How long should HR retain employee documents under DPDP?

At a glance

There’s no single, universal retention period for employee records in India — payroll, Provident Fund (PF) and Employees’ State Insurance (ESI) records, attendance registers and disciplinary files each sit under a different labour or tax law, with different clocks. The DPDP Act doesn’t override any of them; each is a legal-obligation basis for holding data that long. What the Act adds is writing the schedule down per document type, and purging records once the period ends and employment is over — instead of keeping every file indefinitely “just in case.”

Educational resource only. This explains how to build an employee-record retention schedule under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice, and specific retention figures should be checked against the labour-law rules that apply to your state and establishment type.

The situation

HR teams often ask “how long do we need to keep this?” expecting one answer. The honest answer is that a personnel file is really several different records bundled together, each answerable to a different law — and treating the whole file as one retention question is exactly what produces the two failure modes the DPDP Act is written against: keeping everything forever by default, or deleting something a labour inspector could later ask to see.

Why there’s no single number

Employee data retention in India is governed by a purpose-and-necessity approach across several overlapping laws, not one consolidated rule. Payroll, PF, ESI, minimum-wage and tax regulations each set their own expectations for how long the records they govern should be kept — and the exact figure can vary by document type and, for some registers, by state-level Shops and Establishments rules. That’s a genuine complexity, not a gap you can paper over with a single round number.

What the different record categories follow

Group records by the law that actually governs them, not by which department created them.

• Payroll and wage records — governed by wage and payroll legislation, PF and ESI regulations, and income-tax/TDS rules; typically held for several years to satisfy audit and inspection windows under these overlapping regimes.
• Attendance and leave records — held to satisfy labour-inspection and enforcement schedules, generally for a multi-year window a labour inspector could reasonably ask to see.
• Statutory registers (as required under the applicable Shops and Establishments Act or factory rules) — held per that specific state or sectoral rule.
• Recruitment and background-verification records — see the dedicated guide on this; typically shorter-lived than payroll records once the hire decision is made and, for rejected candidates, closed out promptly.
• Disciplinary and performance records — reasonably held through employment and for a defined period after, to defend against a possible legal claim — not indefinitely, and not framed as a punitive permanent record.

Building one schedule that reconciles all of it

Write the retention period per category, name the law it’s tied to, and log the trigger date.

1. List every category of employee record the organisation actually holds — not an ideal version, the real one.
2. Name the retention period and its legal basis for each — payroll under wage/PF/tax rules, statutory registers under the applicable state Act, and so on.
3. Log the trigger date — usually the date of creation, last entry, or termination — so the clock is calculable, not remembered.
4. Build the purge into whatever system holds the records — HRMS, physical registers, or both — rather than an annual manual review that tends not to happen.
5. Revisit the schedule when a law changes or the organisation expands into a new state with different Shops and Establishments requirements.

What happens at termination

Termination starts some clocks and has no effect on others. Statutory records tied to tax, PF or ESI keep running on their own schedule regardless of when someone leaves. Records tied to the employment relationship itself — internal performance notes, non-statutory personal files — lose their original purpose at termination and should move onto a shorter, defined post-employment hold (commonly justified by potential legal claims) rather than sitting in the system indefinitely with no further reason to exist.

What happens to records in a merger, acquisition or business transfer

An acquired company’s employee records don’t get a fresh retention clock just because the employer changes — the underlying legal-obligation basis (wage law, PF/ESI, tax) travels with the records, and so does the deletion duty once those periods end. Where employees transfer to the acquiring entity (common in a business transfer or slump sale), their personnel files typically transfer too, and the acquiring company effectively steps into the retention schedule the original employer should already have had in writing — which is exactly why having that schedule documented, rather than kept in someone’s head, matters at the moment of a transaction and not just in day-to-day HR operations. Where employees don’t transfer — a partial acquisition, a discontinued business line — the records for those employees still carry their own statutory retention duty; the acquiring or divesting entity needs to agree explicitly who retains custody and the associated DPDP Act responsibility, rather than leaving it ambiguous in the transaction documents. Due diligence for any acquisition is a reasonable point to also audit whether the target company’s retention schedule actually exists in writing and is being followed, since an undocumented or unenforced schedule is itself a liability the acquirer inherits.

FAQ