Data Retention for CA Firms: How Long to Keep Client Data and How to Delete It

Short answer: Keep each kind of record for the period a law or professional standard sets, and erase everything else once its purpose ends, which is what the DPDP Act 2023 requires.^[1] The usual anchors for a CA firm are seven years from the audit report for audit documentation, 72 months from the annual return due date for GST records, six years from the end of the assessment year for income-tax books under the 1962 Rules, and eight financial years for a company's books. Put them in a written retention schedule and use software that deletes on a timer.

Last updated 30 October 2026. Periods are from the statutes, rules and ICAI announcements cited at the end. The screenshot is from a sample MyPract workspace, taken on 30 October 2026. This is practical guidance for firms, not legal advice: where periods conflict or a matter is under dispute, confirm with counsel.

A CA firm holds two kinds of data. Some is the firm's own record of its work, such as audit files and its own books. The rest is a copy of the client's records, such as purchase registers, returns and identity documents, which the client must keep under its own statutory duties. Both need an end date.

Does the DPDP Act say how long you can keep client data?

For most firms the Act sets a principle, not a number. Section 8(7) requires a data fiduciary to erase personal data, and have its processors erase it, once the data principal withdraws consent or the specified purpose is no longer being served, unless retention is necessary for compliance with any law for the time being in force.^[1]

The DPDP Rules 2025 were published in the Gazette on 13 November 2025.^[2] Their fixed three-year erasure period applies only to the classes in the Third Schedule (large e-commerce, online gaming and social media platforms), not to a CA firm. One rule does reach every data fiduciary: keep the logs of processing, and the personal data in them, for at least one year.^[2] The retention and erasure duties take effect 18 months after publication, around mid-May 2027.^[3]

So the test for each record is simple. Is a law or standard still making you keep it? If yes, keep it until that period ends. If not, and the work it was collected for is done, delete it. Our DPDP Act checklist for CA firms covers notice, consent and breach reporting.

How long do other laws make a CA firm keep records?

Two cautions. First, the GST and Companies Act periods bind the client, not the firm; your copy only needs to last as long as you need it for your own work or file. Second, periods run from different dates (a report date, a return due date, the end of an assessment year), so record the start date with each period.

What should a CA firm's retention schedule look like?

A one-page schedule that partners sign off is enough for most firms. For each record type, write:

1. What it is, for example "statutory audit file", "client KYC (PAN, Aadhaar)", "GST working files", "engagement emails".
2. Why you hold it: your own professional duty, or a copy kept to do the client's work.
3. The period and its start date, with the law or standard that sets it.
4. Where it lives: practice software, file server, email, paper.
5. What happens at the end: delete, return to the client, or review.
6. Who checks it, and how often (once a year after the audit season works for most firms).

Keep KYC copies, such as Aadhaar and PAN scans, only as long as the engagement needs them, because they are the personal data most exposed in a breach. Where a client relationship ends, offer to return the client's records and then delete your copies, except what your own audit file must keep.

Should you archive or delete a client's data?

They solve different problems.

• Archive while a retention period is still running. The data stays complete and searchable for an assessment, inquiry or peer review, but drops out of day-to-day lists.
• Delete once no purpose and no legal duty remain. That is what the DPDP Act expects, and it also shrinks what a breach could expose.

Deletion has to reach every copy: the practice software, its file storage, shared drives, email attachments and backups. Ask each vendor how long deleted data survives in its backups.

How does MyPract handle retention and deletion?

MyPract separates archiving from deletion and deletes on a timer. Archiving a client keeps every record. Deleting a client, engagement, task, time entry, document or invoice moves it to Trash, where it can be restored. A nightly job then deletes it permanently.

• Trash is emptied after 30 days by default. Owners and Admins can set any period from 7 to 365 days under Settings > Workspace > Practice defaults, and the setting shows when the last clean-up ran and how many items it deleted.
• Paid invoices are never deleted, and an item other records still depend on (for example a client with live invoices) is skipped and tried again the next day rather than forced.
• Files go too. When a document is deleted for good, its files are removed from storage, not just hidden.

Other records are deleted on a fixed schedule, as the privacy policy states:

Data domicile by country: a paying firm outside India gets its own instance in its country, so its database, files and server functions stay in-country. Today, with customers in India, everything runs in Mumbai (AWS ap-south-1) through Supabase. See /facts for the full list of what MyPract does, and our guide to where practice software stores client data.

MyPract does not decide your retention periods for you. Audit files you must keep for seven years should stay out of Trash, archived rather than deleted, and records you keep in other systems need their own schedule. For choosing software with deletion in mind, see the best practice management software for CA firms.

How we checked

On 30 October 2026 we read section 8(7) of the DPDP Act 2023 and the DPDP Rules 2025 as published by MeitY with the commencement notification, ICAI's announcement on the SQC 1 retention period, section 36 of the CGST Act, rule 6F of the Income-tax Rules 1962 on the Income Tax Department's site, commentary on rule 46 of the Income-tax Rules 2026, and section 128 of the Companies Act 2013. MyPract's periods come from its privacy policy and were checked against the product: the nightly retention jobs ran successfully on 29 October 2026, and the screenshot shows the setting in a sample workspace.

Frequently asked questions

How long should a CA firm keep audit working papers?

ICAI's SQC 1, with the matching paragraph of SA 230, says audit documentation should ordinarily be kept for at least seven years from the date of the auditor's report, or the group auditor's report if that is later. Keep files longer if a regulator, court or the firm's own policy needs them.

Does the DPDP Act set a fixed retention period?

Not for most businesses. Section 8(7) says personal data must be erased once its purpose is no longer served, unless keeping it is necessary to comply with a law. The fixed three-year period in the DPDP Rules 2025 applies only to the large e-commerce, gaming and social media platforms listed in the Third Schedule.

How long must GST records be kept?

Section 36 of the CGST Act requires a registered person to keep books and records for 72 months from the due date of the annual return for that year, and longer while an appeal, revision or other proceeding about them is pending.

Is archiving a client the same as deleting the client's data?

No. Archiving hides a client from day-to-day lists but keeps every record, which is right while a retention period is running. Deletion removes the data, which is what the DPDP Act expects once no purpose or legal duty remains.

How does MyPract delete data?

Deleted items go to Trash and can be restored. Trash is emptied automatically after 30 days by default; Owners and Admins can set 7 to 365 days under Settings > Workspace. Paid invoices are never deleted, and the files of deleted documents are removed from storage. Other periods, such as two years for the activity log, are in the privacy policy.

Sources

[1] Ministry of Electronics and Information Technology, "The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)", section 8(7), checked 30 October 2026.

[2] Ministry of Electronics and Information Technology, "Digital Personal Data Protection Rules, 2025", G.S.R. 846(E), Gazette of India dated 13 November 2025, rule 8 and Third Schedule, checked 30 October 2026.

[3] Ministry of Electronics and Information Technology, "Notification G.S.R. 843(E): commencement of the Digital Personal Data Protection Act, 2023", 13 November 2025, checked 30 October 2026.

[4] ICAI, "Announcement on amendment to SQC 1: retention period for engagement documentation", 21 August 2009, checked 30 October 2026.

[5] Commercial Tax Department, Chhattisgarh, "Section 36, CGST Act, 2017: Period of retention of accounts", checked 30 October 2026.

[6] Income Tax Department, "Rule 6F, Income-tax Rules, 1962: books of account kept by certain professionals", checked 30 October 2026.

[7] Taxmann, "Income Tax Rules 2026: Master Guide with Rule-wise Commentary", checked 30 October 2026.

[8] Income Tax Department, "Section 128, Companies Act, 2013: Books of account, etc., to be kept by company", checked 30 October 2026.