How Long to Keep Contracts and Records in India: A Retention Schedule With the Law Behind Each Period
How long an Indian company must keep contracts, books, minutes, tax records and personal data, with the provision behind each period, and how the DPDP Act's erasure duty fits with statutory retention. A schedule you can adopt and the three decisions that make it work.
"Keep everything forever" is the default retention policy of most Indian companies, and from May 2027 it will conflict with the DPDP Act's erasure duty for personal data. The alternative is a schedule: for each record type, a period, the provision that sets it, and a rule for what happens at the end. This guide gives a starting schedule for a private company and explains the reconciliation with data protection. Position as of October 2026.
The schedule
| Record | Period | Basis |
|---|---|---|
| Books of account, vouchers and related records | Eight financial years | Companies Act, 2013, section 128(5) |
| Annual returns and annexures | Eight years from filing | Companies (Management and Administration) Rules, 2014, rule 15(3) |
| Minutes of board, committee and general meetings | Permanently | Rule 25(1)(e)-(f), Management and Administration Rules |
| Register of members; register of charges; MBP registers | Permanently (as the rules provide) | Management and Administration Rules; Registration of Charges Rules, rule 10(4); Meetings of Board Rules |
| Charge instruments after satisfaction | Eight years from satisfaction | Registration of Charges Rules, rule 10(4) |
| Director disclosures (MBP-1) | Eight years from the financial year | Meetings of Board Rules, rule 9(3) |
| Income-tax records | At least the period during which assessment can be reopened; commonly kept eight to ten years | Income-tax Act, 1961 (section 44AA for prescribed persons; reopening periods under section 149) |
| GST records | Seventy-two months from the due date of the annual return, longer if proceedings are pending | CGST Act, 2017, section 36 |
| Executed contracts and their evidence (stamp certificate, audit trail) | Term plus the limitation period (generally three years) and any longer statutory period | Limitation Act, 1963; evidence under BSA 2023 s. 63 |
| Employment records | Per the Labour Codes' rules and state laws; commonly three to five years after exit for most registers | Labour Codes and rules |
| ICT system logs | Rolling 180 days within India | CERT-In Directions, 28 April 2022 |
| Logs and personal data supporting breach detection | One year | DPDP Rules, 2025, rule 6(1)(e) |
| Personal data generally | Until the specified purpose is no longer served, then erase, unless law requires retention | DPDP Act, 2023, section 8(7); Rules, rule 8 and Third Schedule for notified classes |
Reconciling retention with erasure
Section 8(7) of the DPDP Act requires a Data Fiduciary to erase personal data when consent is withdrawn or "as soon as it is reasonable to assume that the specified purpose is no longer being served", "unless retention is necessary for compliance with any law for the time being in force". Rule 8 and the Third Schedule set periods after which the purpose is deemed no longer served for notified classes (large e-commerce, gaming and social media platforms), with notice before erasure. For an ordinary company the method is:
- Identify, for each record containing personal data, the purpose and the statutory retention that applies (a signed contract: performance and defence of claims, for the term plus limitation; payroll: tax and labour law periods).
- Set the retention period as the longer of the purpose-based period and the statutory period.
- Erase, or anonymise, at the end, and record that you did.
- State the periods in the privacy notice.
A retention schedule is therefore both a records policy and the evidence of DPDP compliance.
Three decisions that make it work
- Owner per record type: finance for accounts and tax; company secretary for statutory registers and minutes; legal or the contract desk for contracts; HR for employment records; IT for logs.
- Trigger dates captured at creation: a contract's end date and limitation period; an employee's exit date; a financial year end. Without the trigger, nothing is ever erased.
- A defensible destruction process: approval, log, and a litigation hold rule that suspends destruction when a dispute or investigation is reasonably anticipated.
Contracts specifically
Keep the executed contract, its stamp certificate, the signature audit trail, amendments, notices and the obligation history together for the term plus the limitation period and any longer period a regulator requires. The audit trail is what makes the record provable under section 63 of the Bharatiya Sakshya Adhiniyam, 2023; a signed PDF retained without it is a weaker record at year six than at year one.
Where Legatio fits. Legatio holds the contract record with its evidence, captures the end date and retention period at signature, and applies retention and erasure rules with a log. The schedule and its legal basis are your compliance team's.
Position stated as of October 2026. General information; retention periods under tax and labour law should be confirmed for your situation.