The DPDP Act and client bank statements — what it means for a practice
Short answer: uploading a client’s statement is a disclosure to a third party, and the DPDP Act makes you accountable for it. Not prohibited — accountable. The distinction matters, and it has a clean architectural answer.
This is a plain-language overview for practitioners, not legal advice. The Act’s commencement and rules have been phased; confirm the current position before relying on any of it.
The vocabulary, briefly
India’s Digital Personal Data Protection Act, 2023 uses three roles:
- Data Principal — the individual the data is about. Your client.
- Data Fiduciary — whoever determines the purpose and means of processing. If your practice decides to convert a client’s statement and how, that is you.
- Data Processor — anyone processing on the fiduciary’s behalf. An online converter that receives the file is one of these.
A bank statement belonging to an individual — a proprietor, a partner, a salaried client — is digital personal data in an unusually rich form. A statement belonging to a company is not personal data as such, though named individuals appearing in it may be.
Where the converter fits
The moment you upload a client’s statement to a server-side converter, you have engaged a Data Processor. That is permitted, and it is ordinary — practices engage processors constantly. What the Act asks is that it happen under a valid contract, and that you, as fiduciary, remain answerable for what that processor does.
The practical difficulty is what the contract usually is: a free web tool’s click-through terms, drafted by the vendor, in a jurisdiction you did not choose, revocable at will, with a retention promise you cannot inspect. Compare that with the standard of accountability you would apply if a client asked how you protect their data, and the gap is obvious.
Alongside that sit the fiduciary duties that do not go away because a third party is involved: processing for a stated purpose, reasonable security safeguards, erasure once the purpose is served, breach notification, and a grievance route for the client. The breach obligation is the sharp one — if the converter is breached, the personal data exposed is your client’s, and you disclosed it.
Three architectures, three different answers
| Approach | Is there a disclosure? | What you have to be able to show |
|---|---|---|
| Server-side online converter | Yes — file leaves your control | A contract with the processor, its security posture, its retention and deletion, and a breach path |
| Desktop software | No transmission, if it does not phone home | That it does not, which is harder to demonstrate than it sounds |
| In-browser converter | No — the file never leaves the device | That processing is local; testable by disconnecting from the network |
The third row is not a stronger promise than the first. It is a different structure, and that is the point. A promise is something you audit; an architecture that makes transmission impossible is something you test in ten seconds. The comparison of converter architectures sets out the test.
Consent is not the interesting question
Practitioners often reach for consent first — will the client sign something. Usually there is a basis for processing the statement, because that is what the engagement is for. The engagement letter covers the work.
What the engagement letter typically does not cover is onward disclosure to a named third party for convenience during data entry. That is the exposure: not whether you may process the statement, but whether you may hand it to someone else’s server to do so. Which is why removing the disclosure is a cleaner fix than papering it.
AI assistants are the same question, sharper
Pasting a client statement into a general-purpose AI assistant is the same disclosure with two extra problems: retention and training use depend on plan and settings that can change, and the output cannot be shown to be complete. Covered separately in bank statements and ChatGPT, Gemini or Claude.
ICAI obligations run alongside
Data protection law does not replace professional confidentiality. Duties under the Chartered Accountants Act and ICAI’s ethical standards apply independently, and on client confidentiality they are in some respects stricter. Satisfying one does not discharge the other, and the safest reading is to meet whichever is more demanding on a given point.
A short checklist
- Inventory it. For each tool touching client statements, know whether the file leaves the device. Most practices have never asked.
- Test, do not read. Disconnect from the internet and convert. Works offline means local.
- For anything that does upload, know the retention policy, the jurisdiction and the breach process — and be able to produce them if a client asks.
- Prefer local processing for the extraction step specifically. It is the step with no upside to sending data anywhere.
- Keep the engagement letter honest about third-party tools that genuinely are in the chain.
Where TieOut sits
The statement is parsed by JavaScript in your own browser tab. It is not uploaded, password- protected files are decrypted locally, the password is never transmitted, and there is no backend that receives statements — so there is no processor to contract with and no third-party retention to account for. The privacy policy states it in detail; disconnecting your Wi-Fi and converting a statement anyway will confirm it faster.
FAQ
Does the DPDP Act apply to a chartered accountant handling client statements?
Where the client is an individual — a proprietor, a partner, a salaried person — their bank statement is digital personal data, and a practice that decides how and why it is processed is acting as a Data Fiduciary for it. That brings obligations around purpose, security safeguards, retention and grievance redressal. Data about a company as an entity is not personal data, though named individuals inside it may still be.
Is uploading a client statement to an online converter a disclosure?
Yes. Sending the file to a third party's server is processing by a Data Processor on your behalf. The Act permits that, but it has to be under a valid contract, and you remain accountable to your client for what the processor does. Clicking through a free tool's terms is a thin basis for that accountability.
What are the penalties under the DPDP Act?
The Act provides for significant financial penalties determined by the Data Protection Board, with the highest tier attached to failing to take reasonable security safeguards to prevent a personal data breach. Amounts and the enforcement timeline are set out in the Act and its rules — check the current position rather than relying on a summary, including this one.
How do I avoid the disclosure question entirely?
Use a tool that does not transmit the file. If the statement is parsed inside your own browser and never reaches a server, no disclosure to a processor occurs, so there is no contract to paper and no third-party retention to account for. You can verify it by disconnecting from the internet and converting anyway.
Does this replace my ICAI confidentiality obligations?
No — it sits alongside them. Professional confidentiality duties apply independently of data protection law, and in some respects are stricter. Meeting one does not discharge the other.