For years the trade-off felt acceptable: to process a client's bank statement quickly, you uploaded it to a website that converted it for you. Convenient, but it meant a copy of your client's most sensitive financial data now lived on someone else's server.
India's Digital Personal Data Protection (DPDP) Act has changed the calculus. As an accountant you are handling personal financial data on behalf of clients, and the law now attaches real obligations - and real penalties - to how you store and share it. This article explains, in plain terms, why keeping that data on your own machine is the cleanest way to reduce your risk.
What the DPDP Act actually asks of you
The DPDP Act governs the processing of digital personal data. When you convert a client's bank statement, you are processing personal data - names, account numbers, transaction histories - and you become responsible for protecting it.
The practical implications for a CA firm are straightforward:
- You should collect and retain only the data you actually need.
- You are responsible for data shared with third parties (including conversion websites and cloud tools).
- You must be able to explain where client data lives and who can access it.
- A breach involving client data can carry significant financial penalties.
Important
Uploading a client statement to a free online "PDF to Excel" or "bank statement converter" site means you have shared personal data with a third party you do not control. That is exactly the kind of exposure the Act is concerned with.
The hidden cost of cloud conversion tools
Online converters are seductive because they are free and instant. But "free" usually means the service monetises in ways you cannot see, and "instant" means your client's data has already left your control before you have read the fine print.
Even reputable cloud tools create a chain of custody you now have to account for: their servers, their sub-processors, their retention policy, their breach history. Every link is a question a client - or a regulator - could ask you to answer.
Why on-device processing is the simplest answer
The most defensible position is the simplest one: the data never leaves your premises. When processing happens entirely on your own PC, there is no upload, no third-party server, and no chain of custody to document.
This is the model Greenote is built on. Your client's statement is read, classified, and posted to your local Tally on the same machine. The only outbound connection is to your own Tally instance on your own network.
Pro tip
When a client asks "is my data safe with you?", an honest "it never leaves my computer" is a far stronger answer than "the vendor we use is compliant."
Offline does not mean slower
A common misconception is that on-device software must be clunky or slow. The opposite is true: local processing has no upload time, no queue, and no network latency. Reading a 300-line statement and generating vouchers happens in seconds, on your machine, even with no internet connection.
For the actual conversion workflow, see our step-by-step guide to converting a bank statement to Tally.
A simple data-handling checklist for your firm
You do not need a compliance department to be responsible. A short internal policy goes a long way:
- Stop uploading client statements to free online converters - full stop.
- Prefer tools that process data on-device over cloud tools.
- Keep client files in access-controlled folders, not shared inboxes.
- Delete working copies once the books are posted and verified.
- Be able to state, in one sentence, where each client's data lives.
Conclusion
The DPDP Act did not create the risk of mishandling client data - it just put a price on it. The good news is that the safest approach is also the simplest: keep the data on your machine.
Greenote processes bank statements to Tally fully offline, so privacy is the default, not an add-on. Try it free and give your clients an answer they will trust.
Read next: is it safe to upload client bank statements to online converters, and the five questions worth asking any vendor before you do.
Turn bank statements into Tally vouchers offline
Greenote reads 100+ Indian banks and posts clean vouchers straight into Tally, fully on your PC. No uploads, no cloud, no manual entry.
7-day free trial, no card required. Works with Tally Prime & ERP 9.
