Fairheld: client data stays private, even when your team uses AI

1

What goes into your pack

The pack pulls together your readiness check, the retention schedule and the AI-use register.

Readiness check
Not added yet. Take the check and press "Add to evidence pack" on the results screen.
Take the check
Retention schedule
9 document types. The periods set by law are checked against their sources.
Open the calendar
AI-use register
Off. It is left out of the pack.
Open the register

2

Your firm's details

These fill the blanks in the templates. Leave any of them empty and the pack shows a clear blank to fill in by hand. Kept in this page only.

Firm name

Who clients write to about privacy

Where clients should send documents

Person in charge if data leaks

Use made-up details in this demo.

3

Three templates that only claim what is true

A template that promises something your firm does not do is a risk in itself. A statement tied to a readiness question goes in only if you answered Yes to it. A few other statements about the firm are in to start with. Each is listed for you to read, and you untick any that is not true. You can also edit the wording.

The readiness check has not been added. Until it is, no statement tied to a readiness question is included. Tick the ones that are true for your firm.

Client privacy notice

A plain notice to give to clients. It says what you collect, why, and what they can ask for. Clients must be able to get it in English or in an Indian language listed in the Constitution, such as Marathi or Hindi. If the firm has a website, give the notice there too.

Statements to confirm. Read each one and untick any that is not true

For the work you ask us to do, we collect: your name and contact details; PAN; Aadhaar where the law requires it; bank details; papers about your income and investments; and [add any other kind your firm collects].The law asks for an item-by-item list. Add or remove items so it matches exactly what your firm collects for this work.
We use your information to prepare and file your returns, to carry out audit and other work you engage us for, to meet our own legal duties, and to contact you about that work.Check that these are the only things your firm uses client information for.
We do not sell your information or use it for advertising.Leave this in only if the firm never sells client information and never uses it for advertising.
We share your information only where the work requires it, for example with tax and regulatory authorities when we file on your behalf.It starts unticked, because the readiness check has not been added. Tick it only if the statement is true for your firm.
We reply to a complaint within [number, not more than 90] days.The law asks a firm to say how long it takes to answer a complaint, and allows no more than 90 days. Fill in the number your firm will keep to.
If you give us information about a child, or about an adult with a disability who has a lawful guardian, you confirm that you are the parent or lawful guardian and that you consent on their behalf.Leave this in if the firm handles returns or papers for children, or for adults who have a lawful guardian.
If a leak affects your information, we will tell you without delay and explain what we are doing about it.It starts unticked, because the readiness check has not been added. Tick it only if the statement is true for your firm.

The wording. Edit it as you like.

How [firm name] handles your personal information
[firm name] is a firm of chartered accountants. This notice tells you what personal information we collect from you, why we collect it, and what you can ask us to do with it.

What we collect
For the work you ask us to do, we collect: your name and contact details; PAN; Aadhaar where the law requires it; bank details; papers about your income and investments; and [add any other kind your firm collects].

Why we use it
We use your information to prepare and file your returns, to carry out audit and other work you engage us for, to meet our own legal duties, and to contact you about that work.
We do not sell your information or use it for advertising.

How long we keep it
Some laws require us to keep records for a number of years, even after our work for you is finished.

What you can ask us
From 13 May 2027, under the Digital Personal Data Protection Act, 2023, you can ask what personal information we hold about you and who we have shared it with, ask for it to be corrected, completed or brought up to date, ask for it to be erased where the law allows, withdraw a consent as easily as you gave it, have a complaint dealt with by us, and name someone to act for you if you die or cannot act. Records the law requires us to keep are kept for that period, and withdrawing consent may mean we cannot carry on the work.
To do any of these, or to raise a complaint, write to [name or email for privacy questions].
We reply to a complaint within [number, not more than 90] days.
If you give us information about a child, or about an adult with a disability who has a lawful guardian, you confirm that you are the parent or lawful guardian and that you consent on their behalf.

If something goes wrong
From 13 May 2027, if you are not satisfied with our reply to your complaint, you may complain to the Data Protection Board of India through the Board's website or app.

17 statements left out, and what to do before adding them

We ask only for what the work needs. If we do not need a document, we will not ask for it.
The readiness check has no answer for it. First step: Make a short list of documents needed for each common service and share it with staff.
Please send documents only to [the firm's email address or other agreed channel]. Please do not send them to a staff member's personal WhatsApp or personal email.
The readiness check has no answer for it. First step: Pick one channel for client documents, such as a firm email address, and tell clients to use only that.
Each member of our staff has their own login. We do not share passwords.
The readiness check has no answer for it. First step: Find the three most shared passwords in the firm and replace them with separate logins.
Our email and cloud storage need a second step to sign in.
The readiness check has no answer for it. First step: Switch on two-step login for partner email accounts today, then for staff.
Laptops and phones that hold client files are locked with a password and encrypted.
The readiness check has no answer for it. First step: Check that screen lock and encryption are on for every work laptop and phone.
We take backups on a schedule, and we have tested restoring from one.
The readiness check has no answer for it. First step: Restore one folder from your latest backup to check that it opens.
Our staff are given basic training on handling client information.
The readiness check has no answer for it. First step: Hold a 30-minute session on the firm's three most important data rules.
When someone leaves the firm, their access is removed the same day.
The readiness check has no answer for it. First step: Make a leaving checklist: email, software, cloud drive, tax portals and office keys.
We sometimes use AI tools to help with drafting. Before we do, we remove your name and identity numbers from the text.
The readiness check has no answer for it. First step: Show staff the safe-AI masking tool in this demo and make masking the rule.
We share your information only where the work requires it, for example with tax and regulatory authorities when we file on your behalf.
The readiness check has not been added, so it starts unticked. Untick this if client information also goes anywhere else, for example into an AI tool with names left in, or to a helper with no agreement. Then write what is true.
Any outside helper who sees client information works under a written agreement with us about it.
The readiness check has no answer for it. First step: List the outside people who can see client data and add a data clause to each arrangement.
We have a written rule that says how long each type of record is kept.
The readiness check has no answer for it. First step: Use the retention calendar in this demo as a starting list, then confirm each period.
When that period ends, we erase or destroy the record.
The readiness check has no answer for it. First step: Pick one old financial year that is past its keeping period and erase it as a trial run.
If you ask what information we hold about you, we aim to answer within a few days.
The readiness check has no answer for it. First step: Try it for one client: list everything you hold on them, and who you shared it with, and time how long it takes.
When you ask us to correct or erase your information, we do so where the law allows.
The readiness check has no answer for it. First step: Write down who handles such a request and how you check what must be kept.
We have a written plan for what to do if information leaks.
The readiness check has no answer for it. First step: Start from the data breach checklist in the evidence pack and put names against each step.
If a leak affects your information, we will tell you without delay and explain what we are doing about it.
The readiness check has not been added, so it starts unticked. Leave this in only if the firm is ready to do it. It is a promise to the client.

Privacy clause for engagement letters

A clause to add to your engagement letter, so both sides know how personal information is handled.

Statements tied to your readiness answers (0 of 6 included)

Please send documents only to [the firm's email address or other agreed channel].Not answered in the readiness check.
We may use AI tools to help with drafting. Before we do, we remove names and identity numbers from the text.Not answered in the readiness check.
Where we use an outside helper, that person works under a written agreement with us about your information.Not answered in the readiness check.
We have a written rule that says how long each type of record is kept.Not answered in the readiness check.
When the keeping period for a record ends, we erase or destroy it.Not answered in the readiness check.
We give clients a privacy notice that says what personal information we collect and why.Not answered in the readiness check.

Statements to confirm. Read each one and untick any that is not true

To carry out this engagement, [firm name] will collect and use personal information about you and, where the work needs it, about your family members, employees or customers. We will use it only for this engagement and to meet our legal duties.Check that the firm uses client information for nothing else.
If your information is affected by a data leak, we will tell you without delay.It starts unticked, because the readiness check has not been added. Tick it only if the statement is true for your firm.

The wording. Edit it as you like.

7 statements left out, and what to do before adding them

Please send documents only to [the firm's email address or other agreed channel].
The readiness check has no answer for it. First step: Pick one channel for client documents, such as a firm email address, and tell clients to use only that.
We may use AI tools to help with drafting. Before we do, we remove names and identity numbers from the text.
The readiness check has no answer for it. First step: Show staff the safe-AI masking tool in this demo and make masking the rule.
Where we use an outside helper, that person works under a written agreement with us about your information.
The readiness check has no answer for it. First step: List the outside people who can see client data and add a data clause to each arrangement.
We have a written rule that says how long each type of record is kept.
The readiness check has no answer for it. First step: Use the retention calendar in this demo as a starting list, then confirm each period.
When the keeping period for a record ends, we erase or destroy it.
The readiness check has no answer for it. First step: Pick one old financial year that is past its keeping period and erase it as a trial run.
If your information is affected by a data leak, we will tell you without delay.
The readiness check has not been added, so it starts unticked. Leave this in only if the firm is ready to do it. It is a promise to the client.
We give clients a privacy notice that says what personal information we collect and why.
The readiness check has no answer for it. First step: Start from the client privacy notice template in the evidence pack and adapt it to your firm.

Data breach checklist: the first 72 hours

What to do, in order, if client information leaks or a device is lost. The DPDP duty to report applies from 13 May 2027; following it earlier is good practice. The CERT-In 6-hour report applies now. Keep a printed copy where partners can find it.

The wording. Edit it as you like.

Who is in charge
Person in charge: ______________________. Backup person: ______________________.

In the first hour
[ ] Write down what happened, when it was noticed and who noticed it.
[ ] Tell the person in charge.
[ ] Stop it spreading: change the passwords involved, sign the lost device out of email and cloud storage, and disconnect any affected computer.
[ ] Do not delete anything. Keep the emails, records and the device as they are.
[ ] If a laptop or phone was lost or stolen, file a police complaint and keep a copy.

Without delay, as soon as you know what was affected
[ ] List who is affected, clients and anyone else whose information was in the files, such as clients' staff or family members, and what kinds of information.
[ ] If the information belongs to a client's staff or customers and the firm handles it for that client, tell the client at once, so they can meet their own duties, and agree with them who tells the affected people.
[ ] Tell the Data Protection Board of India that a breach has happened. Give what is known so far: what happened, when, where, how much information, and the likely effect. Do not wait for the full picture.
[ ] Tell each affected person in plain words: what happened and when, what it could mean for them, what the firm is doing about it, what they can do to protect themselves, and who to contact at the firm. Only where the firm holds the information purely on a client's instructions (for example running the client's payroll) is this the client's duty; then tell the client at once and record who tells the people.

Within 6 hours
[ ] Check whether the incident must be reported to CERT-In within 6 hours of noticing it. The CERT-In directions of 28 April 2022 list incidents such as data leaks and unauthorised access to systems. If it must, report it as CERT-In's website explains.

In the first 24 hours
[ ] Work out how it happened and whether it is still going on.
[ ] Find which software, cloud tools and backups hold the affected information.
[ ] Restore lost or damaged files from the latest backup that works.

Within 72 hours of knowing about the breach
[ ] Send the Board the full report: the facts, how and why it happened, what has been done to limit the harm, who caused it if known, what will stop it happening again, and that the affected people have been told.
[ ] If the full report cannot be ready in 72 hours, ask the Board in writing for more time before the 72 hours run out.
[ ] Record each decision taken, who took it and why.
[ ] If the firm has insurance that covers data leaks, tell the insurer as the policy requires.

In the week after
[ ] Fix the cause, so that it cannot happen the same way again.
[ ] Tell staff what happened and what changes.
[ ] Update this checklist with what you learned.

4

Download the pack

One PDF for your firm. It is made on this device. Nothing is uploaded.

Cover
Readiness summary (not yet done)
Retention schedule
Client privacy notice
Privacy clause for engagement letters
Data breach checklist: the first 72 hours
Next steps

Evidence pack

What goes into your pack

Your firm's details

Three templates that only claim what is true

Client privacy notice

Privacy clause for engagement letters

Data breach checklist: the first 72 hours

Download the pack