Accounting software and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 9 min read
Your accounting software holds the names, addresses, PAN, GSTIN and bank details of every customer and vendor, and often your staff’s salaries too. Under India’s DPDP Act, your business is the Data Fiduciary for all of it. Zoho Books stores Indian accounts in India; desktop Tally keeps your books on your own computer, so their security is entirely yours. Tax and company laws require you to keep books for set periods, and the Act allows that, but anything the law doesn’t require still has to go.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
Every invoice you raise, every vendor you pay and every salary you process goes into your accounting software. Customer masters carry phone numbers and addresses, vendor ledgers carry PAN and bank account numbers, and scanned bills sit attached to entries. Accounts feel like a matter for your CA and the tax department, not a privacy question. With the DPDP Act’s full obligations applying from 13 May 2027, it helps to see your books as what they also are: a register of personal data about everyone you do business with.
Is any accounting software “DPDP-compliant”?
No software makes you compliant: the DPDP Act puts the duties on your business, and with desktop software there’s no vendor holding the data at all
You decide why customer, vendor and staff details are recorded and how they’re used, which makes you the Data Fiduciary. When your books run in the cloud, as with Zoho Books or TallyPrime’s cloud access, the vendor stores them on your instructions and is your Data Processor, and the Act requires a valid contract with it (Section 8).
Desktop Tally works differently. Your books sit on your own computer or server, so no outside company is storing them for you. That gives you full control, and it also means every safeguard, from the office computer’s password to the backup on a pen drive, is your responsibility alone.
What personal data flows through your accounting software?
More than most businesses realise, because accounts record people as well as money
Whichever software you use, it typically holds:
- Customer and vendor masters: names, addresses, phone numbers, email addresses, GSTIN and PAN. For sole proprietors and freelancers, these are personal details, not just business ones.
- Bank details: account numbers and IFSC codes for vendors you pay and customers who pay you.
- Invoices and receipts: who bought what, when and for how much.
- Payroll: salaries, PAN, bank accounts and statutory numbers for your staff, if you run payroll in the same software.
- Attachments: scanned bills, signed agreements and ID copies attached to entries.
- Exports and backups: Excel exports sent to your CA, backup files on drives and laptops, and every copy of the company data made for audit.
What DPDP duties does your accounting software create?
The duties are the standard ones, with one difference: the law often requires you to keep accounting records
- Notice when you collect. When you ask a customer or vendor for their PAN, GSTIN or bank details, say what you’re collecting and why (Section 5). A line on your vendor onboarding form or customer account form does the job.
- Purpose limits. A phone number recorded for billing was given for billing. Using your customer ledger as a marketing list needs its own consent.
- Keep what the law requires, and only that. Tax, GST and company laws require you to keep books of account for set periods, and the DPDP Act lets you keep data that another law requires (Section 8). It doesn’t cover everything else: ID copies attached for convenience, old exports, and details of people you never billed should be deleted once their purpose is over.
- Security. Who can open the company data, who holds the admin password, where backups are kept, and whether exports are emailed around are all part of your duty to protect the data.
- Rights requests. A customer or vendor can ask what you hold about them, ask you to correct it, or ask you to delete it. You can correct details freely. For deletion, explain what the law requires you to keep, and delete the rest.
- Breaches. A stolen office laptop, a lost backup drive or a ledger emailed to the wrong person can each be a personal data breach. You must inform the Data Protection Board of India and the affected people.
- Your staff’s data. The Act lets you process employee data for employment purposes without separate consent (Section 7(i)). Payroll records still need the same security and retention discipline.
Where does each one keep your data?
Zoho Books and TallyPrime’s cloud access keep your data in India; desktop Tally keeps your books wherever you install it
The DPDP Act doesn’t require Indian data to stay in India: it allows transfers abroad except to countries the government restricts (Section 16), though some sector regulators set their own rules. You should still know where your books are, because it decides who else could get to them.
| Software | Where your data sits | How it’s set |
|---|---|---|
| TallyPrime (desktop) | On the computer or server where TallyPrime is installed | By where you install it |
| TallyPrime cloud access | India (Oracle Cloud’s Mumbai and Hyderabad regions) | Hosted by Tally |
| Zoho Books | India (Mumbai, with Chennai as backup) | By your location at sign-up |
TallyPrime
TallyPrime keeps your company data on your own computer by default, so its protection is in your hands
Tally’s own guide says that by default data is stored on the hard drive of the device running TallyPrime, with backups to external storage. With TallyPrime cloud access, your company data is hosted online so authorised users can log in from anywhere, with daily automated backups. Tally says cloud access runs on Oracle Cloud Infrastructure in its Mumbai and Hyderabad regions, so the data stays in India.
For protecting the data itself, TallyVault encrypts your company data, including the company name and transaction details, behind a password. Tally warns that forgetting the TallyVault password means permanently losing access to the data, so store it safely. You can create users with one of five roles, each with its own permissions and password, apply a password policy, and mark users inactive when they leave. The Edit Log tracks the creation, alteration and deletion of vouchers, ledgers, stock items and groups. In the TallyPrime Edit Log edition it can’t be turned off, and Tally says that edition meets the audit trail requirement set by the Ministry of Corporate Affairs (MCA).
Zoho Books
Zoho stores Indian accounts in India, and Zoho Books can encrypt and restrict the fields you mark as personal data
Zoho assigns each account to a data centre based on your location at sign-up. India’s are in Mumbai (primary) and Chennai (secondary), and an India-region account logs in at a zoho.in address.
In Zoho Books you can mark custom fields as personally identifiable information (PII). Fields marked as sensitive are encrypted when stored, and only roles given access to protected data can see them, which by default means only the admin. Users without that permission can’t export sensitive data either. You can create custom roles that limit which modules a person uses, and restrict which customers each user can see. Zoho Books also keeps an audit trail of every change to a record, showing who made it, what changed, where and when. A contact can be deleted only once no transactions are linked to it.
How to set up any accounting software for the DPDP Act
The steps are the same whichever software you use; only the setting names change
- Know where your books areFor desktop software, list every computer, server and backup drive that holds company data. For cloud software, confirm the region in your account.
- Lock the dataUse encryption where your software offers it, such as TallyVault, and keep the password somewhere safe outside the software.
- Give each person their own loginUse roles so staff see only what their work needs, keep admin access to one or two people, and deactivate users who leave.
- Mark and protect personal fieldsWhere your software lets you mark fields as personal or sensitive, do it for PAN, bank details and similar fields. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your accounting software’s privacy settings, release notes and announcements to see what has changed.
- Control exports and backupsLimit who can export ledgers, stop emailing full exports, and keep backup drives encrypted and locked away.
- Write down what you keep and whyFor each kind of record, note the law that requires it and for how long, and delete what no law requires once its purpose is over.
- Keep fewer documents attachedIf staff attach ID copies or bank statements to entries, ask whether the books need them at all.
FAQ
Is Tally or Zoho Books DPDP-compliant?
Neither is “compliant” or “non-compliant” on its own. The DPDP Act’s duties fall on your business as the Data Fiduciary. What the software changes is how much help it gives you, through encryption, roles and audit trails, and where your data is kept.
Can a customer ask me to delete their invoices?
They can ask, but you can keep what tax, GST or company law requires you to hold. The DPDP Act allows retention that another law requires. Tell the customer what you’re keeping and under which law, and delete anything the law doesn’t require.
Does the DPDP Act apply if Tally runs only on my office computer?
Yes. The Act applies to personal data you hold in digital form, whether it sits on your own computer or in the cloud. Keeping it on your own computer means no vendor is involved, but every duty, including security and breach reporting, stays with you.
Does an audit trail conflict with the right to erasure?
No. The audit trail is a legal record-keeping requirement, and the DPDP Act allows data to be kept where another law requires it. Erasure applies to what no law requires you to keep.
Do I need a contract with my accounting software vendor?
If your books are hosted in the cloud, yes. The Act requires a valid contract with any Data Processor that handles personal data for you. Check that your agreement covers processing on your behalf, and keep a copy with your compliance records.
Will my accounting software add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your accounting software’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
