Client document retention under DPDP (legal-specific)

At a glance

Unlike chartered accountants (six or eight years under tax and company law) or doctors (a three-year medical-council floor), Indian law firms have no single Bar Council-mandated file-retention period to point to. That makes retention a firm’s own written call — driven by the matter’s limitation period under the Limitation Act, the risk of a future negligence claim, and any court or client-specific requirement — reconciled with the DPDP Act’s expectation that the file is deleted once none of those reasons still applies, rather than kept indefinitely.

Educational resource only. This explains how to set a retention policy under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) for a law practice’s client files, in the absence of a fixed Bar Council retention rule; it is not formal legal advice.

The situation

A firm asking “how long do we keep a closed matter’s file?” often expects a clean statutory answer, the way a CA firm has one for tax records. For advocates and law firms in India, that clean number doesn’t exist — which doesn’t mean the question has no answer, only that the firm has to build it rather than look it up.

Why there’s no fixed number to reach for

The Bar Council of India’s rules govern professional conduct and a lawyer’s duties to the client — they don’t set a specific document-retention period the way the Institute of Chartered Accountants of India’s (ICAI) Standard on Quality Control (SQC) 1 or medical-council regulations do for their professions. That leaves the retention decision to the firm’s own judgment, informed by the practical risks a closed file still carries rather than a single number every practice can copy.

What should actually set the retention period

Three considerations do the real work, and they don’t point to the same number for every matter.

• The Limitation Act, 1963. Most civil claims have a limitation period — commonly three years from when the cause of action arose for many contract and tort matters, longer for specific categories like certain suits relating to immovable property. A file connected to a matter where a related or follow-on claim could still be brought is worth holding at least through that window.
• Professional-negligence exposure. A malpractice claim against the firm itself can surface after a matter closes; many practices hold files longer than the underlying limitation period specifically to have a record if their own conduct is later questioned.
• Court, regulatory or client-specific requirements. Some matters carry their own document-preservation expectations — an ongoing appeal, a regulatory inquiry, or a client contract that specifies a retention term — which should override the firm’s default schedule for that file.

Building a written retention policy

Write the schedule by matter type, not as one number for the whole practice.

1. Categorise matters — litigation, transactional/advisory, regulatory — since the risk profile (and therefore the sensible retention window) differs across them.
2. Set a default period per category, informed by the relevant limitation period plus a buffer for negligence-claim risk, rather than an arbitrary round number.
3. Flag exceptions — an ongoing appeal, a regulatory hold, a client instruction to retain longer — that override the default for a specific file.
4. Log the matter-closure date, so the retention clock is calculable rather than left to memory.
5. Build the purge into whatever system holds closed files — physical archive or document-management system — with a defined review point, not an indefinite hold.

What changes at matter closure

Closure starts the retention clock; it doesn’t automatically trigger deletion. Once a matter closes, the file moves from “actively needed for the engagement” to “held against the specific risks above” — which is a real, DPDP-recognised purpose, just a narrower one than the original engagement. The point isn’t to delete immediately at closure; it’s to have a defined endpoint at all, so the file doesn’t sit in storage indefinitely once even those narrower reasons no longer apply.

What happens to files when a practice closes or a partner leaves

A retention schedule written for an ongoing practice doesn’t answer itself when the practice stops being ongoing — a solo advocate retiring, a firm dissolving, or a partner departing all raise the same question: who now owes the retention duty for files that haven’t reached their retention endpoint? This is a genuine gap in most firms’ planning, since retention schedules are usually written assuming the firm’s own continuity. A few situations worth planning for specifically:

• A solo advocate retiring or winding down — client files with matters still inside their retention window need a named recipient (another practitioner, a designated custodian) who takes on both the physical/digital custody and the DPDP Act’s ongoing security and eventual-deletion duty, rather than files simply sitting in storage with no one responsible.
• A firm dissolving or merging — the surviving entity (in a merger) or a formally designated partner (in a dissolution) should inherit both the files and the documented retention schedule that governs them, so the schedule doesn’t silently reset or get lost in the transition.
• A partner leaving with client relationships — where a client’s ongoing matter moves with a departing partner to a new practice, the file’s DPDP Act custody moves with it; where a closed matter’s file stays with the original firm, that firm keeps the retention duty regardless of the partner’s departure.

The client’s own reasonable expectation — that someone remains accountable for their file’s security and eventual deletion even after the practitioner they dealt with moves on — is what this planning is actually protecting.

FAQ