Indian businesses are legally required to retain different document types for periods ranging from one year to permanently, depending on the document category and the regulatory framework that governs it. The most commonly referenced minimum is six years for GST-related records under the GST framework, and eight years for books of accounts under the Companies Act, 2013. Kayman Vaults, a specialist records management company, helps businesses across India build retention schedules, track document lifecycles, and manage certified disposal so that compliance never becomes a guessing exercise.
Getting retention wrong in either direction carries real consequences. Disposing of a document before its period ends can be treated as destruction of evidence. Keeping documents past their retention period means holding unnecessary risk. This guide gives you a practical, reference-level framework for the most common document categories.
Keeping Everything Forever Is Not a Records Strategy. It Is a Growing Liability.
An unmanaged document archive creates compliance risk, unnecessary storage cost, and audit exposure that compounds every year it goes unaddressed. Kayman Vaults helps businesses build practical retention schedules and manages document lifecycles from creation through to certified destruction.
Why Records Retention Matters: The Compliance Reality
Records retention sits at the intersection of legal obligation, regulatory compliance, and operational risk management. In India, the requirements come from multiple overlapping frameworks:
- The Companies Act, 2013 specifies retention requirements for corporate records
- The GST framework defines minimum periods for tax-related documents
- RBI guidelines govern retention for banks, NBFCs, and financial intermediaries
- Healthcare regulations define patient record retention periods
- Labour laws specify requirements for employment-related records
- Industry-specific regulations add further requirements in pharmaceuticals, manufacturing, and education
No single framework covers everything. For businesses operating across multiple sectors or business lines, the picture becomes more complex, and the cost of getting it wrong becomes correspondingly higher.
The consequences of under-retention: Disposing of a document before its retention period ends can be treated as destruction of evidence in a legal dispute, a failure to comply with a regulatory audit, or a breach of statutory obligations. All carry financial and legal consequences that are significantly more expensive to address than proper records management would have been.
The consequences of over-retention: Holding sensitive documents past their retention period means storing personal data, financial information, and confidential commercial information without a legal basis for doing so. If a breach involves that data, the fact that you were holding it unnecessarily makes your compliance position significantly worse.
A defined retention schedule applied consistently eliminates both risks by telling every document when its time is up and what should happen next.
General Principles Before the Retention Schedule
The retention clock starts at different points for different documents. Some periods run from the date of creation. Others from the end of a transaction. Others from the end of the financial year. The reference point matters as much as the period itself.
Litigation hold overrides retention schedules. If your business is involved in or anticipates legal proceedings, documents relevant to those proceedings must be retained regardless of what the normal schedule says.
Retention periods are minimums, not maximums. The law tells you how long you must keep a document. Best practice is to dispose of documents at the end of their retention life rather than accumulating them indefinitely, but this must always be balanced against litigation hold considerations.
Digital copies and physical originals may have different rules. For some document types, a scanned digital copy satisfies the retention requirement. For others, the physical original must be retained. If you plan to use document scanning services to digitize records and then shred the originals, confirm the physical retention requirement for each document type first.
Disposal must be documented. For any document containing sensitive personal, financial, or commercial information, disposal must be through certified document shredding with a Records Destruction Certificate. Undocumented disposal is indistinguishable from accidental loss during an audit.
Do Not Shred Before You Check the Retention Period. Do Not Keep Documents After It Ends.
Getting either one wrong creates compliance problems that are slow and expensive to resolve. Kayman Vaults tracks retention schedules and manages certified disposal so the risk never falls through the gaps in your process.
Records Retention Schedule for Indian Businesses
The following framework covers the most common document categories. This is a practical reference guide. For your specific industry, business structure, and regulatory context, always supplement with advice from your legal or compliance advisor.
Financial and Tax Records
GST records (tax invoices, purchase records, debit and credit notes, e-way bills) Minimum retention: 6 years from the due date of filing the relevant annual return. Documents related to pending proceedings must be retained until those proceedings conclude.
Income tax records (returns, assessment orders, challans, supporting documents) Minimum retention: 6 years from the end of the relevant assessment year. If proceedings are pending, retain until those proceedings are complete.
Books of accounts (as defined under the Companies Act, 2013) Minimum retention: 8 years from the end of the relevant financial year. For companies with pending assessments, the period extends until the assessment is complete.
Audit reports and statutory financial statements Minimum retention: 8 years from the date of signing.
Bank statements and payment records Minimum retention: 8 years, aligned with books of accounts requirements under the Companies Act.
TDS records and Form 16 certificates Minimum retention: 7 years from the end of the relevant financial year.
Expense reports and petty cash records Minimum retention: 5 years, aligned with general financial record requirements.
Corporate and Legal Records
Memorandum and Articles of Association, Certificate of Incorporation Retention: Permanently. These are the foundational constitutional documents of the company and must be maintained for the entire life of the entity.
Board meeting minutes and resolutions Minimum retention: Permanently, under the Companies Act, 2013. These records form the legal basis for board-level decisions and cannot be disposed of.
Shareholder meeting minutes and resolutions Minimum retention: Permanently.
Register of members, directors, and charges Minimum retention: Permanently, for as long as the company exists, and for a defined period following dissolution.
Commercial contracts and vendor agreements Minimum retention: 3 years after expiry or termination of the contract, under the Limitation Act, 1963. Longer retention is strongly advisable for high-value, strategically significant, or dispute-prone agreements.
Intellectual property registrations and licensing agreements Minimum retention: Permanently for registrations, or for the duration of the IP plus at least 3 years for licensing agreements.
Human Resources Records
Employment contracts and offer letters Minimum retention: 3 years after the end of the employment relationship, with longer retention advisable where the individual may have grounds for a future claim.
Salary and payroll records Minimum retention: 5 years, aligned with PF, ESI, and applicable labour law requirements.
Provident Fund and ESI contribution records Minimum retention: 5 years from the relevant contribution date, or longer if specified by the administering authority.
Leave records and attendance registers Minimum retention: 3 years under most applicable labour laws.
Disciplinary records and termination documentation Minimum retention: 3 years after the end of the employment relationship, or longer if related proceedings are ongoing or anticipated.
Recruitment records for unsuccessful candidates Minimum retention: 1 year after the recruitment process concludes, for equal opportunity compliance purposes.
HR Records Are Among the Most Sensitive Documents Your Business Holds.
Employee personal data retained past its legal requirement creates unnecessary liability. Kayman Vaults keeps HR archives organized, compliant, and securely disposed of at exactly the right time.
Healthcare Records
Patient case records and clinical notes Minimum retention: 3 years from the date of last entry under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002. In practice, most hospitals retain records significantly longer given litigation exposure, and some state-level regulations specify longer periods. Consult your state health authority for applicable requirements.
Radiology and imaging records Minimum retention: 5 years as per common practice and applicable guidelines. Original films or digital equivalents must be retained.
Prescription records Minimum retention: 2 years from the date of issue for most categories.
Consent forms and surgical records Retention: Longer periods are strongly advisable given litigation exposure. Most hospitals retain these for a minimum of 10 years.
Laboratory reports Minimum retention: 2 to 5 years depending on the type of test and applicable clinical guidelines.
Healthcare organizations navigating EMR adoption need to manage the physical retention of historical records throughout the transition period. The CFO of a leading healthcare company working with Kayman Vaults noted that medical document storage is critical for meeting compliance requirements, and that Kayman Vaults’ service covered both physical storage of existing records and digitization of medical files in parallel.
Kayman Vaults’ document scanning and digitization services include specialized workflows for patient file digitization with high-volume capability and strict quality control, specifically designed for healthcare organizations making this transition.
Manufacturing and Operational Records
Quality control records and inspection reports Minimum retention: 3 to 5 years, or longer if required by quality management system certifications. ISO standards typically require minimum 3 years.
Technical drawings and engineering specifications Minimum retention: For the full operational life of the product or asset, plus a defined period after decommissioning. For products with ongoing liability exposure, extended retention is advisable.
Environmental compliance and waste management records Minimum retention: 5 years as required by applicable environmental regulations.
Statutory compliance records (factory registers, safety records) Minimum retention: Varies by the specific act under which the record is maintained, typically 3 to 5 years. Always check the specific regulation.
Product liability records Retention: Longer periods strongly advisable given potential litigation timelines. Many manufacturers retain these for 10 years or more.
General Administrative Records
Insurance policies and claim records Minimum retention: 3 years after expiry or claim settlement.
Supplier and vendor records Minimum retention: 3 years after the end of the supplier relationship.
Property and lease documents Minimum retention: For the duration of ownership or lease plus at least 3 years after termination.
General business correspondence Minimum retention: 2 to 3 years for routine correspondence. Longer for correspondence related to significant transactions, disputes, or regulatory matters.
A Retention Schedule Is Only Useful If Someone Is Actually Tracking It and Acting on It.
Most businesses define retention periods informally and then forget to apply them, until an audit reveals documents that should have been shredded years earlier. Kayman Vaults tracks retention schedules systematically and flags documents for certified disposal at the right time, so your compliance never falls behind.
What to Do When a Document Reaches End of Retention Life
Once a document reaches the end of its retention period, three things need to happen in order:
First: Confirm no litigation hold applies. If any related dispute, audit, or legal matter is active or anticipated, do not dispose of the document until the matter concludes. This overrides the retention schedule.
Second: Confirm physical originals are not required separately from digital copies. If the document has been scanned and digitized through Kayman Vaults’ document scanning services, verify that a digital copy satisfies the retention requirement for that specific document type before destroying the physical original.
Third: Dispose through certified document shredding. Any document containing personal data, financial information, client information, or commercially sensitive content must be destroyed in a way that makes recovery impossible, and the destruction must be formally documented.
Kayman Vaults’ certified document shredding services provide industrial-grade destruction, a documented chain of custody from collection through disposal, and a Records Destruction Certificate for every engagement. This certificate is your compliance evidence for any future audit question about what happened to specific records. Both on-demand shredding for batch disposals and scheduled recurring shredding are available.
Building a Practical Retention Schedule
A retention schedule does not need to be a lengthy legal document. A practical schedule covering your main document categories is sufficient for most businesses. Here is how to build one:
List your document types organized by function: finance, HR, legal, operations, administration.
Define the retention period for each using the framework above as a starting point, supplemented by advice from your legal or compliance advisor for regulated or industry-specific documents.
Define the retention clock start point for each category. Is it the date of creation, the end of the financial year, the end of an employment relationship, or the expiry of a contract?
Define the disposal method for each category. For all documents containing sensitive information, certified shredding with a destruction certificate should be the specified method.
Assign responsibility for monitoring retention schedules and initiating disposal. This should be a defined role rather than an informal expectation.
Schedule an annual review of the retention schedule to reflect regulatory changes and business evolution.
Kayman Vaults can assist with this process as part of a free consultation. The conversation covers your main document types, applicable retention requirements for your industry, and how to build a practical schedule your team can actually maintain and act on.
Your Business Has a Legal Obligation to Both Keep and Destroy Certain Documents at the Right Times.
Getting both right requires a retention schedule, a tracking system, and a certified disposal process working together. Kayman Vaults provides all three under one accountable partnership.
The Bottom Line
Records retention is one of those compliance requirements that most businesses know exists but few manage proactively. The result is archives that keep growing indefinitely, undocumented clearouts that may have disposed of legally required records, or both at different points in the business’s history.
A defined retention schedule, applied consistently with a proper tracking system and a certified disposal process, eliminates the guesswork and the risk entirely.
The documents your business holds should be the ones you are legally or operationally required to hold. The ones that have passed their time should be disposed of properly with documentation. Everything in between should be organized, retrievable, and managed by a system rather than by individual memory and best guesses.
Contact Kayman Vaults for a free site survey and find out how records lifecycle management, from secure storage through certified shredding, can work for your business specifically.
Frequently Asked Questions
Retention periods vary by document type. GST records must be kept for a minimum of 6 years. Books of accounts under the Companies Act require 8 years. Corporate constitutional documents like the Memorandum of Association must be kept permanently. Employment records require at least 3 to 5 years after the end of the relationship. Patient records in healthcare require at least 3 years from the last entry, with most hospitals retaining them significantly longer.
Premature disposal of a document can be treated as destruction of evidence in a legal dispute, non-compliance with a statutory audit request, or a breach of regulatory obligations. The financial and legal consequences can be significantly more expensive than proper records management would have cost.
For some document types, a scanned digital copy satisfies the legal retention requirement and the physical original can be securely destroyed. For others, the physical original must be retained regardless of whether a digital copy exists. Always confirm the specific requirement for each document type before shredding originals after digitization.
Under the GST framework, businesses must retain tax invoices, purchase records, debit and credit notes, e-way bills, and supporting documentation for a minimum of 6 years from the due date of filing the relevant annual return. Documents related to pending proceedings must be retained until those proceedings are complete.
A Records Destruction Certificate is a formal document issued by a certified shredding provider confirming what was destroyed, when, by what method, and under whose authority. It serves as legally defensible evidence of compliant disposal if a regulator or auditor later questions what happened to specific records. Kayman Vaults issues a Records Destruction Certificate for every shredding engagement.
Kayman Vaults tracks retention schedules for stored documents through its proprietary K-Vault software, flags documents approaching end of retention life, and manages certified disposal through its document shredding service. This means businesses do not have to manually track retention deadlines across hundreds of document types.