The DPDP Act for Advocates and Law Firms

A law practice is a concentration of other people's personal data: Aadhaar and PAN copies in vakalatnamas, addresses and phone numbers in petitions, medical records in MACT claims, bank statements in matrimonial and insolvency matters. Under the DPDP Act, the firm holding that data is a Data Fiduciary — and the obligations attach to the firm, not the client.

Where DPDP meets daily legal practice

Redaction becomes a duty, not a courtesy

Data minimisation means filings and shared documents should carry only the personal data the purpose requires. Masking Aadhaar numbers, PAN, bank account numbers and minors' identities before circulation is the practical expression of that duty. Two cautions: drawing a black rectangle over text in a PDF does not remove the text underneath, and uploading a client document to a free cloud redaction tool defeats the purpose — you have disclosed the entire unredacted document to an unknown processor in order to redact it.

Privilege does not exempt you

Professional privilege protects communications from compelled disclosure; it does not exempt the firm from data protection obligations toward the personal data it holds. The two regimes coexist: privilege governs who can demand your files, DPDP governs how you must protect them.

A five-point plan for a law office

1. Inventory client-document storage (server, drives, email, clerks' laptops) and apply access controls and encryption.
2. Replace cloud PDF utilities with client-side tools for merging, compressing, redacting and converting case files.
3. Adopt a redaction SOP: pattern-based detection of Aadhaar/PAN/phone numbers, true text-layer removal, and a verification pass.
4. Password-protect (AES) documents sent by email; share passwords over a separate channel.
5. Define retention: how long closed-matter files are kept, and a yearly purge with a log entry.