Section 36: How Long Records Must Be Kept, and Where

Section 36 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.

Retention is the obligation that outlives every other. It runs long after the return is filed, the assessment closes and the business may have moved on.

Section 36: every registered person required to keep and maintain books of account or other records shall retain them until the expiry of seventy-two months from the due date of furnishing of the annual return for the year pertaining to such accounts and records. The proviso: a person who is a party to an appeal or revision or any other proceedings before any Appellate Authority, Revisional Authority, Appellate Tribunal or court, or is under investigation for an offence under Chapter XIX, shall retain the books for one year after final disposal of such appeal, revision, proceedings or investigation, or for the period specified above, whichever is later.

The clock

Seventy-two months from the due date of the annual return. Not from the transaction, not from the end of the financial year.

For FY 2025-26, the annual return due date is 31 December 2026. Seventy-two months from that is 31 December 2032.

So records for a transaction in April 2025 must be retained until December 2032 — over seven and a half years from the transaction.

The extension

The proviso operates on two triggers:

A party to an appeal, revision or any other proceeding before an Appellate Authority, Revisional Authority, Appellate Tribunal or court.

Under investigation for an offence under Chapter XIX — offences and penalties.

In either case: one year after final disposal, or the seventy-two months, whichever is later.

The practical consequence is that a long-running dispute suspends the retention limit indefinitely. A demand for FY 2018-19 still in appeal in 2030 keeps those records live until a year after it ends.

Where the records must be kept

Section 35(1): every registered person shall keep and maintain, at his principal place of business, as mentioned in the certificate of registration, a true and correct account of production or manufacture of goods, inward and outward supply, stock of goods, input tax credit availed, output tax payable and paid, and such other particulars as may be prescribed.

The proviso: where more than one place of business is specified in the certificate of registration, the accounts relating to each place of business shall be kept at such places of business.

Rule 56(7) repeats it: every registered person shall keep the books of account at the principal place of business and at every additional place of business mentioned in the certificate of registration and shall keep them at each such place.

So records cannot all be centralised at head office where multiple places are declared. Each place holds its own. Principal place of business →

Electronic records

Section 35(1) second proviso: the registered person may keep and maintain such accounts and other particulars in electronic form in the prescribed manner.

Rule 56(15): the records may be maintained in electronic form and shall be authenticated by means of a digital signature.

Rule 57 sets the conditions:

(1) Proper electronic back-up of records shall be maintained and preserved in such manner that, in the event of destruction of such records due to accidents or natural causes, the information can be restored within a reasonable period of time.

(2) The registered person shall, on demand, produce the relevant records or documents, duly authenticated, in hard copy or in any electronically readable format.

(3) Where the accounts and records are stored electronically, the person shall, on demand, provide the details of files, passwords and explanation for codes used, where necessary, for access and any other information which is required for such access along with a sample copy in print form of the information stored in such files.

That third requirement — passwords and code explanations — is the one that cloud and ERP arrangements are rarely designed around. A system whose data cannot be produced in a readable format, with the codes explained, does not satisfy Rule 57 however well it works internally.

The consequence of not retaining

Section 35(6): where a registered person fails to account for the goods or services in accordance with s.35(1), the proper officer shall determine the amount of tax payable on the goods or services that are not accounted for, as if such goods or services had been supplied, and the provisions of s.73, s.74 or s.74A shall apply for determination of such tax.

Section 122(1)(xvi) penalises failure to keep, maintain or retain books of account and other documents as required.

Section 132 brings in prosecution where the ingredients are made out, including for falsifying or substituting financial records or producing fake accounts or documents.

Key takeaways

• Seventy-two months from the annual return due date — roughly seven and a half years from a transaction.
• The proviso extends it to one year after final disposal of an appeal, revision, proceeding or investigation.
• Records must be kept at the principal place of business and at every additional place declared.
• Electronic records must be digitally signed, backed up and restorable, and producible in hard copy or readable format.
• Rule 57(3) requires passwords and code explanations on demand.
• Section 35(6) taxes unaccounted goods or services as if supplied.

Read next

• Section 35 CGST Act: Accounts and Records
• Section 36 CGST Act: Retention of Accounts
• Principal Place of Business: Definition and Proof
• Rule 58: Enrolment for Transporters and Warehouse Keepers

Disclaimer: Positions stated as on 5 September 2026, based on the CGST Act and Rules as amended to 31 March 2026 (ICAI Bare Law, 12th edition).