What does the DPDP Act mean for client data?

The Act talks about a Data Fiduciary, the organisation that decides why and how personal data is processed, and a Data Principal, the person the data is about. A Data Processor handles data on the fiduciary's instructions. In ordinary terms: the law firm, clinic, CA firm or agency that decides to keep a client's file is responsible for that decision. A software studio that builds or hosts the system on the firm's instructions is not a substitute for that responsibility.

Client names, phone numbers, identity documents, patient appointments and financial papers are personal data when they identify a person. A firm that has been keeping them in chat threads and a shared drive has not been outside the question. The software is where the firm's choices become enforceable, or fail to.

The Digital Personal Data Protection Rules, 2025 were notified in the Gazette on 13 November 2025. Their commencement clause does not switch every duty on that day. Some rules, including parts of the Data Protection Board machinery, apply from publication. Consent-manager registration is set for one year after publication. The rules that carry the day-to-day duties of organisations are set for eighteen months after publication, which is 13 May 2027.

Secondary commentary sometimes computes those later dates and then notes that a notification could still clarify them. Treat the dates as what the Rules' commencement clause says, and ask counsel to confirm the latest government notification before you rely on one. Do not treat the gap as permission to collect whatever is convenient until 2027. Duties that already exist under the Information Technology Act framework, including around sensitive personal data, have not been paused.

Purpose: why this record exists, said in a sentence a client could read. Notice: what the person is told at the moment the data is collected, not in a policy nobody opens. Access: which roles can see which clients, and how a leaver loses that access the same day. Retention: how long a matter, a tax year or a patient enquiry is kept, and what deletion means in a system that also keeps backups.

Breach path: who is told, inside the firm, if a mailbox or a database is exposed, and how fast. The Act expects fiduciaries to be able to inform the Board and affected people. A firm that has never named an owner for that hour will not invent a good process on the day. Hosting belongs in the same conversation. If the data should stay in India, or if a UK or Gulf client brings another regime with them, that is a requirement, not a hosting preference discovered at launch.

A serious system can restrict a file to the people on that matter, keep a record of a download, separate a public website enquiry from a client's working papers, and make export and deletion a defined action rather than a favour from a developer. Those are engineering choices Sunbeam will design with the firm.

Software cannot certify that the firm is compliant, and Sunbeam does not issue that certificate. The purpose of the processing, the notice, and the decision to keep the data remain the firm's, taken with its own advisers. If you want the operational questions in shorter form, they are also on the FAQ.