How Long Should a CA Firm Keep Client Documents?
Two rules pull in opposite directions. The DPDP Act says personal data should be deleted when it is no longer needed. Tax and company law says certain records must be kept for years. A firm that ignores either rule is exposed, so the answer is to keep each document for the period the law requires, and no longer.
What the DPDP principle says
The Act expects personal data to be deleted once the purpose has been served, unless another law requires its retention. That principle means you should not keep client documents "just in case." Each keeping decision needs a reason.
What other laws require
The table below gives the common retention periods for the records a CA firm holds. Periods depend on the type of record and the law, so check each one against the current text before you set your policy.
| Record | Commonly cited period | Source of the requirement |
|---|---|---|
| GST records and accounts | 72 months from the relevant annual return date | Section 36, CGST Act |
| Books of account under company law | Eight years | Companies Act, section 128 (verify) |
| Income tax records | Depends on the assessment window for the year | Income tax law (confirm with counsel) |
| Audit working papers | Often kept for several years | Professional and firm policy |
Income tax retention is the most fact-dependent. Confirm the period for each assessment year with your lawyer before you rely on it.
Set the period by document type
Start with the document, not the client. A bank statement, a Form 16, an identity copy and an audit file each have a different reason to be kept and a different period.
For identity documents collected only for a single engagement, the purpose usually ends when the work ends, unless another law requires you to keep a copy. Confirm that point with your lawyer before you set a rule.
Write the periods into a one-page policy. Keep it short enough that your team will read it.
Delete on a schedule
A policy that nobody follows protects no one. Pick one date each year, usually after filing, to review the folders. Delete what is past its period. Keep a short note of what was removed and when, so you can show that the process ran.
Keep fewer copies
Every extra copy is a record you must protect and eventually delete. Keep one master copy in the client's folder. Avoid copies on personal phones, in email attachments and in downloaded folders on laptops.
Audit working papers
Audit working papers often sit outside the client folder, in the audit team's own files. Set a period for them under your firm's policy, and check it against the audit rules that apply. Keep a clear link between the working papers and the client file, so a later review can find both.
Documents you should not keep
Some documents do not need to be kept once their purpose is served. Examples include a photocopy of an identity card sent for a single verification, or a phone photo of a document that already sits in the folder in a better form. Remove duplicates like these when you review the folder.
Questions people ask
Can I delete a client's documents after one year?
Only if no law requires you to keep them for longer. Many tax records must be kept for several years, so check each document type before you delete.
What about identity copies such as Aadhaar and PAN?
Keep them only as long as you need them for the engagement and any legal requirement. Restrict access and remove them on schedule.
Who decides the final policy?
Your firm does, with advice from your lawyer. This article is general information and does not replace that advice.
For the folder habits that make deletion easier, read the guide to organising client documents.
