent before any profile is shared, and log each share.
• [Recruitment] Give candidates a one-click way to withdraw from the talent pool.
• [Recruitment] Limit background checks to what the role needs, with the candidate’s informed consent collected for the employer.
• [HR] Stop collecting full Aadhaar copies unless a law requires it; use masked copies or DigiLocker; never share them with clients.
• [HR] Define what associate data each deployment client receives, and put it in the client contract.
• [Marketing] Separate newsletter and event consent from engagement, and clean the mailing list.
• [Legal] Anonymise case studies and deal announcements by default; get consent where an individual is named.
• [Ops] Publish the contact person, request channels, identifier needed and a grievance period of 15–30 days.
• [Ops] Set up a request register that routes processor-role requests to the client.
• [Security] Write a breach run-book that covers processor-role incidents and client notification.
• [HR] Add confidentiality and data clauses to staff, intern and articled assistant agreements, and an exit checklist.

Phase 3: operate (ongoing)

• [Partners] Review the role matrix when you add a new service line.
• [Ops] Run the retention purge every year with partner sign-off on files to keep.
• [Recruitment] Refresh or expire talent-pool consents on schedule.
• [Security] Run phishing training for partners and staff every year; partners’ mailboxes are the main target.
• [Security] Run a breach drill every year (for example, a lost laptop with client files) against the 72-hour clock.
• [IT] Review DMS and data-room access every quarter and on every staff exit.
• [Legal] Review vendor and processor contracts and renewal dates every quarter.
• [Ops] Review rights and grievance timelines every month.
• [Partners] Keep evidence: engagement letters, consents, erasure confirmations, training records.
• [Ops] At the end of each processor engagement, return or delete the client’s data and send written confirmation.
• [Legal] Review legal holds every six months and release those whose matters have closed.
• [Recruitment] Audit a sample of profile shares every quarter against the consent log.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Get candidate consent for your talent pool	Define purposes (talent pool, share with a named client, background checks, job alerts) once. Send candidates to the hosted consent page by link or QR code; each purpose is a separate toggle, off by default.	Sourcing and screening.
Prove a candidate agreed before you shared a profile	Each choice is signed and hash-chained against the exact notice version, with a receipt for the candidate and an evidence pack for you.	Logging which client received the profile.
Stop sharing after withdrawal	The verify API returns not permitted immediately after a withdrawal; signed webhooks tell your ATS.	Wiring it into your ATS.
Record consent given in an engagement letter or on paper	Record consent captured elsewhere, marked as not verified by the person.	The signed letter.
Publish notices for clients and associates	Versioned notices in English and all 22 Eighth Schedule languages, with the rights, withdrawal and Board-complaint block and your contact added automatically.	Reviewing translations.
Track vendors and sub-processors	A processor registry with DPA dates, expiry flags and links to purposes; processors confirm withdrawals and erasures. Export a record of processing as JSON, CSV or PDF.	Signing the contracts.
Run retention by purpose	Retention days per purpose, the retention job and legal holds shown in the notice.	Deleting files in your DMS.
Handle requests and grievances	A rights inbox with SLA timers; erasure closes with a structured proof.	Decisions on exemptions and privilege.
Manage a breach	A breach register with the 72-hour clock, Rule 7 notices and Board report documents.	Investigation and client notification.

Not included: myconsentapp does not search your DMS or mailboxes for personal data, does not decide whether privilege or section 17(1)(a) applies, and is not legal advice.

Common mistakes

• Signing processor terms for advisory work where you exercise independent judgement, or treating payroll data you process for a client as your own.
• Running client work through partners’ personal WhatsApp and Gmail.
• Keeping every matter file forever “in case”.
• Building a CV database from forwarded and scraped profiles without telling candidates.
• Sharing full CVs with several clients without the candidate’s consent for each.
• Collecting full Aadhaar copies of every associate and passing them to clients.
• Assuming section 17(1)(a) covers all of a law firm’s processing, including marketing and HR.
• Forgetting that security duties under section 8(5) apply even where an exemption applies.

Frequently asked questions

Is a law firm a Data Fiduciary or a processor for client data? Usually a fiduciary. A law firm decides how to use information to represent a client, using its own professional judgement. For data processed to enforce or defend legal claims, section 17(1)(a) disapplies most of the notice, consent and rights duties, but sections 8(1) and 8(5) still apply.

Do we need consent from the opposing party to hold their data in a litigation file? No, where the processing is necessary for enforcing a legal right or claim (section 17(1)(a)). Keep only what the matter needs, protect it, and delete it when the matter and any limitation period end.

We prepare payroll for 40 clients. What are we? Usually their processor. Section 8(2) requires a valid contract; put an addendum in place covering instructions, security, breach notice, erasure and sub-processors. Your clients remain responsible under section 8(1).

Can a recruiter keep CVs from job portals? Not without a ground. A CV on a paid portal is not clearly “made publicly available” by the candidate within section 3(c)(ii). Send the candidate your notice, ask for consent for your database, and delete if they do not agree.

A candidate asks which companies we sent their CV to. Must we say? Yes. Section 11(1)(b) gives a right to know the other fiduciaries and processors you shared data with. Log every share so you can answer.

Do professional confidentiality rules conflict with DPDP? They mostly work together: both limit disclosure. Where a rights request would reveal privileged or client-confidential material, an exemption such as section 17(1)(a) may apply. Confirm the position for each case with counsel.

Do we need a Data Protection Officer? Only Significant Data Fiduciaries must appoint one, and professional firms are unlikely to be notified. You must publish a contact person who can answer questions (section 8(9), rule 9). Larger firms often name a partner or a privacy lead.