Data Breach Duties for CA Firms in India: What to Do

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Cyber law

A chartered accountancy firm rarely thinks of itself as a data business, yet it holds some of the most sensitive personal data in the economy: PAN details, bank statements, salary structures, investment records, loan documents and identity proofs belonging to clients, their families and its own employees. When that data is lost, copied or leaked, the question asked by the client and the regulator is simple: what did the firm do before the breach, and what did it do after? The Digital Personal Data Protection Act, 2023 answers both. A firm that holds digital personal data and decides how it is processed is a Data Fiduciary, and sections 8(5) and 8(6) place two distinct duties on it - a duty to protect the data, and a duty to report a breach.

The older framework has not vanished. Section 43A of the Information Technology Act, 2000, with the rules made under it, still governs compensation for a failure to protect data, and the criminal provisions of the Bharatiya Nyaya Sanhita, 2023 apply where the breach was deliberate. A CA firm faces three overlapping exposures - regulatory penalty, civil compensation and, in serious cases, prosecution - and each is answered by a different set of rules.

Are you a Data Fiduciary? Answer that first

The DPDP Act, 2023 defines a Data Fiduciary as the person who alone or with others determines the purpose and means of processing personal data. A CA firm that decides what to collect from a client, where to store it, how long to keep it and who may access it falls squarely within that definition. The client whose data it is is the Data Principal. A vendor, cloud provider or IT contractor that processes the data on the firm's instructions is a Data Processor.

The classification matters because the duties attach to the Data Fiduciary, not to the processor. A firm cannot contract out of the obligation by outsourcing its file server. Section 8(5) expressly extends the security duty to personal data processed on the firm's behalf by a Data Processor. In plain terms, if your outsourced IT vendor mishandles client data, the regulator still looks to the firm. This is the single most common misunderstanding among professional-services firms.

The security safeguard duty under section 8(5)

Section 8(5) requires a Data Fiduciary to protect personal data in its possession or control by taking reasonable security safeguards to prevent a personal data breach. The Act does not spell out a checklist, and this is deliberate - what is "reasonable" depends on the nature of the data and the scale of processing. For a CA firm, reasonable safeguards generally mean, at a minimum:

• Access control, so that each staff member reaches only the client files they need.
• Encryption of data at rest and in transit, especially for files carried on laptops and phones.
• Multi-factor authentication for accounting software, email and cloud storage.
• A written security policy, with training and periodic review.
• Vendor due diligence, because the firm remains answerable for its processors.
• Retention discipline - keeping personal data only while the purpose is served, as the law requires.

Where a firm holds a large volume of sensitive data, it may also be designated a Significant Data Fiduciary under section 10 of the Act, which brings additional duties such as appointing a Data Protection Officer and conducting periodic audits. The Act leaves the designation to a Central Government notification, so the position for any given firm should be checked rather than assumed.

The notification duty under section 8(6)

Section 8(6) is the provision most firms will actually face. In the event of a personal data breach, the Data Fiduciary must intimate the Data Protection Board and each affected Data Principal, in the form and manner prescribed by the rules. The duty is dual: notifying the regulator alone is not enough, and notifying the clients alone is not enough. A personal data breach is defined broadly - any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. A ransomware incident, a lost laptop, an email sent to the wrong client, and a misconfigured cloud folder all qualify.

The practical sequence after a suspected breach is:

1. Contain it. Cut off compromised accounts, revoke credentials, isolate affected systems and preserve logs before anyone "cleans up". Wiping a system destroys the very evidence needed to establish what was taken.
2. Assess scope. Identify whose personal data was involved, what categories, and whether the breach is material. This step decides what must be reported.
3. Intimate the Board and affected Data Principals. Do it in the prescribed form and manner and without delaying to complete a perfect investigation. The duty to notify is separate from the duty to fully investigate.
4. Document the timeline. Record when the breach was detected, what was done, and who decided what. Regulators and courts assess the response, not just the incident.
5. Preserve electronic records properly. Logs and system records must be capable of being proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which means the certificate under section 63(4) should be thought about early, not at trial.
6. Notify insurers and, where dishonesty is suspected, the police. Information about a cognizable offence is recorded under section 173 of the BNSS, 2023.

The older framework that still bites: IT Act section 43A

Section 43A of the IT Act, 2000 provides that where a body corporate possessing, dealing or handling sensitive personal data in a computer resource is negligent in implementing reasonable security practices, causing wrongful loss or gain, it is liable to compensate the affected person. The rules made under it set out reasonable security practices. This route does not require a regulator to act - an affected client can claim compensation directly. The DPDP Act, 2023 provides in section 44 for the omission of section 43A, but that omission takes effect only when notified. Until the notification, firms should treat both frameworks as live, and because the transition is still working itself out, this is an area where the law should be described as unsettled rather than final.

What a breach can cost a firm

The DPDP Act, 2023 sets monetary penalties in its Schedule. These are statutory maxima that the Data Protection Board may impose; they are not automatic, and the Board must follow the inquiry procedure in the Act.

Alongside the regulator, a firm faces its clients. A client whose financial records were exposed can argue negligence, and where the engagement letter contains a confidentiality or data-protection clause, a contractual claim as well. Professional-indemnity insurance may respond, but insurers examine whether the firm followed its own policy, which is exactly what section 8(5) also asks.

When a breach becomes a criminal case

Not every breach is a crime, but some are. If an insider copies client data to sell it, the conduct can attract criminal breach of trust under section 316 of the Bharatiya Nyaya Sanhita, 2023, and the IT Act provisions on unauthorised access and computer-related offences. If documents or electronic records are altered or fabricated to conceal the breach, forgery under section 336 or the use of a forged document under section 340 of the BNS may apply, and section 66 of the IT Act covers dishonest computer-related acts. Where the firm itself is the accused - for instance, an allegation that a partner knowingly disclosed client records - the professional regulator and the criminal court may examine the same facts, and the firm's records become central evidence.

Professional and client-facing exposure

Independently of the DPDP Act, a chartered accountant's conduct is governed by the Chartered Accountants Act, 1949 and the code of ethics that flows from it, including the confidentiality a client is entitled to expect. A disciplinary complaint does not need a data-protection finding; it can be triggered by the same facts. For corporate clients, the Companies Act, 2013 adds duties around books of account and audit records, and falsification of books is itself a serious offence. The practical consequence is that a data breach at a CA firm is rarely a single-regulator event - the ICAI, the Data Protection Board, a civil court and possibly a criminal court can each take an interest.

Where the law is still unsettled

Three points should be stated plainly. First, the detailed rules prescribing the breach-notification form, the manner and the timeline have been the subject of change, so a firm should confirm the position current at the time of the breach rather than rely on a fixed memory of it. Second, the omission of IT Act section 43A by the DPDP Act, 2023 operates only on notification, so both regimes coexist for now. Third, whether a particular incident is a "personal data breach" requiring notification is a judgement call that benefits from legal advice at the point of decision, not after it. Where the law is developing, a firm is far safer documenting its reasoning than assuming a uniform answer applies.

Common mistakes after a breach

• Deleting or reimaging the affected system, destroying logs and the evidence needed to defend the firm.
• Notifying clients but not the Board, or the reverse, when section 8(6) requires both.
• Waiting for a completed forensic report before any notification, when the duty to intimate is not suspended by an unfinished investigation.
• Assuming the cloud provider or IT vendor carries the legal responsibility. The security duty under section 8(5) follows the Data Fiduciary.
• Treating the incident as purely regulatory, and ignoring the client's compensation claim under IT Act section 43A and the contractual confidentiality clause.

When to involve a lawyer

A firm should take legal advice the moment a breach is suspected, and certainly before sending any notification. The immediate tasks are to define the notification obligation precisely, to protect the evidence so that it can be proved later under the Bharatiya Sakshya Adhiniyam, 2023, to handle communications with affected clients without creating avoidable admissions, and to coordinate the answer to the Board, the insurer and any police complaint. Our cyber crime lawyers in Kolkata advise professional firms on exactly this sequence - containment, notification and defence - and a first discussion can be arranged through our contact page. Advice is cheaper the earlier it reaches the file.

A data breach is judged on the quality of the response. Firms are penalised far less for the incident itself than for what they failed to do in the days after it.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Patient Data Breach: Legal Duties of Hospitals in India
• Property Fraud Online: Duties of Real Estate Agents
• E-Commerce Sellers: Fraud, Duties and Legal Remedies
• Cyber Security Legal Checklist for Startups in India
• Cyber Crime Compliance for Companies in India: Legal Duties
• Cyber Bullying and Schools: Duties and Liability in India

Cyber crime lawyer in your city · Bank account freeze help · Contact