DPDP Act Compliance for Finance and Accounting: What Indian Businesses Must Prepare For

A payroll executive downloads an employee master containing names, PAN details, bank accounts and salaries. One copy is uploaded to the payroll platform, another is emailed to an external consultant, and a third remains on a laptop. Months later, nobody is certain who can still access those files or when they should be deleted.

This is not an unusual cyberattack scenario. It is an ordinary finance workflow—and exactly why readiness for India’s Digital Personal Data Protection Act, 2023 (DPDP Act) cannot sit only with legal or IT teams.

Finance functions routinely collect and use personal data belonging to employees, customers, vendors, contractors, investors and directors. As the DPDP framework moves towards its main operational phase, businesses need to understand where that data travels, why it is retained, who can access it and what happens when a person exercises a statutory right.

In short: DPDPA compliance for finance and accounting requires a business to identify the digital personal data used in finance workflows, establish a valid purpose for processing it, provide notices where required, limit collection and access, maintain accuracy and security, manage processor contracts, respond to individual requests and erase data when its purpose ends—unless another law requires retention. Most substantive business obligations are scheduled to commence on 14 May 2027, but process and system preparation should begin now.

What the DPDP Act and DPDP Rules Mean for Businesses

The DPDP Act governs digital personal data processed in India, including data collected on paper and subsequently digitised. It can also apply to processing outside India when connected with offering goods or services to people in India. Purely personal or domestic processing and certain publicly available data are outside its scope.

Three terms are particularly important:

• Data Principal: the individual to whom the personal data relates—for example, an employee, customer, consultant or individual vendor.
• Data Fiduciary: the person or organisation that determines why and how personal data is processed. An employer deciding how payroll data is used will generally occupy this role.
• Data Processor: a person or organisation processing personal data on behalf of a Data Fiduciary. Depending on the facts and contractual arrangement, a payroll bureau or outsourced accounting provider may act as a processor for particular activities.

Roles are determined by actual decision-making and processing—not merely by the label used in a contract. A service provider may also be a Data Fiduciary for data it processes for its own purposes.

The implementation position as of 21 September 2026

The final DPDP Rules, 2025 were notified on 14 November 2025, alongside a notification bringing the Act into force in phases. The framework is therefore no longer at the draft-Rules stage.

Phase	Effective date	What it broadly covers
Initial phase	14 November 2025	Definitions; establishment and functioning of the Data Protection Board; rule-making and specified institutional provisions; Rules 1, 2 and 17–21
Consent Manager phase	14 November 2026	Registration and obligations of Consent Managers under section 6(9), section 27(1)(d) and Rule 4
Main operational phase	14 May 2027	Most substantive obligations and rights, including grounds for processing, notices, consent, general Data Fiduciary obligations, security safeguards, breach notification, children’s data, Data Principal rights, and Rules 3 and 5–16, 22 and 23

This phased commencement matters. As at the update date, many day-to-day duties discussed below are enacted and notified but are scheduled to become enforceable on 14 May 2027. Businesses should treat the intervening period as implementation time, not as a reason to wait.

Why Finance and Accounting Teams Are Directly Affected

Finance teams may hold more identifiable information than almost any other business function:

• employee names, contact details, PAN and bank information;
• salaries, incentives, reimbursements and benefit records;
• Aadhaar or other identity documents where lawfully collected;
• customer contacts, billing details and payment records;
• vendor, contractor and sole-proprietor information;
• tax declarations, withholding records and statutory filings;
• investor, director and shareholder information; and
• expense claims containing travel, medical or family information.

The risks often arise through routine behaviour: shared spreadsheet passwords, broad access to accounting folders, KYC documents exchanged over personal messaging apps, former employees retaining access, duplicate downloads, or records retained indefinitely “just in case”.

The issue is not simply whether data exists. It is whether the business can explain and control its full lifecycle—from collection and use to sharing, retention and deletion.

Key DPDP Responsibilities Affecting Finance Operations

Establish the processing ground and communicate clearly

Once the relevant provisions commence, personal data may be processed for a lawful purpose based on consent or a “certain legitimate use” specified in the Act. Consent, where relied upon, must be free, specific, informed, unconditional and unambiguous, with clear affirmative action. It must be limited to data necessary for the specified purpose.

Not every finance activity will depend on consent. The Act includes certain legitimate uses, including processing for employment-related purposes and processing required to meet legal obligations in specified circumstances. Businesses should map each purpose to an appropriate legal basis with qualified counsel rather than applying one blanket consent to every activity.

Rule 3, scheduled for 14 May 2027, requires a standalone, clear notice containing an itemised description of the personal data and specified purposes, along with ways to withdraw consent, exercise rights and complain to the Board.

Collect only what the purpose requires

Data minimisation is explicit where consent is the basis: consent must be limited to personal data necessary for the purpose. It is also a sound control elsewhere. If a vendor onboarding process needs bank and tax information, it should not collect unrelated identity details merely because an old form contains those fields.

Maintain accuracy where decisions or disclosures are involved

The Data Fiduciary must ensure completeness, accuracy and consistency where personal data is likely to be used to make a decision affecting the individual or disclosed to another Data Fiduciary. In finance, inaccurate bank, tax, reimbursement or payroll data can directly affect a person.

Apply reasonable security safeguards

The Act requires reasonable security safeguards. Rule 6 specifies minimum measures scheduled for the main operational phase, including appropriate protection such as encryption, masking or tokenisation; access controls; logs, monitoring and review; backups; contractual safeguards with processors; and appropriate technical and organisational measures.

For finance operations, common implementation measures may include role-based access, multi-factor authentication, controlled folders, maker-checker approval, secure transfer channels and periodic access reviews. These are practical control recommendations; the suitable combination depends on the organisation’s risks and systems.

Prepare for breach notification

The Act requires the Data Fiduciary to notify the Data Protection Board and each affected Data Principal of a personal-data breach. Rule 7 provides details on the content and timing, including notification to affected individuals without delay and a detailed submission to the Board within 72 hours of becoming aware of the breach, unless the Board allows a longer period.

A finance incident plan should therefore cover misdirected payroll emails, compromised accounting credentials, lost laptops and unauthorised vendor-master changes—not only ransomware.

Respect retention duties and erasure rights

Personal data should not be held forever. Under section 8(7), once operational, a Data Fiduciary must erase data when consent is withdrawn or it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, and cause its processor to erase the data—unless retention is necessary to comply with another law.

This exception is crucial in finance. Tax, company, employment and other laws may require particular records to be retained. A deletion request should trigger a documented assessment, not automatic deletion or indefinite refusal.

Enable Data Principal rights

The Act provides rights relating to access, correction, completion, updating, erasure, grievance redressal and nomination. Finance teams need a route to locate relevant records across payroll tools, accounting systems, email, shared drives and service providers without exposing somebody else’s information.

Oversee processors and vendors

A Data Fiduciary remains responsible for processing undertaken on its behalf by a Data Processor, irrespective of an agreement to the contrary. Processors must be engaged under a valid contract. That makes vendor selection, written instructions, access controls, security provisions, breach escalation and exit arrangements central to outsourced accounting data security.

Treat children’s data with additional care where relevant

Most B2B accounting records will relate to adults, but children’s data can appear in insurance, benefits, reimbursements, education services or customer accounts. The Act includes additional requirements for verifiable parental consent and restrictions on processing likely to cause detrimental effects, subject to notified exemptions. Businesses should identify whether this applies rather than assuming finance systems contain no children’s data.

A Practical DPDPA Readiness Checklist for Finance Teams

The following is an implementation checklist, not a statement that every item is expressly mandated in this exact format.

1. Create a finance-data inventory. List personal data fields used in payroll, AP, AR, expenses, compliance, treasury, fundraising and reporting.
2. Map the data flow. Record where each item is collected, stored, downloaded, shared and archived, including email and messaging tools.
3. Assign roles. Determine which entity is the Data Fiduciary or processor for each workflow and document the business owner.
4. Record the purpose and legal basis. Separate consent-based processing, certain legitimate uses and statutory obligations with legal input.
5. Review collection forms and notices. Remove unnecessary fields and prepare clear, purpose-specific communications where required.
6. Restrict access. Apply least-privilege and role-based access; remove former staff and review privileged users periodically.
7. Control copies and transfers. Replace uncontrolled attachments and local files with approved repositories and secure sharing methods.
8. Build a retention schedule. Reconcile DPDP erasure principles with tax, corporate, employment and other statutory retention duties.
9. Create a rights-request workflow. Establish ownership, identity verification, search procedures, review and response tracking.
10. Strengthen incident response. Define how finance staff and providers identify, contain, escalate and document a suspected breach.
11. Review provider contracts and controls. Cover processing instructions, security, subcontractors, incident reporting, audit cooperation, return and deletion.
12. Retain evidence. Maintain approvals, access reviews, training records, process documents and remediation logs to create an auditable trail.

What Changes When Finance Is Outsourced?

Outsourcing bookkeeping, payroll or accounts payable does not necessarily outsource accountability. If your company decides the purpose and means of processing, it remains the Data Fiduciary for processing performed on its behalf and is responsible for compliance.

The provider relationship should therefore be operationally clear—not limited to a confidentiality clause. Confirm which systems will be used, where files will be stored, who will have access, whether subcontractors are involved, how instructions are documented and what occurs when the engagement ends.

Questions to ask a finance outsourcing provider

• What personal data will your team access for our engagement?
• How is access approved, restricted, logged and revoked?
• Which systems, storage locations and communication channels will be used?
• Will any subprocessors or third-party tools process our data?
• What security and organisational controls protect the information?
• How quickly will you escalate a suspected personal-data breach?
• How will you support correction, access and erasure requests?
• What happens to files, backups and credentials when the contract ends?
• Can you provide current, independently verifiable security credentials and clarify their scope?

How Ocellus Can Support More Secure Finance Operations

DPDPA readiness needs legal interpretation, privacy governance, technology and workable business processes. Ocellus can support the finance-process layer and work alongside a client’s legal, IT, cybersecurity and privacy advisers.

Depending on the engagement, this may include helping a business:

• identify personal-data touchpoints in finance and accounting workflows;
• map collection, use, sharing, storage and hand-offs;
• document workflows, owners and maker-checker responsibilities;
• strengthen role-based access and approval practices;
• reduce uncontrolled duplication and circulation of records;
• establish structured document-management and retention routines;
• design controlled processes for payroll, vendor onboarding, reimbursements and bookkeeping;
• review finance-related vendors and service-provider controls; and
• build more consistent, traceable and audit-ready finance operations.

Ocellus’s finance and accounting outsourcing, process outsourcing, CFO services, startup support and project consulting capabilities allow controls to be considered within the actual operating process—not as a separate policy that teams struggle to apply.

Ocellus is not presented here as a law firm, Consent Manager or regulatory certifying authority. Legal conclusions and the final compliance position should be confirmed with qualified privacy counsel.

Why Ocellus’s Security Credentials Matter

Ocellus states that its Information Security Management System is certified to ISO/IEC 27001:2022, covering business strategy, accounting consultation and advisory, finance and accounting process outsourcing, and CFO services. ISO 27001 provides a structured framework for identifying and managing information-security risks, responsibilities and controls.

Ocellus also states that it has been assessed against the UKCert-GDPR Management Standard across the same service areas. This is relevant evidence of structured data-protection practices within its operations.

Neither credential automatically makes Ocellus—or any client using its services—compliant with the DPDP Act. DPDPA compliance depends on the organisation’s role, processing activities, purposes, notices, systems, contracts, decisions and implementation. The credentials are better understood as due-diligence indicators that should be evaluated alongside engagement-specific controls.

When Should a Business Begin Preparing?

Now. The main operational provisions are scheduled for 14 May 2027, but a reliable data inventory cannot be created overnight. Contracts may need renegotiation, retention conflicts require legal review, access problems require system changes, and employees need usable procedures.

Preparation is especially important if your business:

• processes payroll or reimbursements through spreadsheets and email;
• has no consolidated record of finance-data locations;
• outsources accounting without detailed data-handling provisions;
• cannot promptly revoke or review system access;
• retains KYC, bank or tax records without a schedule;
• is preparing for fundraising or due diligence; or
• has GDPR processes but has not mapped them to India’s distinct DPDP framework.

GDPR work may provide a useful foundation, but it does not establish DPDPA compliance. The two frameworks differ in scope, terminology, grounds for processing, rights and implementation requirements.

Build DPDPA Readiness into the Finance Function

The most useful starting point is not a generic privacy policy. It is a close look at where personal data enters everyday finance operations, how it moves, who can see it and why it remains stored.

Speak with Ocellus about reviewing the personal-data touchpoints, controls and documentation within your finance and accounting processes. Ocellus can help strengthen the operational finance layer while working alongside your legal, privacy, IT and cybersecurity advisers.

Disclaimer: This article provides general information and does not constitute legal advice. Application of the DPDP Act and Rules depends on the facts, roles and processing activities of each organisation. Obtain advice from a qualified legal or privacy professional before making compliance decisions.

---

FAQs

Does the DPDPA apply to small businesses and startups?

The DPDP Act does not provide a general exemption merely because an organisation is a startup or SME. Applicability depends on whether it processes digital personal data within the Act’s scope. The government may exempt certain classes of Data Fiduciaries, including startups, from specified provisions by notification, so each business should check the current position and its activities.

Is payroll data covered by the DPDP Act?

Payroll files usually contain digital personal data such as names, bank accounts, PAN details, salary and benefits information. They can therefore fall within the Act’s scope. Employment-related processing may qualify as a “certain legitimate use” under section 7(i), but that does not remove the need to assess other applicable duties once in force.

Is an outsourced accounting firm a Data Processor?

It may be a Data Processor when it handles personal data on a client’s behalf and under the client’s purposes and instructions. Its exact role depends on the facts. If it determines purposes and means for particular processing of its own, it may be a Data Fiduciary for that activity.

Does outsourcing accounting transfer DPDPA responsibility?

No. The Act states that a Data Fiduciary remains responsible for processing undertaken on its behalf by a Data Processor, irrespective of an agreement to the contrary. A valid contract and effective vendor oversight are therefore essential.

Is ISO 27001 enough for DPDPA compliance?

No. ISO/IEC 27001:2022 is relevant to a structured information-security management system, but it does not by itself certify compliance with India’s DPDP Act. DPDPA obligations also concern processing grounds, notices, rights, retention, contracts and organisation-specific implementation.

Does GDPR compliance mean a company is DPDPA-compliant?

No. GDPR controls may provide a strong starting point, but the DPDP Act has its own scope, terminology, legal framework and Rules. Businesses should conduct an India-specific gap assessment rather than assume equivalence.

What should a company ask its finance outsourcing provider?

Ask what personal data it receives, who can access it, what systems and subprocessors are used, how access is logged and revoked, how incidents are escalated, how rights requests are supported, and how data is returned or deleted at exit. Verify security credentials and confirm that their scope covers the service being purchased.

When should businesses start preparing for the DPDP Rules?

Businesses should prepare now. As of 21 September 2026, the main operational provisions are scheduled to commence on 14 May 2027. Mapping data, changing contracts, fixing access, setting retention rules and training teams can take months.

Disclaimer: This article is intended for general informational purposes only and does not constitute legal, regulatory or professional advice. The applicability of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 depends on each organisation’s specific activities, responsibilities and data-processing practices. Businesses should consult a qualified legal or data-privacy professional before making compliance decisions. Ocellus Consulting does not guarantee DPDPA compliance or act as a substitute for legal counsel.