At a glance“Just email me your PAN and Aadhaar” is how most professional document collection starts, and it skips everything the DPDP Act expects at collection: a stated purpose, a named document list, a secure channel and a retention answer. This is a free email template that asks properly: which documents, why each one, how to send them safely, how long you’ll hold them, and whom to ask. It costs one extra paragraph and reads as professionalism, not bureaucracy.
Educational resource only. This provides a template for requesting documents from clients in line with India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
The situation
Every professional practice (CA, lawyer, consultant, broker, HR) begins engagements the same way: asking the client to send documents. The habitual ask (“share your documents whenever convenient”) produces the habitual result: sensitive files arriving as plain attachments and chat forwards, over-collection nobody scoped, and copies nobody scheduled for deletion. The request email is where all of that is decided, which makes it the cheapest compliance surface you own.
What this template is (and why the ask matters)
The request email is your point of collection: the place the DPDP Act expects purpose, minimisation and a secure route to show up. Whoever collects client documents is a Data Fiduciary: collection needs a stated purpose the client has been told (Section 5’s notice duty), should be limited to what that purpose needs, and the copies you hold must be secured and erased when the purpose ends. An email that names each document with its reason, offers a proper channel, and states retention does that work at the moment it matters, and signals to the client that their documents are being handled by someone who takes them seriously. Use it for client onboarding, KYC, engagement kickoffs, or any recurring document ask.
The template: copy and fill in
Copy everything below, fill the brackets, and delete document rows you don’t need.
Subject: Documents needed for [purpose], from [Your Business/Practice Name]
Dear [client name],
To proceed with [the engagement / service], we need the following documents:
| Document | Why we need it |
|---|---|
| [Document 1] | [purpose] |
| [Document 2] | [purpose] |
| [Document 3] | [purpose] |
How to send them: please use [the secure channel] rather than email attachments or WhatsApp. If you must email a document, password-protect the file and share the password separately (a call or text works).
A few notes:
- Where a masked version serves (e.g. masked Aadhaar), please send that rather than the full document.
- We only need the documents listed.
- We will hold these documents securely, use them only for [purpose], and [delete them / return and delete them] once [completion point].
If you have any questions about how your documents are handled, contact [name / role] at [contact].
Regards, [Your name] [Practice name / contact]
How to fill it in
The document table is the minimisation tool: if a row’s “why” is hard to write, the row shouldn’t exist.
[purpose]
- What it means: The reason you need these documents, in plain language. It appears three times: the overall reason in the subject line and the retention note, and a document-specific reason in each table row.
- Examples: Overall: “your ITR filing”; “your home loan application.” Per document: “to compute salary income” (Form 16); “to claim HRA exemption” (rent agreement).
[Your Business/Practice Name]
- What it means: Your firm or practice’s name, as the client would recognise it.
- Examples: “Sharma & Associates”; “Acme Consulting.”
[client name]
- What it means: The client’s name, so the request reads as addressed to them rather than a form letter.
- Examples: Their name as it appears on your engagement records.
[the engagement / service]
- What it means: The specific piece of work this request is for.
- Examples: “Your ITR filing for FY 2025-26”; “your home loan application”; “your onboarding as a new client.”
[Document 1], [Document 2], [Document 3]
- What it means: One row per document you actually need; delete rows you don’t use, and add more the same way if you need a fourth or fifth.
- Examples: “Form 16”; “Rent agreement”; “Bank statement (last 3 months).”
[the secure channel]
- What it means: Your one controlled intake route: a client portal, a secure upload link, or at minimum protected-file-by-email with the password kept separate. Naming it in the ask is what stops the WhatsApp default.
- Examples: “Our client portal at [link]”; “the secure upload form on our website.”
[delete them / return and delete them]
- What it means: Whichever matches what you actually do once the purpose ends: delete your copies, or return the originals and delete any copies you made.
- Examples: “delete them” for scanned copies you don’t need to return; “return and delete them” for physical documents you’re handing back.
[completion point] - retention
- What it means: When the client’s documents stop living with you: engagement end, or the statutory period your profession’s rules require, named honestly.
- Examples: “Once your return is filed and the retention period under tax law ends”; “on completion of the transaction.”
[name / role], [contact]
- What it means: A real person or role for data questions, and how to reach them: the same contact your grievance process names.
- Examples: “Priya Sharma, Data Protection Officer” and “[email protected].”
[Your name]
- What it means: Your name, as the sender signing off the request.
- Examples: The name you sign client correspondence with.
[Practice name / contact]
- What it means: Your firm’s name and a way to reach it, repeated in the signature block.
- Examples: “Sharma & Associates, +91-XXXXXXXXXX.”
What this template doesn’t cover
The email asks properly: it doesn’t replace your notice-and-consent capture or your handling behind the scenes. Where your engagement’s data collection needs formal notice and consent (it usually does), pair this with your point-of-collection notice and consent form: the email’s purpose table summarises, it doesn’t substitute. It also can’t secure the channel for you: if the “secure channel” bracket has nothing true to say, that’s the gap to fix first. And sector rules (KYC mandates, professional record requirements) govern what you must collect and keep regardless of what the email promises; align the retention line with them before sending.
FAQ
Isn’t asking by email exactly what breaks DPDP?
The ask can travel by email, though the documents shouldn’t have to. The template’s job is to route the sensitive material to a proper channel and put purpose, minimisation and retention on the record at the point of collection.
Do I really need to justify every document?
Writing one plain reason per document is minimisation in practice: it keeps your ask to what the purpose needs, and it’s the line you’d want to point at if a client (or the Data Protection Board of India) ever asked why you held something.
What if the client just WhatsApps everything anyway?
Move the files into your controlled store, delete them from the chat, and gently restate the channel; clients follow the path you make easiest. The template exists to make the secure path the stated, obvious one.
Can I reuse this for recurring asks like monthly payroll inputs?
Yes. Fix the table for the recurring set, keep the purpose and retention lines current, and the same structure serves every cycle. Recurring asks benefit most from a portal, since the channel decision is made once.