Indian HR teams are operating under the heaviest documentation load the profession has carried in a decade. The four Labour Codes took effect on 21 November 2025, consolidating 29 central statutes into a unified regulatory framework. The DPDP Rules, notified on 14 November 2025, extended data-protection duties over every PAN, Aadhaar, salary line and performance note sitting on an HR server.
A single missing nomination form, an unfiled POSH annual report, or a wage register running on last year’s state format can now trigger inspection notices, District Officer scrutiny, or a Data Protection Board inquiry.
The practical question for HR is which papers prove compliance when an inspector, a court, or a data regulator asks for them. The checklist below works backwards from that moment.
The Statutory Register Core
A core set of registers sits at the base of every covered establishment’s compliance file. The Code on Wages, 2019, and the Occupational Safety, Health and Working Conditions (OSH) Code, 2020, have now replaced what state Shops and Establishments formats used to split across six or seven separate books.
Rule 51(1) of the Code on Wages (Central) Rules, 2026, permits each of them to be maintained electronically, provided it is digitally authenticated.
| Register | What It Captures | Governing Provision | Retention |
|---|---|---|---|
| Register of Employees (Form I) | Name, UAN, date of joining, designation, wage rate, PF/ESI numbers, bank details | OSH Code, Section 33; Code on Wages, Section 50 | 5 years |
| Attendance Register cum Muster Roll (Form IX) | Daily attendance, in/out time, overtime, shift, place of work | Code on Wages, Section 50; Rule 51(1), Central Rules 2026 | 5 years |
| Wage Register (Form IV) | Wage period, components, deductions, net paid, date of payment | Code on Wages, Section 50 | 5 years |
| Register of Deductions, Fines and Damages | Lawful deductions, recoveries and advances | Code on Wages, Section 50 | 5 years |
Section 50(2) adds a display obligation: a notice board carrying the abstract of the Code, category-wise wage rates, wage period, date of payment and the name and contact of the Inspector-cum-Facilitator.
Wage slips in Form V must be issued to each employee on or before the day wages are paid. A single statutory annual return now replaces most of the 30-plus returns HR teams were previously filing.
Employment Lifecycle Documents
Beyond statutory registers, every employee file must document the full arc from offer to exit. The OSH Code made written appointment letters mandatory across formal and non-formal sectors, closing a long-standing gap where millions worked without written terms. Documentation thins out quickly after the first week on the job, and that’s where most audit findings begin.
Onboarding Records
The joining file sets the pattern for everything downstream, and most audit findings against mid-sized Indian employers trace back to gaps created in the first ten days of employment. A clean onboarding dossier carries the following, each dated and acknowledged:
- Signed offer letter and appointment letter with wage structure aligned to the Code on Wages definition (basic plus DA capped at 50% of total remuneration)
- PAN, Aadhaar (with explicit DPDP consent for processing), bank details and photographs
- Education and employment verification records, with the vendor data-processing agreement on file
- EPF Form 11 (new joinee declaration) and Form 2 (nomination for PF and EDLI)
- ESI declaration where wages fall within the ₹21,000 monthly ceiling
- Nomination for gratuity under the Code on Social Security
- Signed acknowledgements of the leave policy, POSH policy, code of conduct and DPDP consent notice
Our guide to PF, ESI, PT and TDS payroll compliance walks through the first-month filings in sequence, and the background verification and DPDP compliance walkthrough covers vendor documentation specifically.
Active-Employment Records
The ongoing file grows month on month, and most of it will be requested by name during an inspection or a labour court matter. Each thread needs to stay live and dated, because a gap of even one wage period creates a reconciliation problem that compounds over the year:
- Monthly salary slips and TDS computations, reconciled to the wage register
- Leave balances, LWP, and comp-off ledgers
- Performance review records, PIPs and training attendance
- Transfers, promotions and compensation revisions, each with a dated letter
- Disciplinary proceedings, show-cause notices and employee replies
- Overtime slips tied to the muster roll
Exit Records
A clean exit file protects the organisation from employment-tribunal claims and from PF or gratuity demands raised years after the fact. The file closes the employment relationship on paper, and anything missing here resurfaces when a former employee files a complaint or when an EPFO query lands:
- Resignation letter and acceptance correspondence
- Full-and-final settlement sheet, including gratuity, leave encashment and bonus accruals
- PF withdrawal or transfer evidence (Form 19, 10C, 31)
- Relieving letter, experience certificate and no-dues confirmation
- Exit interview record and asset return log
- Data access revocation and NDA reaffirmation where applicable
POSH and Policy Documents
POSH compliance leaves a paper trail that District Officers verify independently of HR self-reporting. Section 21 of the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 requires every Internal Committee to prepare an annual report in the prescribed form and submit it to the employer and the District Officer each calendar year.
Section 26 attaches a penalty of up to ₹50,000 for failure to file, failure to constitute the IC, or failure to act on its recommendations, with doubling and licence cancellation on repeat offences.
The POSH audit file that must be ready on request:
- IC constitution order naming Presiding Officer, members and external member (our note on IC composition, tenure and external members covers the statutory structure)
- Signed POSH policy acknowledgement from every employee, including contract staff
- Annual training and awareness session records with attendance sheets
- Complaint register, including nil returns
- Minutes of IC meetings and inquiry reports (with Section 16 confidentiality safeguards)
- Section 21 annual report, with filed-proof from the District Officer
- Board/Directors’ Report disclosure under Section 22 for incorporated employers
Alongside POSH, the standing policy library every HR function must version-control includes the code of conduct, leave and attendance policy, grievance redressal policy, anti-discrimination policy, whistleblower policy (statutory for listed companies under Section 177 of the Companies Act, 2013), and information-security policy. An unacknowledged policy is close to no policy at all when a labour court or an IC asks for proof of communication. Our POSH policy checklist lays out the drafting pointers.
DPDP Act Documents
The DPDP Rules, 2025, triggered an 18-month phased compliance window that reached full enforcement by May 2027. HR holds the largest concentration of personal data in most Indian organisations, running from salary and biometric records to performance notes, medical declarations and family-member details for insurance.
Priority items in that build-out:
- Standalone consent notices in clear, plain language (Rule 3), available in English or any Eighth Schedule language the employee reads
- Record of consents obtained and withdrawals, time-stamped
- Data retention schedule mapped to the “legitimate uses” basis under Section 7 (which covers most routine employment processing without separate consent)
- Data processor agreements with payroll, benefits, LMS, EAP, insurance and background verification vendors
- Personal data breach register, with the two-stage notification evidence required under Rule 7
- Grievance officer appointment order and complaint log
Our full read of the Act and its implications for HR is in what every HR leader should know about the DPDP Act.
The Audit-Ready Retention Map
A single master index, reviewed quarterly, is what separates an audit-ready HR function from one scrambling through drives when an inspector arrives. The retention periods below are the current statutory minima. Internal retention schedules can run longer than these for business-record reasons.
| Document | Governing Law | Minimum Retention |
| Wage, attendance, deductions, overtime registers | Code on Wages, 2019; Rule 51(4) | 5 years from last entry |
| PF, EPS and ECR records | EPF & MP Act, 1952 (practice-based) | 5 to 7 years |
| ESI records, including Accident Book | ESIC Regulations, Rules 32, 66, 102-A | 5 years |
| Minimum wage records (state sphere) | Minimum Wages Central Rules, 1950, Rule 26A | 3 years |
| POSH IC records and annual reports | POSH Act, Section 21 | Indefinite as practical minimum |
| TDS and income tax records | Income Tax Act, 1961, Section 44AA | 6 years from the relevant assessment year |
| Appointment letters and personnel files | OSH Code, 2020 | Term of employment + 5 years |
| DPDP consent, retention and breach logs | DPDP Act, 2023; Rules 2025 | For the life of processing + 3 years |
In the End…
Documentation holds up only when it’s tested the way an inspector would test it. A quarterly internal gate, run by HR with legal and finance in the room, is the simplest working mechanism: pull three random employee files, two wage periods, the POSH IC order, the current DPDP consent notice, and the data breach register, then verify that each one ties cleanly to the governing provision.
Gaps flagged in that review go into a thirty-day remediation calendar with named owners. The organisations that cleared the Labour Code transition cleanly weren’t the ones with the thickest policy libraries. They were the ones whose documents worked when they were asked for.
