Data retention How long to keep records, and when to delete them.
Short answer. Data retention is the rule for how long data is kept before it is deleted. Two pulls compete: some laws say keep, others say delete. In India the CGST Act requires a registered person to retain books of account until 72 months after the due date of the annual return, and the Companies Act, 2013 requires books of account to be kept for not less than eight financial years. The DPDP Act, being phased in from about May 2027, says a data fiduciary must erase personal data when consent is withdrawn or the purpose is no longer served, unless retention is necessary under a law. The DPDP Rules, 2025 add a one-year minimum for certain logs. A retention schedule reconciles the clocks. This is general information, not legal advice.
01
Clocks that pull in different directions
The DPDP Act and Rules are being phased in. The Rules say that rules 3 and 5 to 16, which include rules 6 and 8, come into force 18 months after publication in November 2025, around May 2027, and the Press Information Bureau describes an eighteen-month period for phased compliance. Check the commencement notification for the date that applies to section 8(7) of the Act. The CGST Act, the Companies Act and the CERT-In directions are already in force.
Source
What it says
Direction
CGST Act, 2017, section 36
Registered persons keep books of account and records until 72 months after the due date of the annual return for the year concerned. If an appeal, revision or investigation is pending, they keep the relevant records for one year after final disposal, if that is later
Keep
Companies Act, 2013, section 128(5)
Books of account of a company, with vouchers, kept in good order for not less than eight financial years
Keep
CERT-In directions, 28 April 2022
Logs of ICT systems kept for a rolling 180 days, within the Indian jurisdiction
Keep
DPDP Rules, 2025, rules 6 and 8(3)
Certain logs, traffic data and personal data kept for a minimum of one year
Keep
DPDP Act, 2023, section 8(7)
Erase personal data when consent is withdrawn or the purpose is no longer served, unless retention is necessary for compliance with a law, and have processors erase it too
Delete
02
Building a retention schedule
A schedule lists each class of data with the reason it is kept, the period, and what happens at the end. These rows are examples to adapt, not rules.
Class of data
What sets the period
At the end
Books of account and vouchers
The Companies Act, 2013 and the CGST Act, 2017
Delete or archive after the longer period, unless a hold applies
Client files
Your engagement terms, your professional rules and limitation periods; ask your adviser
Return or delete as the engagement says
AI prompts, answers and chat history
Your own policy and the purpose they were collected for
Delete on schedule
Meeting recordings and transcripts
Consent and purpose; the approved minutes are the lasting record
Delete once the minutes are approved, if your policy says so
Audit logs of AI use
CERT-In 180 days, the DPDP Rules one year from 2027, and your own needs
Delete on schedule and record the deletion
Backups
The rotation cycle
Expire with the cycle
03
Retention and AI specifically
AI systems create copies you may not think of: the search index built from your documents, saved prompts and answers, caches and exported drafts. Deleting a file without deleting the copies leaves the information in the system. Plan for deletion to reach the index, caches and backups, and keep a record that it happened.
Treat audit logs and chat content as separate classes. A log that shows who asked what may need to be kept for months, while the content of the question may need to go sooner.
04
Holds and exceptions
Section 36 of the CGST Act shows the usual shape of a legal hold. A person who is party to an appeal, revision or other proceeding, or is under investigation for an offence, must keep the related records for one year after final disposal, or for the period above, whichever is later. Section 8(7) of the DPDP Act carries its own exception: erase unless retention is necessary for compliance with any law. Its worked example is a bank that must keep identity records for ten years after an account closes.
Check for a legal hold or an open dispute before any deletion run.
Delete from the live system, the index, caches and, on rotation, backups.
Ask processors to erase too, as section 8(7)(b) requires of a data fiduciary.
Keep a short record of what was deleted, when, and under which rule.
05
Where ANVE stands
ANVE logs every model call with the user, the app, the model and whether it ran locally or in the cloud. How long the office keeps its records is the office’s decision. How deletion reaches logs, indexes and backups in ANVE is a question to settle in writing before a paid pilot. Our question pages on AI chat records and on deleting a document cover the practical side.
06
Questions people ask
How long should we keep AI chat records?
There is no single rule. It depends on the purpose, the sector and your policy; see our question page on AI chat records. If chats contain personal data, section 8(7) of the DPDP Act points toward erasing them when the purpose is served, unless a law requires you to keep them.
Does the DPDP Act set a fixed retention period?
Not in its general provision, which is purpose-based. The DPDP Rules, 2025 set specified periods for specified cases. Rule 8(1) and the Third Schedule set a three-year erasure period for large e-commerce, online gaming and social media platforms, which will not describe most offices.
Can we delete a document a client asks us to remove?
Only if no rule requires you to keep it. A client’s request does not override a legal duty to retain, as the bank example in section 8(7) shows. Tell the client what you can and cannot delete.
Do backups count?
Yes. Backups are copies of the data, so deletion duties reach them. Plan expiry by rotation and document the cycle.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
