Compliance & labour law · Updated October 2026
Employee data retention is the rule-set for how long you keep each kind of employee record and when you delete it. Two pulls work against each other: labour and tax laws make you keep certain records for years, while data protection law (the DPDP Act) says personal data should be erased once its purpose is served. Your retention schedule is where you settle that for every record type, in writing.
The clearest period is in the Code on Wages (Central) Rules, 2026 (notified 8 May 2026): the employee register, register of wages and attendance-cum-muster roll must be preserved for five years after the date of the last entry, and may be kept electronically. Secondary summaries of the Social Security (Central) Rules, 2026 also report a five-year period for the registers under them, but read the rule text for your Act before relying on it. Older Acts varied between roughly three and five years, which is why advice written before the Codes often differs.
| Record | What to do |
|---|---|
| Wage, attendance and employee registers | Five years from last entry (Wages Rules, 2026); the date is the last entry, not the year-end |
| PF, ESI, gratuity records | Check the applicable Act and rule; keep service history at least until final settlement and any claim is closed |
| Tax and books of account | Secondary sources cite seven years under the Income-tax Act, 2025; confirm with your tax adviser |
| Anything under dispute or inspection | Keep until the matter ends, whatever the schedule says |
The DPDP Act expects a data fiduciary to erase personal data once the purpose is no longer served, unless another law requires it to be kept. The Rules were notified on 13 November 2025, but the core duties are not binding until 13 May 2027, so you have time to build a schedule rather than cut data in a rush. The Rules also set a minimum one-year retention for processing logs, so do not wipe system logs to look tidy.
Practically, this means separating what you must keep (statutory registers, pay and tax history) from what you merely hold: rejected candidates’ CVs, old copies of ID documents, and biometric attendance templates of people who have left. Those are the first candidates for deletion, subject to your legal advice. Keep a clean employee master record so you know where each document lives.
Not automatically. The five-year period applies to specific registers, and gratuity, tax or litigation needs may run longer. Delete only after checking each record type against your schedule.
The Wages Rules allow electronic registers, so a properly maintained digital register is acceptable. For other documents, check whether the Act insists on originals.
You are. Under the DPDP Act a fiduciary must make its processor erase data too, so write deletion and return clauses into the contract, as in payroll outsourcing arrangements.
Run your yearly HR audit against this schedule and note every record type that has no owner or end date.