Cookie settings

Choose what FinRace may use. You can change this at any time from “Cookie settings” at the bottom of the page.

Strictly necessary

Always on

Keep you signed in, protect your account and forms, and remember the settings you choose here, such as theme and language. The site cannot work without these.

Count visits and see which pages are used, so we can improve them. First-party and cookieless: a hash of your IP address and browser that changes every day, and an approximate city from a database on our own server. Nothing is shared with anyone else. Off unless you allow it.

Advertising and marketing

Not used. FinRace has no advertising or third-party tracking cookies.

DPDP Act 2023 for professional-services firms: a practical checklist

Updated 3 September 2026

The Digital Personal Data Protection Act 2023 applies to any firm that processes digital personal data — which includes almost every CA, CS, legal and advisory practice. As a Data Fiduciary deciding the purpose and means of processing client and employee personal data, a firm carries the following core obligations.

Checklist

  • Notice. Give data principals a clear notice — what personal data is collected, the purpose, how to withdraw consent and how to complain to the Data Protection Board.
  • Lawful basis. Process on consent or a recognised legitimate use. Consent must be free, specific, informed and revocable, and requests should be no broader than the purpose.
  • Purpose limitation. Use the data only for the purpose it was collected for; delete it when the purpose is served and retention is no longer required or legally mandated.
  • Accuracy. Keep data used for decisions or disclosures complete and accurate.
  • Security safeguards. Implement reasonable technical and organisational measures to prevent a personal-data breach.
  • Breach response. Notify the Board and affected principals of a personal-data breach as prescribed.
  • Processor contracts. Engage data processors (including software vendors) only under a valid contract.
  • Principal rights. Be able to service access, correction, erasure and grievance-redressal requests, and appoint a contact for them.
  • Children’s data. Obtain verifiable parental consent where a principal is a minor.

Where AI tooling fits

Sending client personal data to a third-party AI service makes that provider a processor in your chain, to be covered by contract and reflected in your notice. Keeping processing on infrastructure you control shortens that chain and simplifies the security-safeguards and processor-contract items.

How FinRace AI helps

FinRace AI is built to keep client data on self-hosted infrastructure rather than routing it to a third-party model API — see how data is handled. This guide is a general checklist, not legal advice on your firm’s DPDP compliance; confirm your position with counsel.

This guide is general information, not professional advice. FinRace AI is a sovereign, self-hosted tool for Indian financial and legal professionals — deterministic tax / GST / TDS computation, citation-validated statutory-provision research and document drafting, run entirely on infrastructure you control. See what it does.

Related guides