How Long Must You Keep Digital Answer Sheets? India's Legal Framework

A Question With No Single Answer

If a student files an RTI request for their answer sheet three years after the examination, must your university still have it? If the DPDP Act 2023 requires data minimisation, does keeping answer sheets longer than necessary create compliance risk? If a court stays a result, how long must you retain the specific answer scripts under litigation?

These questions do not have a single definitive national answer. Indian universities operate under a layered framework: central legislation, UGC regulations, state university acts, and individual institutional policies, all of which can produce different retention timelines for the same category of examination record. For digital evaluation systems in particular, where answer scripts exist as server-stored image files, the practical and legal stakes of getting this wrong are higher than in the paper era — because digital deletion is instantaneous and often irrecoverable.

This guide maps the relevant frameworks and offers a practical approach for examination controllers.

---

The RTI Act: Why 6 Months Is Not Enough

The Right to Information Act, 2005, does not specify retention periods for examination records. But the Supreme Court's 2011 ruling in CBSE v. Aditya Bandopadhyay established that students have a right to inspect their evaluated answer scripts. Universities across India have since been subject to RTI applications seeking access to graded answer books.

The implication: a university that deletes digital answer scripts before all potential RTI windows are exhausted faces legal exposure. Under Section 6 of the RTI Act, a citizen may file an application at any time. The practical standard adopted by many institutions — deleting scripts 6 months after result declaration — is too short in the context of:

A working retention floor for RTI compliance is 18 months from result declaration, allowing for revaluation, appeal, and RTI cycles to run their course before scripts are destroyed.

---

DPDP Act 2023: Data Minimisation Creates a Ceiling

The Digital Personal Data Protection Act, 2023, which began phased enforcement through 2025–2026, introduces the concept of storage limitation. Under Section 8(7), data fiduciaries — which includes universities that process student personal data — may retain personal data only as long as the purpose for which it was collected requires.

Answer scripts contain personal data: the student's handwriting, identity information, and academic performance. The DPDP Act requires that once the purpose of evaluation, revaluation, grievance redressal, and statutory compliance is served, the data should not be retained indefinitely.

This creates a ceiling that counteracts any tendency to keep digital records permanently because storage is cheap. Universities that retain answer scripts beyond the period needed for legal and institutional purposes may face compliance obligations under the Act, including responding to student data erasure requests under Section 13.

Key exception for litigation: The Act permits continued retention when required under any other law currently in force or in connection with a legal proceeding. If a student's script is the subject of a court stay, writ petition, or grievance pending before an ombudsman or tribunal, the script must be retained until the matter is finally disposed of, regardless of the standard retention period.

---

UGC and Institutional Policies: Significant Variation

The UGC has not issued a uniform national directive on examination record retention timelines. This leaves significant discretion to individual universities. The variation across institutions is substantial:

None of these institutional policies is required to align with the others, and none necessarily reflects the minimum required by the RTI Act interpretation above or the DPDP Act's storage limitation principle.

For affiliated colleges, the affiliating university's examination regulations take precedence over any internal college policy. Examination controllers at affiliated colleges should verify the retention timelines specified in their university's examination ordinance before configuring deletion workflows in their digital evaluation platform.

---

What Digital Systems Make Possible — and What That Responsibility Requires

In the paper era, answer sheet retention was constrained by physical reality. A medium-sized university examining 80,000 students per semester generates roughly 4–8 lakh individual answer scripts per year. Warehousing these at scale was expensive and logistically difficult, which created de facto pressure to destroy physical scripts relatively quickly.

Digital storage removes that pressure entirely. A full answer script image at 300 dpi, covering 12–16 pages per script, occupies approximately 3–6 MB. One lakh scripts occupy roughly 300–600 GB — the equivalent of a standard server disk array costing under Rs 15,000 per year in cloud storage.

This changes the legal calculus. A university cannot credibly claim storage limitations as justification for early deletion when the cost of retention is negligible. At the same time, a university that retains all digital answer scripts indefinitely without a structured retention and disposal policy is accumulating personal data beyond the DPDP Act's storage limitation principle.

The digital environment requires explicit, documented retention policies rather than the informal conventions that governed paper archives.

---

A Practical Retention Framework for Indian Universities

Based on the overlapping requirements above, a defensible university retention policy for digital answer scripts should include the following tiers:

---

Implementation Steps for Exam Controllers

Step 1: Document the policy formally. The retention framework should be approved by the Academic Council or Examination Board and published in the university's examination regulations. A policy in a Word file on the Controller of Examinations' desktop is not a policy.

Step 2: Map the policy to your digital evaluation platform. Most onscreen marking systems store answer script images on cloud or on-premise servers. Verify that the platform supports configurable retention periods by examination cycle, and that deletions require explicit authorisation rather than automatic expiry.

Step 3: Integrate with the RTI tracking register. When an RTI application is received citing specific examination records, those records should be flagged in the platform immediately to prevent automated deletion. This requires a workflow connection between the RTI cell and the examination technology team.

Step 4: Train evaluation centre staff on data categorisation. Staff processing answer scripts after evaluation should know the difference between a standard script (standard retention), a revaluation script (extended retention), and a malpractice-flagged script (indefinite hold). In digital systems, categorisation at the point of handling determines what retention rules apply.

Step 5: Audit annually. Conduct an annual review of retention compliance: confirm that scripts scheduled for deletion have actually been deleted, that litigation-flagged scripts have not been deleted, and that the policy is current with any changes to the RTI Act, DPDP Act notifications, or UGC directions.

---

The Special Case of OMR Sheets

OMR sheets used in objective examinations — different from handwritten answer scripts — are scanned, machine-read, and then the physical originals are typically destroyed. In digital evaluation workflows, the scanned image of the OMR sheet is the official record. The same retention framework applies.

However, a specific complication arises in cases where students challenge OMR grading results. Courts have in several cases ordered universities to preserve both the physical OMR sheet (if it still exists) and the digital scan. Universities that have already destroyed physical OMR sheets after scanning must ensure the scan image is of demonstrably archival quality — not a preview scan — and that the chain of custody from physical sheet to digital image is documented.

---

Why This Matters More in 2026

The DPDP Act's enforcement framework is becoming active. The appointment of the Data Protection Board is underway, and the first enforcement notices to educational institutions are anticipated. Universities that have not yet established clear data retention policies for examination records are operating without a documented compliance position.

Simultaneously, the CBSE onscreen marking experience of 2026 demonstrated that students, courts, and parliamentary committees are scrutinising digital examination systems with a level of attention that the physical era never attracted. The question is no longer whether digital evaluation will face regulatory and legal scrutiny. It already is. The question is whether your institution's data governance is ready to answer it.

---

Related Reading