Last reviewed: 20 August 2026. A new provision buried in the Income-tax Rules, 2026 — Rule 46(8) — is about to change how every business and professional maintaining electronic books of account handles backups. From FY 2026-27, a daily backup on a server physically located in India is not good IT hygiene anymore; it is a statutory requirement your tax auditor has to certify in the new Form No. 26. Most accounting teams we have spoken to have never separately configured an India-region backup for their cloud software — this post sets out exactly what changes, who it hits hardest, and what to fix before your FY 2026-27 audit.
What Rule 46(8) actually requires
Strip away the commentary and the rule does three things. First, it says that where books of account are maintained in electronic form under Section 62 of the Income-tax Act, 2025, a backup of those records must be taken every day. Second, it says that backup copy must sit on a server that is physically located in India — your primary software or hosting can remain wherever it already is (a global AWS region, a vendor's own servers abroad, a local desktop installation), but the backup leg specifically has to be India-based. Third, it says the electronic records must remain accessible in India at all times, which reads as a data-availability requirement on top of the storage-location requirement.
None of this forces a business to change its accounting software or migrate its primary system to an Indian data centre. It forces a specific, verifiable backup configuration — and it forces your auditor to go looking for evidence of it.
Who this covers — and why "audit-only" is the wrong read
Section 62 duty to maintain books is broader than the tax-audit population. Rule 46(8) is written against that broader base, which means a small proprietorship keeping its books on Tally or Zoho Books — with no tax-audit obligation at all — is still within the letter of the rule if those books are electronic. Where the rule bites hardest in practice is the Section 63 tax-audit band, because that is where an external auditor now has to actively certify backup compliance:
| Category | Tax-audit threshold (Section 63) | Rule 46(8) exposure |
|---|---|---|
| Business (normal) | Turnover exceeds Rs 1 crore | Auditor certifies backup compliance in Form No. 26 |
| Business (mostly digital) | Turnover up to Rs 10 crore, if cash receipts and cash payments are each within 5% of total transactions | Same certification, larger digital footprint to secure |
| Professionals | Gross receipts exceed Rs 50 lakh | Same certification requirement |
| Below audit thresholds but books kept electronically | No tax audit triggered | Section 62 backup duty still technically applies; no third-party certification, but records remain exposed if challenged |
Form No. 26: the new certification your auditor will ask about
Current professional commentary describes Form No. 26 as the FY 2026-27 tax-audit reporting form under the Income-tax Act, 2025 framework, taking over from the familiar Forms 3CA, 3CB and 3CD. Beyond the usual audit particulars, it asks the auditor to record:
- The name of the accounting software or ERP in use (Tally, Zoho Books, QuickBooks, SAP, Oracle, or otherwise)
- The server IP address and the country where the primary server is located
- The India-based backup server's address/location
- An explicit yes/no compliance confirmation on the daily-backup requirement
For auditors, this converts a background IT question into a documented audit assertion — get the vendor confirmation in writing well before finalisation, not on signing day. For businesses, it means your accountant or IT vendor should expect this question from your CA this year, possibly for the first time.
What "India-located backup server" means for common setups
Worked example 1 — desktop Tally, single office. An SME running Tally on a local office PC, with data backed up manually to a pen drive or an occasional email to the owner, is not compliant: there is no verifiable daily backup on an identifiable India-located server. The fix is inexpensive — a scheduled daily backup job to an India-hosted NAS, an Indian cloud storage account, or Tally's own India-hosted backup service, with a log that shows it actually ran.
Worked example 2 — cloud accounting, foreign default region. A startup on Zoho Books or QuickBooks Online, provisioned on a default global/US/Singapore data region, is commonly compliant on the "primary hosting can be anywhere" limb but non-compliant on the backup limb, because the platform's automatic backups usually replicate within the same region as the primary account. The practical fix is to enable the platform's India data-residency or India-region backup option where available, or to run a scheduled export/API pull into an India-hosted storage account as a parallel backup, and retain the configuration proof for the auditor.
Penalty and downstream risk
| Trigger | Reported penalty | Who bears it |
|---|---|---|
| Failure to maintain the prescribed daily backup on an India server | Rs 25,000 | The assessee |
| Incorrect compliance certification in Form No. 26 | Rs 10,000 | The tax auditor |
| Records challenged in assessment | Best-judgment assessment risk; records may be discounted as evidence | The assessee |
There is a commercial angle too: lenders and investors increasingly ask for clean digital records during due diligence, and an audit qualification on data-backup compliance is not a good look on a CMA data pack or an investor data room.
Action checklist before your FY 2026-27 audit
- List every system holding statutory electronic records — accounting software, GST/e-invoicing tools, payroll, inventory — and where each is physically hosted.
- Confirm with each vendor whether daily backup already routes to an India server; if not, enable the India-region option or configure a parallel export.
- Get the India backup server's address/location in writing from the vendor — this is the exact data point Form No. 26 asks for.
- Set a backup log or notification so failures are caught same-day, not discovered at audit time.
- Brief your CA at the start of the audit cycle, not at finalisation, so the certification is built on evidence rather than assumptions.
Our practical position
The rule number, thresholds and penalty figures above reflect the consistent reading across current professional commentary on the Income-tax Rules, 2026; we have not independently sighted the CBDT gazette text in preparing this note. Treat the substance — daily backup, India server location, Form No. 26 disclosure — as the direction of travel and confirm the final wording and effective date with us or your auditor before relying on it for a specific compliance certification, especially if your accounting data currently sits entirely outside India.
Frequently asked questions
What is Rule 46(8) of the Income-tax Rules, 2026?
Rule 46(8) is a new rule under the Income-tax Rules, 2026 (framed under the Income-tax Act, 2025) that requires every person maintaining books of account electronically under Section 62, including those subject to tax audit under Section 63, to take a daily backup of those electronic records on a server physically located in India. The primary accounting system can still be hosted anywhere in the world; it is the backup copy that must sit on an India-located server and remain accessible in India at all times.
From when does Rule 46(8) apply?
Professional commentary and practitioner reading of the notification place the effective date at 1 April 2026, i.e. FY 2026-27 (AY 2027-28), aligning with the broader rollout of the Income-tax Act, 2025. Businesses should confirm the exact commencement date against the final gazette notification and their tax auditor's guidance before treating any earlier period as covered.
Who is covered — does a small proprietorship also need this?
The rule text extends to anyone maintaining books of account under Section 62, which is a broader class than just tax-audit cases. In practice, the compliance pressure is sharpest for entities also covered by Section 63 tax audit — businesses with turnover above Rs 1 crore (Rs 10 crore where cash receipts and cash payments are each within 5% of total transactions) and professionals with gross receipts above Rs 50 lakh — because their auditor now has to certify backup compliance in Form No. 26. Smaller businesses maintaining electronic books voluntarily (say, on Tally or Zoho Books) fall within the letter of Section 62 even without an audit obligation, so treating this as an audit-only rule is a common but risky misreading.
We use cloud accounting software hosted outside India — are we automatically non-compliant?
Not automatically. The rule does not require your primary accounting data or your software vendor's servers to be in India — global hosting (AWS, Azure, Google Cloud, or a vendor's own servers abroad) is not itself a violation. What it requires is a daily backup copy that is stored on a server physically located in India and accessible from India at all times. Many cloud platforms let you configure a region-specific backup or export routine; the compliance gap is usually that this backup leg was never separately configured, not that the primary software choice is wrong.
What is Form No. 26 and how is it different from Forms 3CA/3CB/3CD?
Form No. 26 is described in current professional commentary as the tax-audit reporting form applicable from FY 2026-27 under the Income-tax Act, 2025 framework, replacing the erstwhile Forms 3CA, 3CB and 3CD. Alongside the usual audit particulars, it requires the auditor to report the accounting software used, the server IP address, the country where the primary server is located, the India-based backup server address, and an explicit compliance confirmation on the daily-backup requirement. Auditors should treat this as a new line of audit evidence to gather up front, not a box to tick at signing.
What happens if we don't comply?
Reported penalty exposure is Rs 25,000 for failure to maintain the prescribed daily backup on an India-located server, and Rs 10,000 against the auditor for an incorrect compliance certification. Beyond the monetary penalty, non-compliant electronic records risk being questioned as evidence in assessment or scrutiny proceedings, which can expose an entity to a best-judgment assessment under the Act. Businesses relying on digital records to support GST reconciliation, loan applications or investor due diligence also carry a practical risk of those records being challenged if the backup trail isn't in order.
What should we do before the FY 2026-27 audit cycle starts?
Four steps cover most of the practical gap: (1) list every system that holds statutory books electronically — accounting software, GST/e-invoicing tools, payroll — and note where each is hosted; (2) turn on or configure a daily automated backup routing to an India-based server or Indian data-centre region of your cloud provider; (3) get written confirmation from each software vendor of the India backup server's location and retention policy, since this is exactly what your auditor will ask for; (4) brief your CA early so the compliance check is built into audit planning rather than discovered at signing.
We help businesses configure compliant bookkeeping, cloud accounting and CFO reporting, and prepare tax-audit documentation end to end.
Bookkeeping services Accounting automation Tax audit services Talk to usThis article is for general guidance on a newly reported provision of the Income-tax Rules, 2026 and reflects our understanding as of 20 August 2026. It is not a substitute for professional advice on your specific facts, and figures should be confirmed against the final notified text before being relied upon for compliance certification. Related reading: Tax Audit under Section 44AB: Limits and Due Date and Documents Required for Tax Audit: The 3CD Data Pack.