Before You Upload Client GST and TDS PDFs to an AI Tool: A DPDP Checklist for CA Firms
By GST Reco Pro
GST Reco Pro builds browser-based tools for GST and TDS reconciliation, used by Chartered Accountants and corporate tax teams across India.
The DPDP Rules were notified in November 2025, and their main obligations apply from May 2027. CA firms hold some of the most sensitive data in the economy, and more of it is flowing into converters and AI tools every month. Here is a practical checklist for deciding where client PDFs are allowed to go.
A GST return carries a GSTIN, which embeds a PAN. A TDS challan carries a TAN, payment amounts and bank details. For a proprietorship, much of that is personal data about a named individual. CA firms collect this for hundreds or thousands of clients, and increasingly they pass it into online PDF converters, cloud spreadsheets and AI chat tools to save time.
The Digital Personal Data Protection Rules, notified on 13 November 2025, give that habit a deadline. The rules commence in phases: the Data Protection Board provisions immediately, consent-manager provisions after one year, around November 2026, and the substantive obligations on data fiduciaries after eighteen months, on 13 May 2027.
Why a CA firm is in scope
A data fiduciary is any person that decides why and how personal data is processed. A firm that collects client records to prepare returns, and decides which tools to process them in, fits that description for the personal data it holds. Confirm the analysis for your own practice with your advisors, but most firms should plan on the basis that the obligations apply to them. Those obligations include reasonable security safeguards, breach notification to the Data Protection Board and affected individuals, and responsibility for what the firm's processors do with the data.
A checklist for every tool that touches client documents
- Where is the file processed? On your machine, or uploaded to someone else's servers? Uploads make the provider a processor of your clients' data.
- Is it retained? Many online converters and AI tools keep uploaded files or extracted text for some period, and some use them to improve their services. Read the terms, not the marketing page.
- Who else can access it? Staff at the provider, sub-processors, and whoever operates the cloud the provider runs on.
- Is there a contract? A processor handling personal data on your behalf should be under a written agreement that covers security, deletion and breach notice.
- Is the data minimised? A tool that needs the whole return to extract one table is collecting more than it needs.
- What happens on a breach? You are expected to notify promptly. If the provider would not tell you, you cannot meet that obligation.
- Which staff are using what? Shadow use of free tools by juniors is the commonest gap. Write a short approved-tools list and train on it.
Where AI tools fit
AI assistants are genuinely useful for explaining a notice, drafting a reply or summarising a circular. These tasks rarely need the client's actual data, and when they do, the data can usually be anonymised first. The risk is in the reflex of pasting or uploading a full return, challan or ledger into a general-purpose tool to get a quick extraction or summary. That is the habit to replace with a tool that does the job without sending the document anywhere.
Processing in the browser
One architecture removes most of the checklist at once: processing that happens entirely on the user's own device. If the PDF is parsed and the spreadsheet generated inside the browser, the document never reaches a third-party server. There is nothing for the provider to retain, expose or lose. This is how GST Reco Pro is built. The GSTR and TDS converters run in a Web Worker in your browser; the files are never uploaded.
Browser-local processing is not a compliance programme by itself. A firm still needs its own policies, access controls and breach procedures. But it takes the highest-volume, highest-sensitivity flow — client returns and challans going into a converter — out of the third-party question entirely.
Convert GSTR-1, GSTR-3B and TDS challan PDFs to Excel without uploading them anywhere. Processing happens entirely in your browser.
See the browser-based tools →Read how GST Reco Pro keeps client documents on your device.
Read the security overview →Frequently Asked Questions
When do the DPDP Rules apply to CA firms?
The DPDP Rules were notified on 13 November 2025 and commence in phases. The substantive obligations on data fiduciaries, such as security safeguards and breach notification, apply from 13 May 2027. Firms should use the time before then to map where client data goes and close gaps.
Is it safe to upload client GST returns to an online PDF converter?
It depends on the provider's processing, retention and security terms. Uploading makes the provider a processor of your clients' data, and under the DPDP regime you remain responsible for it. Tools that process the file locally in the browser avoid the transfer altogether.
Does GST Reco Pro upload my PDFs?
No. GST Reco Pro parses GSTR and TDS challan PDFs and generates the Excel file entirely inside your browser using a Web Worker. The documents are never sent to a server.
Can CA firms use AI tools under the DPDP Rules?
Yes, with care. Tasks like explaining a notice or drafting a reply rarely need the client's actual data, and data can usually be anonymised first. The risk lies in uploading full returns, challans or ledgers into general-purpose tools without knowing how the provider stores and uses them.