Keep or erase
Retention calendar
How long to keep each type of document, and when to erase it.
Erase when done, but not before the law allows
The DPDP Act and its Rules say, from 13 May 2027
Erase personal data once the work is done, or when the client withdraws consent. Keep it, and the logs of processing it, for at least a year after processing, and longer where another law says so.
Tax, company and other laws, and ICAI standards, say
Keep certain records for a set number of years.
So the question for each file is: what is the longest period any law or professional standard requires? Keep the file until then, then erase it.
Where papers of different kinds are kept apart, each kind can be erased after its own period.
Many of these laws put the duty on the client, not the firm: GST records and company books, for example. For copies it holds, a firm sets its own policy, then erases them under the DPDP Act once the purpose is over. The client's period is shown for reference. The schedule below says whose duty each one is.
When can a client file be erased?
What is in the file?
Only engagement letters use this date. Other types ask for their own date when you pick them.
Your answer will appear here
Pick what is in the file, then enter its dates.
Or press "Use a sample file" to see how it works.
A date is not enough
Before you erase a file
The calculator gives a date. Before anyone deletes a client file, a careful firm also checks that nothing is still open, that the papers are not needed, and that every copy is dealt with. Then it keeps a record that the file was erased.
Start with the calculator above
- Pick what is in the file and the date the keeping period starts.
Log of erasures on this device
Off until you switch it on. It keeps what is on the record: the file reference, what the file held, the dates, the places you went through, who approved it and your note. It is saved in this browser only.
The full schedule
8 rows checked against their sources, 1 suggested ยท last checked 5 October 2026
Client KYC documents
Verified- Keep for
- 5 years
- Law
- Prevention of Money Laundering Act, 2002, section 12, and notification S.O. 2036(E) of 3 May 2023
- Starts from
- The end of the business relationship with the client, or the closing of the account, whichever is later. For a client you still serve, it has not ended yet
- Whose duty
- The CA firm, but only when it does listed financial work for the client: buying or selling property; managing client money, securities, bank or other accounts; raising contributions for companies; setting up, running or managing companies, LLPs or trusts; or buying or selling businesses. Ordinary audit and tax work is not covered.
- Note
- Records of each transaction: 5 years from the date of the transaction. The 2005 record-keeping rules no longer set a period (removed in 2013); they ask for a physical copy of identity records, kept as the regulator sets.
- Source
- Open the source
Audit working papers
Verified- Keep for
- At least 7 years
- Law
- ICAI Standard on Quality Control (SQC) 1, paragraph 83, and SA 230, paragraph A23
- Starts from
- The date of the auditor's report, or the group auditor's report if later. If the file holds several years, use the latest report
- Whose duty
- The CA firm
- Note
- For work other than audit, the firm sets its own period.
- Source
- Open the source
Client company records handled by the firm
Verified- Keep for
- At least 8 financial years
- Law
- Companies Act, 2013, section 128(5)
- Starts from
- The end of the financial year the books relate to, for example 31 March 2025 for 2024-25. If the file holds several years, use the latest
- Whose duty
- The company, not the CA firm. For copies it holds, the firm sets its own policy, then erases them under the DPDP Act once the purpose is over. This period is shown for reference.
- Note
- Longer if an investigation is ordered and the Central Government directs it. A company younger than 8 years keeps all its years.
- Source
- Open the source
GST records handled by the firm
Verified- Keep for
- 72 months (6 years)
- Law
- CGST Act, 2017, section 36
- Starts from
- The due date of the annual return for that year. If the file holds several years, use the latest
- Whose duty
- The GST-registered client. For copies it holds, the firm sets its own policy, then erases them under the DPDP Act once the purpose is over. This period is shown for reference.
- Note
- If there is an appeal, revision, other proceeding or investigation, keep until 1 year after it is finally decided, or the 72 months, whichever is later.
- Source
- Open the source
Income-tax records, from tax year 2026-27
Verified- Keep for
- 7 tax years
- Law
- Income-tax Act, 2025, section 62, and Income-tax Rules, 2026, rule 46(9)
- Starts from
- The end of the tax year the records relate to, for example 31 March 2027 for tax year 2026-27. If the file holds several years, use the latest
- Whose duty
- The taxpayer: the firm for its own books, the client for the client's books
- Note
- The Rules were notified on 20 March 2026 (G.S.R. 198(E)) and apply from 1 April 2026. Keep longer if the assessment is reopened, until it is completed.
- Source
- Open the source
Income-tax books of a professional, financial years up to 2025-26
Verified- Keep for
- 6 years
- Law
- Income-tax Rules, 1962, rule 6F(5), with section 44AA of the Income-tax Act, 1961
- Starts from
- The end of the assessment year the books relate to. For books of 2024-25, that is 31 March 2026. If the file holds several years, use the latest
- Whose duty
- Professionals listed in rule 6F, such as a CA firm for its own books. The rule sets no period for a client in business, but such a client should keep books until the year can no longer be reopened, which in some cases is up to about 5 years and 3 months after the end of the assessment year.
- Note
- Keep longer if the assessment is reopened, until it is completed.
- Source
- Open the source
Personal data, and the logs of processing it
Verified- Keep for
- At least 1 year
- Law
- DPDP Rules, 2025, rules 6(1)(e) and 8(3)
- Starts from
- The date of the processing. For a whole log, the date of its last entry
- Whose duty
- The CA firm, including for data a cloud provider or other helper handles for it
- Note
- Applies from 13 May 2027, worked out from the date the Rules were published. A minimum: keep the data and its logs for at least 1 year after processing, then erase unless another law needs them kept longer.
- Source
- Open the source
Engagement letters
Suggested- Keep for
- At least 7 years, suggested
- Law
- Limitation Act, 1963, articles 55 and 113, and ICAI misconduct rules, 2007, rule 12; no period set by law
- Starts from
- The date the work under the letter ended
- Whose duty
- The CA firm sets its own period
- Note
- No law sets a period, so the firm chooses. A civil claim is usually barred after 3 years, but the Institute may still take up a misconduct complaint for 7 years: under rule 12 of the Chartered Accountants (Procedure of Investigations of Professional and Other Misconduct and Conduct of Cases) Rules, 2007, it may refuse one made more than 7 years after the event. So 7 years is the suggested choice.
- Source
- Open the source
Staff wage, provident fund and social security records
Verified- Keep for
- 5 years
- Law
- Social Security (Central) Rules, 2026 (G.S.R. 344(E), 8 May 2026), rule 53, and EPF Scheme, 2026
- Starts from
- The date of the last entry
- Whose duty
- The CA firm, as an employer
- Note
- 5 calendar years from the last entry, so the calculator keeps the record to the end of the fifth calendar year. Wage registers: rule 51(4) of the Code on Wages (Central) Rules, 2026 also says 5 years, but it covers employers in the central government's sphere. For a private firm the state's rules apply; as of October 2026 Maharashtra's were still in draft, and its old rules said 3 years.
- Source
- Open the source
At the end of the period: Erase or destroy it safely, unless another law or an open matter means it must be kept.