Tax Audit under Income Tax Act 2025
                     Tax Audit under Income Tax Act 2025: Do You Know Physical Location & IP Address of Your 
Financial Data?
The transition from the existing Tax Audit formats (Forms 3CA/3CB/3CD) to the proposed Form 
No. 26 under the Income-tax Act, 2025 introduces significant changes in digital data 
governance and audit transparency. Effective from Tax Year 2026–27, the audit framework 
places renewed emphasis on data sovereignty, traceability, and jurisdictional control over 
financial records. Based on an analysis of the Draft Rules, businesses now face a rigorous 
two-fold compliance mandate concerning electronic books of account.
1. The Disclosure Requirement – Form No. 26 The proposed Form 26 moves beyond generic 
statements that books are maintained in “computerized” form. If books of account are 
maintained using cloud-based software or digital platforms, the auditor must specifically 
disclose: The IP Address of the storage server, and The Country where the data is physically 
stored. This marks a fundamental shift in tax audit reporting. The audit will no longer be 
limited to verifying accounting entries — it will also certify the digital location of financial 
data. Accordingly, businesses using ERP systems, SaaS platforms, or cloud hosting solutions 
must be capable of identifying and substantiating their server location and digital storage 
infrastructure.
2. The Substantive Mandate – Draft Rule 46(8) Beyond disclosure, the Draft Income Tax Rules, 2026 introduce a 
binding compliance requirement under Rule 46(8). The rule provides: “The books of account and other 
documents specified in sub-rules (1), (4) and (6) maintained in electronic mode shall remain accessible in 
India at all times, and the back-up of such books of account and other documents maintained in electronic 
mode, shall be kept in servers physically located in India, and shall be updated on a daily basis.” This 
requirement has three clear components: Continuous accessibility in India Back-up servers physically 
located in India Daily updating of such records The mandate effectively embeds data localization within the 
income-tax compliance framework. It is not merely procedural — it is structural.
Broader framework of Rule 46 – Maintenance of Books under Section 62 To understand the scope of Rule 46(8), 
it is necessary to examine the broader framework of Rule 46: Rule 46(1)
Rule 46(1) Every person required to maintain books under section 62(1) of the Act must maintain such books and documents as enable the 
Assessing Officer to compute total income under the Act. Rule 46(4) – Mandatory Books of Account The prescribed books include: A cash 
book A journal (where mercantile system is followed) A ledger Copies of bills or receipts issued for sums ≥ ₹250 Original bills/receipts for 
expenditure ≥ ₹250 Payment vouchers where expenditure does not exceed ₹250 and adequate particulars are not recorded in the cash 
book Rule
 46(6) – Additional Requirement for Medical Professionals
In addition to the above: A daily case register in Form No. 25 Inventory (opening and closing) of drugs, medicines and consumables
Rule 46(8) – Electronic Maintenance Where these books are maintained electronically: They must remain accessible in India at all times 
Back-ups must be stored on servers physically located in India Data must be updated daily This provision applies to all categories of 
prescribed books under sub-rules (1), (4) and (6).
Compliance Implications for Businesses The implications are immediate and significant. Organizations using: Global ERP platforms Overseas 
cloud infrastructure Multi-region server architecture International SaaS accounting solutions must verify whether: Their primary and 
backup servers are physically located in India Data remains continuously accessible within Indian jurisdiction Systems are configured for 
daily updates Vendor contracts support compliance certification This is no longer an IT preference — it is a statutory requirement.
Governance and Risk Perspective The new framework reflects a broader policy shift towards:
Strengthening digital sovereignty Enhancing audit transparency Ensuring jurisdictional control over financial records 
Reducing dependency on offshore data infrastructure From Tax Year 2026–27 onward, tax audits will intersect directly 
with IT governance and cloud architecture decisions. Conclusion The proposed Form 26 and Draft Rule 46(8) 
fundamentally redefine tax audit compliance in India. The question for businesses is no longer limited to: Are our books 
accurate? It now extends to: Do we know the physical location and IP address of our financial data? CFOs, CIOs, and tax 
heads must act proactively to assess infrastructure readiness before the new regime becomes operational.
Read more at: https://taxguru.in/income-tax/tax-audit-physical-location-ip-address-financial-data.html
Copyright © Taxguru.in