Client Data and AI: Privacy Rules Every Accountant Should Follow
- Indian accountants using AI tools must follow the Digital Personal Data Protection Act, 2023 and obtain explicit consent before processing client financial data through any AI platform.
- Never upload raw client PAN, Aadhaar, bank statements, or salary slips to a public AI tool without a Data Processing Agreement in place with that vendor.
- A simple written data-handling policy and client consent form can protect your practice from significant penalties under Indian privacy law.
- What Counts as "Client Data" Under the DPDP Act?
- The Core Rule: Consent Before You Process
- A Worked Example: What Happens When You Use AI on Salary Data
- Your Obligations as a Data Fiduciary
- Choosing the Right AI Tool: A Quick Checklist
- Common Mistakes Accountants Make With AI and Client Data
- Building a Simple Data-Safe AI Workflow
If you use any AI tool — ChatGPT, Gemini, a cloud accounting assistant, or even an AI-powered ITR software — to process your client's financial data, Indian privacy law already applies to you. The Digital Personal Data Protection Act, 2023 (DPDP Act) treats a client's name, PAN, income figures, and bank details as personal data. As the accountant who decides what to do with that data, you are legally a Data Fiduciary. That means the responsibility for protecting that data sits with you, not with the AI company. Here is exactly what that means in practice and what you must do right now.
What Counts as "Client Data" Under the DPDP Act?
Almost everything a client shares with you qualifies as personal data under the DPDP Act. This is broader than most accountants expect.
- Identity data: Full name, PAN, Aadhaar number, date of birth
- Financial data: Salary slips, Form 16, bank statements, GST turnover figures, ITR details
- Sensitive inferences: Tax liability amount, loan repayment capacity, net worth estimates generated by an AI tool from the above inputs
- Business data: Client's vendor names, creditor lists, profit figures — if linked to an identifiable individual (especially in proprietorships and partnerships)
A one-person proprietorship's GST return is effectively personal data because the business and the individual are the same legal person. Do not treat it as anonymous business data.
The Core Rule: Consent Before You Process
The DPDP Act requires that you obtain free, specific, informed, and unambiguous consent before processing a client's personal data. For accountants using AI, this creates a very specific obligation: if you paste a client's salary slip into an AI chatbot to generate a tax summary, the client must have already consented to that specific use.
A generic engagement letter that says "we may use technology to assist our services" is almost certainly not enough. Consent must describe what data, why, and which third-party platforms may receive it. Update your standard client onboarding form to include a clear AI data processing clause.
A Worked Example: What Happens When You Use AI on Salary Data
Suppose your client Priya earns a gross salary of ₹12,00,000 per year. You receive her Form 16 and paste it into an AI tool to auto-calculate her tax liability under the new tax regime.
The AI processes:
- Name and PAN (identity data)
- Employer name and TAN (linked entity data)
- Gross salary: ₹12,00,000
- Standard deduction: ₹75,000 (FY 2026-27 new regime)
- Net taxable income: ₹11,25,000
The AI then calculates approximate tax:
| Income Slab (New Regime, FY 2026-27) | Rate | Tax on Slab |
|---|---|---|
| Up to ₹4,00,000 | Nil | ₹0 |
| ₹4,00,001 – ₹8,00,000 | 5% | ₹20,000 |
| ₹8,00,001 – ₹11,25,000 | 10% | ₹32,500 |
| Total Tax (before cess) | ₹52,500 | |
| Health & Education Cess @ 4% | 4% | ₹2,100 |
| Total Tax Payable | ₹54,600 |
All of this is perfectly legitimate — if Priya's consent form covers AI-assisted processing and the AI vendor has signed a Data Processing Agreement (DPA) with you. If not, you have just violated the DPDP Act, potentially exposed Priya's PAN and income to a foreign server, and created a liability for your practice. The tax math is fine. The process was not.
Your Obligations as a Data Fiduciary
- Obtain verifiable consent before any AI processing. Keep a digital or physical record of the consent.
- Sign a Data Processing Agreement with every AI vendor that touches client data. Check whether the vendor stores your inputs for model training — many free tools do this by default.
- Limit data to what is necessary. If the AI needs income figures, do not paste the full bank statement. Anonymise or redact wherever possible before uploading.
- Notify clients of a data breach without undue delay. The DPDP Act requires notification to the Data Protection Board and affected individuals.
- Honor withdrawal of consent. If a client asks you to stop using AI for their data, you must comply and delete what has already been processed.
Choosing the Right AI Tool: A Quick Checklist
Not all AI tools carry the same risk. Before onboarding any platform, confirm the following:
- Does the vendor offer a signed Data Processing Agreement?
- Are servers located in India, or does the vendor comply with India's cross-border data transfer rules under the DPDP Act?
- Does the vendor use your inputs to train its AI models? (Opt out or choose an enterprise plan that disables training.)
- Does the platform have SOC 2 Type II or equivalent security certification?
- Can the vendor delete your data on request and provide written confirmation?
If you are unsure how your current practice stacks up against these requirements, running a Compliance Checkup on KyaTax can help you identify gaps quickly.
Common Mistakes Accountants Make With AI and Client Data
1. Using the Free Version of Public AI Tools for Client Work
Free tiers of most AI chatbots explicitly reserve the right to use your conversations for training. Pasting a client's PAN or salary data into a free chatbot window is a direct DPDP Act compliance failure. Use only enterprise or API versions with data-isolation guarantees.
2. No Written Consent Clause in the Engagement Letter
Most CA firms still use engagement letters drafted before the DPDP Act existed. These do not cover AI processing. Add a specific AI data processing clause before FY 2026-27 filings begin.
3. Treating GST Data of Proprietors as Anonymous Business Data
A sole proprietor's GSTIN, turnover, and supplier details are personal data under the DPDP Act. Uploading a proprietor's GST returns into any AI tool without consent is a violation, even if you think of it as "just business numbers."
4. Forwarding AI-Generated Summaries Without Reviewing Them
AI tools sometimes hallucinate numbers or misread figures. If you forward an AI-generated tax summary to a client without verifying it and the figure is wrong, you bear professional liability under the Chartered Accountants Act as well as potential DPDP Act issues if incorrect data was shared onward.
5. No Process for Data Deletion When a Client Leaves
Under the DPDP Act, you must delete personal data once the purpose for which it was collected is fulfilled, or when the client withdraws consent. Most accounting firms have no documented deletion protocol. Create one now — even a simple checklist works.
Building a Simple Data-Safe AI Workflow
You do not need expensive software to be compliant. Here is a practical workflow for FY 2026-27:
- Update your engagement letter with an AI consent clause before accepting any new client.
- Maintain a vendor register listing every AI tool used and its DPA status.
- Before using AI on any file, redact the client's name and PAN where the calculation does not require them.
- Download and delete AI session data at the end of each working day if your platform allows it.
- Keep a one-page internal policy document. If the Data Protection Board ever enquires, documented intent and process go a long way.
Privacy compliance is not about fearing AI. It is about using it responsibly so your clients trust you more, not less.
Do it yourself in minutes — free to try, no login needed.
Open Compliance Checkup →Frequently asked questions
Does the DPDP Act apply to small CA firms and individual accountants?
Yes. The DPDP Act applies to any entity that processes personal data of Indian individuals, regardless of the firm's size or turnover. If you handle even one client's PAN or salary data using any digital tool or AI platform, you qualify as a Data Fiduciary and must comply with consent, security, and data deletion obligations.
Can I use ChatGPT to prepare a client's ITR if I have their consent?
Consent is necessary but not sufficient on its own. You also need a Data Processing Agreement with OpenAI that covers your use case and restricts them from training on your data. OpenAI's enterprise and API tiers offer this; the free consumer version does not. Even with consent, use the minimum data needed — for example, enter income figures without names or PAN where possible.
What penalty can an accountant face for a client data breach under the DPDP Act?
The DPDP Act provides for significant financial penalties for data breaches and non-compliance, adjudicated by the Data Protection Board of India. The specific penalty amount depends on the nature and severity of the breach. Beyond statutory penalties, you also face professional misconduct proceedings under the Institute of Chartered Accountants of India's disciplinary mechanism, which can affect your certificate of practice.
What should a client data consent form for an accounting practice include?
Your consent form should clearly state: (1) what categories of personal data will be processed (PAN, income details, bank data, etc.), (2) the specific purpose of processing such as ITR filing or GST compliance, (3) the names or categories of third-party AI tools or cloud platforms that will receive the data, (4) how long the data will be retained, and (5) the client's right to withdraw consent at any time. Keep a dated, signed copy for your records.
General information for FY 2026-27, not professional advice for your specific case. Rules change — verify against the latest notification or ask a KyaTax expert.
Related: All free tools · More guides · Virtual CFO