At a glance
“Just email me your PAN and Aadhaar” is how most professional document collection starts — and it skips everything the DPDP Act expects at collection: a stated purpose, a named document list, a secure channel and a retention answer. This is a free email template that asks properly: which documents, why each one, how to send them safely, how long you’ll hold them, and whom to ask. It costs one extra paragraph and reads as professionalism, not bureaucracy.
Educational resource only. This provides a template for requesting documents from clients in line with India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
The situation
Every professional practice — CA, lawyer, consultant, broker, HR — begins engagements the same way: asking the client to send documents. The habitual ask (“share your documents whenever convenient”) produces the habitual result: sensitive files arriving as plain attachments and chat forwards, over-collection nobody scoped, and copies nobody scheduled for deletion. The request email is where all of that is decided — which makes it the cheapest compliance surface you own.
What this template is (and why the ask matters)
The request email is your point of collection — the place the DPDP Act expects purpose, minimisation and a secure route to show up. Whoever collects client documents is a Data Fiduciary: collection needs a stated purpose the client has been told (Section 5’s notice duty), should be limited to what that purpose needs, and the copies you hold must be secured and erased when the purpose ends. An email that names each document with its reason, offers a proper channel, and states retention does that work at the moment it matters — and signals to the client that their documents are being handled by someone who takes them seriously. Use it for client onboarding, KYC, engagement kickoffs, or any recurring document ask.
The template — copy and fill in
Copy everything below, fill the brackets, and delete document rows you don’t need.
Subject: Documents needed for [purpose] — [Your Business/Practice Name]
Dear [client name],
To proceed with [the engagement / service — e.g. “your ITR filing for FY 2025–26”], we need the following documents:
| Document | Why we need it |
|---|---|
| [Document 1 — e.g. Form 16] | [purpose — e.g. “to compute your salary income”] |
| [Document 2 — e.g. Bank statement, Apr–Jun] | [purpose — e.g. “to verify interest income”] |
| [Document 3] | [purpose] |
How to send them: please use [the secure channel — e.g. “our client portal at [link]”] rather than email attachments or WhatsApp. If you must email a document, password-protect the file and share the password separately (a call or text works).
A few notes:
- Where a masked version serves (e.g. masked Aadhaar), please send that rather than the full document.
- We only need the documents listed — please don’t send extras.
- We will hold these documents securely, use them only for [purpose], and [delete them / return and delete them] once [completion point — e.g. “the filing is complete and the statutory retention period ends”].
If you have any questions about how your documents are handled, contact [name / role] at [contact].
Regards, [Your name] [Practice name / contact]
How to fill it in
The document table is the minimisation tool — if a row’s “why” is hard to write, the row shouldn’t exist.
- [Document / purpose rows]
- What it means: One row per document, each with its plain reason. Writing the reason is the discipline: it catches the “send everything, we’ll see what we need” habit before the client’s inbox does.
- Examples: “Form 16 — to compute salary income”; “Rent agreement — to claim HRA exemption.”
- [the secure channel]
- What it means: Your one controlled intake route — a client portal, a secure upload link, or at minimum protected-file-by-email with the password separate. Naming it in the ask is what stops the WhatsApp default.
- [completion point] — retention
- What it means: When the client’s documents stop living with you — engagement end, or the statutory period your profession’s rules require, named honestly.
- Examples: “Once your return is filed and the retention period under tax law ends”; “on completion of the transaction.”
- [name / role] — the contact
- What it means: A real person or role for data questions — the same contact your grievance process names.
What this template doesn’t cover
The email asks properly — it doesn’t replace your notice-and-consent capture or your handling behind the scenes. Where your engagement’s data collection needs formal notice and consent (it usually does), pair this with your point-of-collection notice and consent form — the email’s purpose table summarises, it doesn’t substitute. It also can’t secure the channel for you: if the “secure channel” bracket has nothing true to say, that’s the gap to fix first. And sector rules (KYC mandates, professional record requirements) govern what you must collect and keep regardless of what the email promises — align the retention line with them before sending.
FAQ
Isn’t asking by email exactly what breaks DPDP?
The ask can travel by email — the documents shouldn’t have to. The template’s job is to route the sensitive material to a proper channel and put purpose, minimisation and retention on the record at the point of collection.
Do I really need to justify every document?
Writing one plain reason per document is minimisation in practice — it keeps your ask to what the purpose needs, and it’s the line you’d want to point at if a client (or the Data Protection Board of India) ever asked why you held something.
What if the client just WhatsApps everything anyway?
Move the files into your controlled store, delete them from the chat, and gently restate the channel — clients follow the path you make easiest. The template exists to make the secure path the stated, obvious one.
Can I reuse this for recurring asks like monthly payroll inputs?
Yes — fix the table for the recurring set, keep the purpose and retention lines current, and the same structure serves every cycle. Recurring asks benefit most from a portal, since the channel decision is made once.