How Long Should You Keep Client Documents? A Simple Retention Policy for Small Practices
It is March, and a partner is clearing a cupboard. She finds a carton marked "2016 clients". Inside are Form 16s, bank statements and Aadhaar copies for people who left the firm years ago. "Do we still need this?" she asks. Nobody knows.
A clear client document retention policy India firms can follow answers that in a minute. This guide shows a simple version for small practices, built on one idea: not every paper has the same reason to stay.
- Separate two things: records the law says you must keep, and copies clients send you to do a job.
- Keep client copies only as long as the work and any legal need require.
- Pick a short default, such as one year, and extend it for named clients with a reason.
- Write the policy on one page and apply it on a schedule, not when someone remembers.
Two kinds of papers, two kinds of rules
Start by splitting your files into two groups.
Your own records. These are the books, working papers and reports that you create as a professional. Laws and professional standards may require you to keep them for a set number of years.
Copies clients send you. These are the PAN cards, statements and certificates that arrive so you can do a job. They are the client's documents, and you hold them for a purpose.
The second group is where firms keep too much. Once the job is done and no law needs the copy, the reason to hold it ends.
What the law may require you to keep
Several laws set minimum periods for records. Two common examples are worth knowing.
- The GST law asks registered persons to keep records for a set number of years after the annual return is due. See the GST portal for the current period.
- Income-tax rules ask certain taxpayers and professionals to keep books of account for a number of years after the relevant assessment year. See the income tax portal.
Other laws, such as company law and anti-money-laundering rules, set their own periods. Your adviser can tell you which apply to your work and your clients. Write the answer down once.
A simple client document retention policy for India
Most small practices do well with a short default and a clear way to extend it.
| Class of document | Suggested default | Reason to extend |
|---|---|---|
| ID documents (PAN, Aadhaar) | Until onboarding or filing is done, up to 1 year | Ongoing engagement |
| Income documents for a return | 1 year after filing | Open assessment, notice |
| Bank statements | 1 year | Audit, dispute |
| Signed engagement and consent | 3 years | Limitation period |
| Documents under a legal hold | Until released | Court, inquiry |
Treat the table as a starting point. Your own rules may be longer, and your adviser may ask for more. The important part is that you pick a number, write it down and apply it the same way to every client. A rule that has exceptions for favourites is not a rule.
Why keeping everything forever is a risk
Old files feel safe, but they carry a cost. Each one is a document that someone must protect, and each year adds more.
If your firm is ever the subject of a breach, a larger pile of old documents means more people affected.
Under the Digital Personal Data Protection Act, 2023, personal data should be erased once its purpose is served and no law requires you to keep it. The Act is on the MeitY website. We cover the wider picture in DPDP for professional firms.
Short retention also makes life easier. Searches are faster and cleaner when old clutter is gone. Your team stops wondering which version is current, and you stop paying to store papers that no one will ever open again, which is a small saving that adds up.
How to run the policy without effort
A policy that depends on memory will fail. Run it on a schedule.
- Set a default for the whole firm, such as one year after the last job.
- Mark exceptions for clients who need longer, with a one-line reason.
- Get a reminder 30 days before anything is erased.
- Let the owner extend or download what must stay.
- Erase on the date, and keep a note that you did.
Between steps three and four, you also get a useful nudge. A client who is about to be erased is often a client who will need you again next season.
Tell clients what you do
Include your retention rule in your engagement letter or on the page where clients upload. Say how long you keep their documents and how to ask for earlier erasure.
Clients respect a firm that says "we keep your papers for one year after the work, and then we erase them". It sounds careful, and it is. If you want a checklist for the wider duties, use our free DPDP readiness checklist and read the DPDP guide.
For sensitive IDs in particular, read how to store Aadhaar, PAN and bank statements safely. It shows how retention fits with access and logs.
This article is general information, not legal advice. Check specific obligations with your professional adviser.
Where Reposha fits
Reposha is a secure client document service with retention built in. You choose a default of six months, one year or three years, and you can extend it for named clients. Thirty days before files are due to be erased, the owner gets an email with the number of clients affected. You can then send a fresh request, extend the period or download what you must keep. On the date, files are erased and the action is recorded. Your own statutory records stay wherever you keep them.
Questions people ask
How long should I keep client documents?
It depends on the document and the law. Keep records the law requires for the stated period. Keep client copies only until the work is done and no legal need remains, which for many small firms is around one year after the last job.
Can I delete client documents after filing a return?
Often yes, once the job is complete and no law or open query needs the copy. Keep what the law requires, such as books of account. Check your obligations with your adviser, and extend retention if an assessment or notice is open.
Does the DPDP Act require me to erase client data?
The Act expects personal data to be erased once its purpose is served, unless a law requires you to keep it. So holding every client copy forever is not a safe default. Set a period, write it down and erase on schedule.
What is a legal hold?
A legal hold pauses erasure for a client while a court case, notice or inquiry is open. Documents under a hold stay until it is released. Mark the client clearly, so a scheduled clean-up does not remove papers you still need.
A short checklist of the habits the DPDP Act asks for, in the order most firms need them.
