Tech Tips
[Not yet joined the group? Join now]
Data Security & Privacy Classics for CAs – Essential Checks & Habits
| Shortcut / Action | What it does | Classic |
|---|---|---|
| Check devices signed in to Google | Google Account → Security → Your devices → Manage all devices | #01 |
| Review access when employee leaves | Revoke email, portals, recovery details & connected apps | #01 |
| Don’t trust WhatsApp links | Open official site yourself or call the sender on a known number | #02 |
| Verify before uploading documents | Check the domain; never rely on forwarded links | #02 |
| Never share OTPs / card details on WhatsApp | Verify any such request with a direct phone call | #03 |
| Inspect Document before sending | File → Info → Check for Issues → Inspect Document | #03 |
| Sync ≠ Backup | Sync is convenience; backup is an independent recovery path | #04 |
| Test your backups | Periodically restore an older file and confirm access works | #04 |
DATA SECURITY & PRIVACY CLASSICS #01
Two access checks every office should make.
1. Check devices signed in to your Google account
Go to:
Google Account → Security → Your devices → Manage all devices
Look for old office computers, forgotten logins, shared systems or devices you don't recognise.
Found something unfamiliar? Sign it out immediately and change your password.
2. When an employee leaves, review digital access
Don't just collect the laptop.
Check:
• Email and Google/Microsoft sessions
• GST / Income Tax portal access
• Recovery email & mobile
• Connected apps such as Drive or Dropbox
Revoke access that is no longer required.
An employee leaving the firm should also mean their digital access leaves.
Security check: Who can still get in?
DATA SECURITY & PRIVACY CLASSICS #02
Two rules for suspicious links.
1. Don't trust a WhatsApp link because the message looks genuine.
• “Document shared.”
• “IT notice received.”
• “GST alert.”
• “File pending.”
Be cautious of unexpected View / Download / Track links or urgent requests.
Don't verify by replying to the message.
Open the official website yourself or contact the sender through a known number.
2. Be careful before uploading PAN, Aadhaar, DSC or other documents.
Don't trust a page just because it looks like a government portal.
• Check the domain.
• Avoid forwarded links.
• Open the official website yourself and navigate to the service.
A convincing-looking upload page can be fake.
Verify the destination before you click or upload.
DATA SECURITY & PRIVACY CLASSICS #03
Think before you share sensitive information.
1. Never share OTPs or card details on WhatsApp.
Even if the request appears to come from someone you know, their account could be compromised or accessed from another device.
If someone asks for sensitive information: Verify through a direct phone call.
Known contact ≠ verified request.
2. Check a document before sending it externally.
What you see on screen may not be everything inside the file.
For Word/Excel: File → Info → Check for Issues → Inspect Document
Look for:
• Comments
• Tracked changes
• Hidden information
• Reviewer names
Remove anything that shouldn't leave the firm.
PDFs can contain metadata too.
Check the file — not just what is visible.
DATA SECURITY & PRIVACY CLASSICS #04
Cloud storage doesn't automatically mean backup.
1. Sync ≠ Backup
If a file is synced and you delete it, the deletion may also sync everywhere.
A proper backup should provide an independent recovery path — such as a versioned or offline backup.
Sync = convenience.
Backup = recovery.
Don't confuse the two.
2. Test your backups.
Don't stop at “Backup completed successfully.”
Periodically check:
• Can an older file actually be restored?
• Are important folders included?
• Can you access the backup if the main computer fails?
A backup that has never been tested is an assumption, not proof of recovery.
Backup → Test → Restore.
