A Practical Guide for CAs and Finance Teams
Backup of accounting data was earlier treated mainly as an internal best practice.
Accounting firms and finance teams advised clients to keep backups of Tally data, ERP records, Excel workings, scanned invoices and year-end files to avoid data loss and ensure continuity during audits, GST reconciliations, notices or business disruption.
That approach is no longer enough.
From 1 April 2026, the Income-tax Rules, 2026 are already in force. One important change which may still be missed by many businesses and professionals is the compliance requirement around electronic books of account.
Where books of account and prescribed documents are maintained in electronic mode, they must remain accessible in India at all times, and backup of such electronic books and documents must be kept on a daily basis on servers physically located in India.
This is a small line in the rule, but a significant change in practice.
Bookkeeping compliance is no longer limited to maintaining ledgers, vouchers and supporting documents. It now also includes how electronic books are backed up, where they are stored, whether they are accessible in India, and whether they can be restored when required.
The real shift
Bookkeeping today is largely electronic.
Even small and medium businesses maintain accounts through Tally, Busy, Zoho Books, Marg, Vyapar, ERP systems, POS software, Excel files, scanned documents, cloud folders or outsourced accounting systems maintained by CA firms.
So the real question is not whether books are electronic. In most cases, they already are.
The real question is whether those electronic books are properly controlled.
Earlier, weak backup was seen mainly as a business continuity risk. Now, for electronic books, it may also become a tax compliance risk.
Accounting data is not merely operational data. It is legal and financial evidence. If books are lost, corrupted or inaccessible, the business may face difficulty in income-tax assessments, GST notices, tax audits, bank finance, due diligence, internal reviews and business disputes.
Why tax audit cases need special attention
This requirement is relevant wherever books are required to be maintained and are maintained electronically. However, in tax audit cases, the matter becomes more direct because it enters the reporting framework.
From tax year 2026-27, tax audit reporting under the new framework will be in Form No. 26. Where books are maintained electronically, the auditor may have to report details relating to accounting software and electronic storage.
This may include:
- accounting software used,
- IP address and country of the server where accounting information is maintained,
- whether electronic books remain accessible in India,
- whether Rule 46(8) is complied with, and
- address of the India-located backup server.
This means server location and backup compliance are no longer only backend IT details. They can become tax audit reporting points.
Before reporting, professionals should obtain reasonable evidence from the client, software vendor, hosting provider or internal IT team.
Four practical controls to implement
This compliance can be handled practically through four simple controls.
1. Enable daily backup
Daily backup should be enabled for electronic books and key supporting records.
Merely using software that has a backup option is not enough.
Many accounting and ERP systems provide backup features, but unless the feature is actually enabled, scheduled and monitored, it does not create real compliance or protection.
The backup should preferably be automatic, time-stamped and not dependent only on one person manually copying files. Manual backup may fail due to oversight, staff absence, system change or lack of follow-up.
For local accounting software, backup can be configured at the system level. For cloud accounting software, the vendor’s backup mechanism should be understood. For ERP or custom software, the IT team should confirm the backup schedule.
The process should be designed around daily backup, and there should be evidence that the backup is actually running.
2. Confirm India-based backup storage
The backup must be kept on servers physically located in India.
If books are maintained on cloud, the cloud server and backup location should be verified.
If books are maintained locally, such as Tally on a desktop or office system, daily backup should still be arranged on an India-based server. This may be an office server, NAS or India-based cloud server, provided it is properly configured, secured and capable of restoration.
Only keeping backup on the same laptop, desktop, pen drive or external hard disk is a weak practice. Such copies may be useful as additional safety, but they should not be treated as a complete backup control.
Similarly, the statement “data is on cloud” is not enough. Cloud data can be hosted in India or outside India depending on the vendor and selected region. The actual server and backup location should be confirmed.
3. Keep evidence
Compliance should be capable of being demonstrated.
For tax audit clients and important non-audit clients, basic evidence should be maintained in the client file.
This may include:
- accounting software name,
- local / cloud / hybrid setup,
- backup frequency,
- backup location,
- confirmation that backup server is physically located in India,
- screenshot of backup settings,
- vendor or IT confirmation,
- sample backup log,
- management confirmation, and
- name of the person responsible for backup verification.
This need not become a full IT audit for every small client. But professionals should avoid relying only on verbal statements.
For cloud or hosted systems, vendor confirmation is important. For office server-based backup, internal documentation and responsible person confirmation should be maintained.
4. Test restore and retain data
A backup is useful only if it can be restored.
Periodic restore testing should be performed, especially for tax audit clients, ERP clients, large data clients and clients whose accounts are maintained by CA firms.
A simple restore test is sufficient in many cases. One sample backup can be restored in a separate folder or test environment to confirm that the data is readable and complete.
Retention is equally important.
Under the new framework, books and documents are required to be kept for seven tax years from the end of the relevant tax year. Therefore, the backup policy should ensure that old data is not overwritten or lost.
A practical retention approach may include daily operational backup, monthly backup snapshot, year-end accounting backup, year-end supporting documents archive, and final audit or tax records.
Practical checklist for immediate use
CAs, finance teams and accounting firms can start with this simple checklist:
Daily backup
- Daily backup feature enabled, not merely available
- Backup preferably automatic and scheduled
- Backup covers accounting data and key supporting records
- Backup log or proof periodically reviewed
India-based storage
- Backup stored on server physically located in India
- Cloud region or server location confirmed
- Office server / NAS documented where used
- Backup stored separately from the main system
Access and security
- Access restricted to authorised persons
- Backup protected from accidental deletion or alteration
- User controls and passwords implemented
- Access removed when staff leave
Evidence
- Vendor / IT confirmation obtained
- Backup settings screenshot maintained
- Backup log or proof preserved
- Responsible person identified
Restore and retention
- Restore testing done periodically
- Year-end backup archived
- Data retained for required period
- Old data not overwritten without review
Where books are maintained by a CA firm or outsourced accounting team, the same checklist should be applied internally. Client-wise accounting data should be backed up daily, access should be restricted, year-end backups should be archived separately, and client confidentiality should be protected.
Conclusion
Backup of accounting data was earlier seen mainly as a good internal practice.
Now, for electronic books, it is a compliance checkpoint.
The practical message is clear:
Electronic books should be accessible in India, backed up daily, stored on servers physically located in India, and capable of being restored when required.
This change is not about complicating compliance. It is about recognising that modern books of account are digital records, and digital records need proper backup, location control and recovery discipline.
For CAs and finance teams, this is the right time to update bookkeeping review checklists, tax audit planning procedures and client advisory formats.
Professionals who understand this shift early will be better positioned to guide clients in the new tax compliance environment.
Disclaimer: This article is for professional awareness and discussion. Readers should refer to the applicable provisions of the Income-tax Act, 2025, Income-tax Rules, 2026, notified forms, FAQs and professional guidance before taking any final position.
CAclubindia
