Keep what the law, the contract or the business genuinely requires. Delete the rest on schedule. Holding customer data indefinitely because nobody decided to delete it is a liability that grows quietly and surfaces during an incident.
| Record type | Retention | Driver |
|---|---|---|
| Statutory books, incorporation and ROC filings | Permanent | Company law |
| Financial records, invoices, ledgers | As required by tax and company law | Statutory |
| GST returns and supporting records | As required by GST law | Statutory |
| TDS records and certificates | As required by tax law | Statutory |
| Client contracts, SOWs, DPAs | Term + limitation period | Contractual and legal defence |
| Partner agreements and KYC | Term + statutory retention | Contractual and AML |
| Investor documentation and KYC | Term + statutory retention | AML |
| Employee records | Per employment law | Statutory |
| Candidate records (unsuccessful) | Limited period, then deleted | Data minimisation |
| Payroll and statutory contribution records | Per applicable statute | Statutory |
| Call recordings — client campaigns | Per the client's contract; deleted at term end unless the client instructs otherwise | Controller's instruction |
| Campaign customer data | Per the client's contract; returned or destroyed at term end with written certification | Processor obligation |
| Tickets and support records | Business period stated in the support policy | Operational |
| Security and access logs | Stated period, sufficient for incident investigation | Security |
| Incident and breach records | Extended period — these are needed years later | Regulatory defence |
| Training records | Employment period + stated period | Client audit |
| Marketing prospect data | Until consent withdrawal or the stated inactivity period | Data minimisation |
| Internal email and messaging | Business period | Operational |
Exact durations are set against the statute in force and are recorded in the compliance calendar. Where a client contract specifies a different period, the client's instruction governs for their data — we are the processor.
Where litigation, a regulatory investigation or a dispute is reasonably anticipated, retention is suspended and the relevant records are preserved. A legal hold overrides every deletion schedule and is issued only by the Director. Deleting records under a legal hold is a serious offence regardless of whether the deletion was routine.
At the end of a client engagement, campaign customer data is returned in the agreed format or securely destroyed, and written certification of destruction is issued — including from every partner who held the data. Partner obligations here are in the DPA and enforced at exit (18_Vendors/05_Performance_Management_And_Termination.md).
Digital: secure deletion or cryptographic erasure; media sanitised or destroyed before disposal. Paper: cross-cut shredding or certified destruction. Paper containing customer data never enters general waste.
Finance & Compliance owns the schedule. Function Heads own execution within their area. Reviewed annually and whenever a relevant law changes.
An AI agent never states a specific retention period from inference. If asked "how long do you keep my data", the correct answer is that retention follows the client's contract and applicable law, with an offer to route the question to Compliance.
Registration is free. Browse every live project with its scope, seats and payout, then apply to the ones that fit.
Register free See live projects