Legal & Regulatory Compliance

India

• Information Technology Act, 2000 and the reasonable security practices rules. We maintain a documented information security programme with managerial, technical, operational and physical controls proportionate to the information we protect.
• Digital Personal Data Protection Act, 2023. We process personal data lawfully, for specified purposes, with reasonable security safeguards, and we support data principals' rights and our clients' obligations as data fiduciaries.
• CERT-In directions. Specified cyber-security incidents are reported to CERT-In within the prescribed time, and relevant logs are maintained.
• Tax, corporate and professional law. We follow the record-keeping and confidentiality obligations that apply to our accounting, tax and compliance work under Indian tax, GST, customs and company law.

United States

• IRS Publication 4557. Our controls follow its practical safeguards: MFA, strong passwords, secure transmission, device protection, and an incident-response plan.
• IRC Section 7216. Before tax return information is disclosed to us, the client obtains taxpayer consent in the form required by the regulations; our onboarding checklist records this.
• FTC Safeguards Rule (GLBA). We support our US clients' duty to oversee service providers through contractual terms, security answers and evidence on request.
• CCPA / CPRA. Service-provider terms available on request.

United Kingdom and European Union

• UK GDPR, Data Protection Act 2018 and EU GDPR. Article 28 processor terms, Standard Contractual Clauses and the UK Addendum for transfers to India.
• Making Tax Digital. VAT and income tax workflows use MTD-compatible software chosen by the client.

United Arab Emirates and Saudi Arabia

• UAE Federal Decree-Law on Personal Data Protection and Saudi Personal Data Protection Law. Processor terms by contract.
• FTA and ZATCA requirements. Accounting records and workpapers maintained to support VAT, Corporate Tax, Zakat and e-invoicing compliance.

Australia and Canada

• Privacy Act 1988 and the Australian Privacy Principles, including APP 8 on cross-border disclosure, supported by contract.
• Tax Agent Services Act framework. Lodgements are made by the client's registered tax or BAS agent; we provide preparation support.
• PIPEDA accountability for cross-border processing, supported by contract.

Recognised good-practice frameworks

Our controls are informed by the principles of ISO/IEC 27001 (information security management) and the AICPA Trust Services Criteria for security, confidentiality and privacy. We state clearly which formal certifications we hold; those are published, with documents, on our Registrations and Certifications page.

Professional standards

Our work is prepared and reviewed under documented checklists, with independent review before delivery, and our team is bound by professional confidentiality obligations in addition to contractual NDAs.