Document retention periods in India: what the law actually says

Why is there no single answer?

Each statute sets its own minimum, and each starts its clock from a different event: the end of a financial year, the date a return was filed, the due date of an annual return, the redemption of a security, or the date a contract was broken. A policy that says "keep everything for eight years" will be too short for some records, needlessly long for others, and in conflict with the Digital Personal Data Protection Act for anything holding personal data.

The useful unit is therefore not a folder but a record class: a type of document, the law that governs it, the period, and the event that starts the count. The list below is the starting set most Indian companies need.

Company law: books, registers, returns and minutes

Under the Companies Act, 2013 and the rules made under it:

• Books of account and vouchers: not less than eight financial years immediately preceding a financial year, under section 128(5). A company in existence for less than eight years keeps all preceding years, and the Central Government may direct a longer period where an investigation has been ordered.
• Register of members and its index: preserved permanently, under rule 15 of the Companies (Management and Administration) Rules, 2014. A foreign register of members is also preserved permanently.
• Registers of debenture holders and other security holders: eight years from the date of redemption of the debentures or securities, under the same rule.
• Copies of annual returns filed under section 92, with their attachments: eight years from the date of filing with the Registrar, under the same rule.
• Minutes of board and committee meetings: preserved permanently under Secretarial Standard SS-1, which section 118(10) of the Act makes mandatory to observe. Minutes may be kept physically or electronically.

GST: 72 months from the annual return due date

Section 36 of the Central Goods and Services Tax Act, 2017 requires a registered person to keep the accounts and records required under the Act until 72 months from the due date of furnishing the annual return for the year to which they relate. The clock runs from the due date of the annual return, not the end of the financial year and not the date the return was actually filed, so the end date differs year by year as due dates move.

There is an extension: a registered person who is party to an appeal, revision or other proceeding, or under investigation for an offence under Chapter XIX, keeps the records for one year after final disposal of that matter, or for the 72 months, whichever is later.

Rule 57 of the CGST Rules, 2017 permits electronic records but requires a proper backup from which they can be restored after destruction, production on demand in hard copy or a readable electronic format, and, on request, the file details, passwords and explanation of codes. Rule 56(8) requires a log of every entry edited or deleted in electronic registers.

Income tax and labour records: check the new rules

Both regimes changed recently, and older retention guides cite repealed provisions.

Income tax: the Income-tax Act, 2025 replaced the Income-tax Act, 1961 from 1 April 2026. Maintenance of books now sits in section 62, which leaves the retention period to be prescribed by rules, and the Income-tax Rules, 2026 were notified by CBDT on 20 March 2026. Guides that quote rule 6F of the 1962 Rules describe the old position. Read the current rule before fixing a period in your schedule.

Labour: the Code on Wages, 2019 and the other labour codes came into force on 21 November 2025, replacing the registers prescribed under the older Acts. The registers, their forms and their preservation periods are set by central and state rules under the codes, and most private establishments fall under state rules. Take the period from the rules that apply to each establishment, not from a guide written for the repealed Acts.

Contracts: retention is set by the limitation period

No statute says how long to keep an ordinary commercial contract. The practical floor comes from the Limitation Act, 1963: under Article 55, a suit for compensation for breach of contract must be brought within three years from when the contract is broken, or, for successive breaches, from the breach sued on, or, for a continuing breach, from when it ceases.

Two consequences follow. First, the retention clock for a contract starts at the last possible breach, which is usually expiry or termination plus any surviving obligations such as confidentiality, indemnity and warranty periods, not the signing date. Second, destroying a contract three years after signing can leave a company without its own evidence while the counterparty can still sue. A common schedule keeps contracts for the limitation period after the last surviving obligation ends, plus a margin, and longer where the contract is also a tax or accounting record.

Personal data: the duty runs the other way

Section 8(7) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to erase personal data once consent is withdrawn or the specified purpose is no longer served, whichever is earlier, unless retention is necessary for compliance with law. The exception matters: an employee record that is also a statutory register is kept for the statutory period, and only then becomes subject to erasure.

This is where most retention policies break. A document that mixes a statutory record with personal data that no law requires to be kept, such as a vendor file with copies of an individual proprietor's identity documents, needs both a minimum period and an erasure trigger. The detailed retention and log requirements of the DPDP Rules, 2025 are covered in our guide to AI document management and retention.

How do you turn this into a retention schedule?

For each record class, write down five things, and make the system enforce them rather than relying on people to remember:

• the record class and an example document, so classification is unambiguous;
• the legal basis, with the section or rule, so the period can be re-checked when the law changes;
• the trigger event that starts the clock, such as end of financial year, filing date, annual return due date, redemption, or contract expiry;
• the period, and what happens at the end: review, archive or destroy;
• who approves disposal, with a second person required to confirm it.

Legal hold overrides every schedule

When litigation, an investigation or a regulatory inquiry is reasonably anticipated, the documents relevant to it must be preserved regardless of what the schedule says. The GST proviso above is one statutory example of the principle; the general one is that destroying evidence after a dispute is foreseeable damages the party that did it.

In practice that means a hold must be able to freeze a defined set of documents, block deletion, archiving and disposal of them until it is released, and record who was notified and when. A schedule that runs automatically without checking for holds is a liability, not a control.

IntelloVault, IntelloSync's document management system, applies retention schedules with a period, trigger and disposition action, requires maker-checker approval for disposal, and blocks disposal of any document under legal hold.