You are between hearings, sitting in the bar room, scrolling through WhatsApp to find a client's Aadhaar copy someone on your team forwarded last week. The photo is buried somewhere between causelist screenshots and hearing reminders. That single moment, a government ID living unencrypted in a chat thread, is exactly the kind of exposure the Digital Personal Data Protection Act, 2023 (DPDP Act) was written to address.
Digital privacy for lawyers is now a statutory obligation, not just a matter of professional ethics. Under the DPDP Act, read with the DPDP Rules 2025, every law firm and advocate that collects or processes a client's personal data must meet specific security standards or face penalties of up to INR 250 crore per breach category.
Pair that with the Supreme Court's October 2025 ruling reinforcing attorney-client privilege under the Bharatiya Sakshya Adhiniyam 2023, and the message is clear: how you handle client data defines both your legal exposure and your professional standing.
Why Does the DPDP Act Apply to Law Firms?
Many advocates assume the DPDP Act targets tech companies and banks. It does not. The Act defines a "Data Fiduciary" as any person who determines the purpose and means of processing personal data. When your firm collects a client's identity proof, financial statements, or medical records for a claim, it determines why and how that data is processed. That makes you a Data Fiduciary.
The DPDP Rules 2025, notified via Gazette notification G.S.R. 846(E) in November 2025, set a three-phase implementation timeline. Substantive Data Fiduciary obligations are expected to take effect around May 2027. But waiting until enforcement begins is a mistake. Building compliant workflows takes time, and the penalties are steep.
What Are the Key Obligations?
Security safeguards that do not switch off
Section 8(1) places a non-delegable obligation on every Data Fiduciary to implement "reasonable security safeguards." Section 8(5) reinforces the requirement for accurate data. These obligations persist even where legal-work exemptions apply.
Rule 6 requires contracts with Data Processors to mandate equivalent security, including encryption, access controls, and log retention for at least one year. For a solo practitioner, this means unencrypted folders on a shared desktop, client documents forwarded over personal email, and identity copies saved in WhatsApp groups each represent a gap that could trigger liability.
Purpose limitation and breach notification
You can process only the personal data necessary for the matter at hand. You cannot retain a client's Aadhaar and PAN collected for a property transaction indefinitely for unrelated future use without fresh consent.
If client data is compromised, the firm must notify the Data Protection Board and affected clients within prescribed timelines. Once a matter concludes and no legal retention requirement applies, personal data must be deleted, a point that intersects uncomfortably with litigation-hold duties and needs clear internal policies.
How Does the Supreme Court's 2025 Privilege Ruling Change Things?
On 31 October 2025, the Supreme Court delivered a landmark ruling in In Re: Summoning Advocates who give Legal Opinion or Represent Parties During Investigation of Cases (2025 INSC 1275). The three-judge bench held that an investigating officer cannot directly summon a lawyer to extract case facts covered by privilege.
The ruling grounded attorney-client privilege in Section 132 of the Bharatiya Sakshya Adhiniyam, 2023. It held that any permissible summons must clearly state the enabling facts and be issued only with prior written approval from an officer not below SP rank, subject to judicial review under Section 528 BNSS.
The Court also tied privilege protections to Articles 19(1)(g), 21, and 22(1), building on the K.S. Puttaswamy (2017) right-to-privacy framework.
For practicing advocates, this is both a shield and a responsibility. Privilege protects what your client tells you, but that protection matters only if you keep those communications secure. A data breach that exposes privileged content to unauthorized parties is not covered by privilege.
One important limitation: in-house counsel do not enjoy Section 132 privilege. They receive narrower protection under Section 134 of the BSA.
What Practical Steps Should Your Firm Take Now?
You do not need to overhaul everything overnight. But start now, well before enforcement begins. Five steps will put your practice on solid ground:
Audit where client data lives — map every location, from case management software to WhatsApp groups to USB drives.
Move to encrypted, access-controlled storage — a shared desktop folder with no password does not meet "reasonable security safeguards."
Establish consent and purpose-limitation workflows — document the purpose before collecting personal data and flag when retention periods expire.
Train your team — everyone who handles client data needs to understand why forwarding an Aadhaar copy over WhatsApp is a risk, not just an inconvenience.
Prepare for breach response — draft who to notify internally, how to assess scope, and how to communicate with clients and the Data Protection Board.
How Practice Management Software Helps You Stay Compliant
Managing DPDP compliance with spreadsheets and WhatsApp groups is like tracking hearings across five courts in a paper diary. It works until it does not.
Provakil, built specifically for Indian legal practices, offers encrypted document storage, role-based access, audit trails for every document interaction, matter-level data organization that maps to purpose-limitation requirements, and automated retention reminders. For firms handling hundreds of matters across multiple courts and forums, manually tracking where client documents sit at scale isn't realistic.
Clients are becoming more aware of their data rights. A firm that demonstrates it takes data security seriously, stores matter data in encrypted systems, and can produce audit logs on request builds the trust that generates referrals. In a profession where growth depends entirely on reputation, that trust is a competitive advantage.
The Bottom Line
Digital privacy for lawyers is no longer a compliance checkbox you can defer. The DPDP Act makes data security a statutory obligation, the Supreme Court has reinforced the weight of privilege, and enforcement timelines are set. Firms that act now, audit their data, move to secure systems, and train their teams will be ready for enforcement rather than scrambling. Client trust has always been the foundation of legal practice. The only change is that the law now holds you to the standard your clients already expect.
Frequently Asked Questions
1. Does the DPDP Act apply to solo practitioners and small law firms?
Yes. Any person who determines the purpose and means of processing personal data is a Data Fiduciary. A solo advocate collecting client identity documents qualifies. Firm size does not create an exemption, and Section 8(1) security obligations apply regardless.
2. Are law firms exempt from DPDP when processing data for litigation?
Partially. Section 17(1)(a) exempts processing to enforce legal rights, but the obligation to maintain reasonable security safeguards under Section 8(1) and data accuracy under Section 8(5) persists even when exemptions apply.
3. When do DPDP penalties become enforceable for law firms?
The DPDP Rules 2025 set a phased timeline. Substantive Data Fiduciary obligations, including penalties up to INR 250 crore per breach category, are expected around May 2027. Firms should begin compliance preparation now.
4. How does the Supreme Court's 2025 privilege ruling affect digital data handling?
The ruling reinforced that privileged communications under Section 132 of the BSA 2023 are protected from compelled disclosure during investigations. But if privileged data leaks through a breach, privilege does not shield you from DPDP liability.
5. What is the difference between a Data Fiduciary and a Data Processor under DPDP?
A Data Fiduciary determines why and how personal data is processed. A Data Processor acts on the Fiduciary's instructions. The Fiduciary bears primary liability, but Rule 6 requires contractually binding Processors to meet equivalent security standards.
Dive deep into Provakil's numerous blog posts & discover how legal tech can streamline your litigation, contracts, IP, and notice management processes.
