Zoho Books and Rule 46(8): Where Your Books Are Actually Stored
From 1 April 2026, electronic books must stay accessible in India with daily backups on Indian servers. What Rule 46(8) means if you run Zoho Books, and how to check.
Quick answers. Rule 46(8) requires electronic books to stay accessible in India with a daily backup on India-located servers, from 1 April 2026. It covers anyone maintaining books under Section 62 or liable to audit under Section 63. Your auditor must now report the software name, storage service, server IP address, country and backup server address in Form No. 26. Penalty is ₹25,000 on the taxpayer under Section 441, and ₹10,000 on an auditor certifying wrongly.
Choosing software used to be an operational decision
For twenty years, picking accounting software was a question of price, feel and whether your accountant already knew it. Nobody put the answer in a statutory form.
That changed on 1 April 2026. The Income-tax Rules 2026, notified by Notification No. 22/2026 [GSR 198(E)] on 20 March 2026, brought in Rule 46(8), and the redesigned tax audit report asks your auditor to name your software, state the IP address of the server your books sit on, and name the country. Rule 46(8) is now something you can fail.
What is Rule 46(8)?
Rule 46(8) of the Income-tax Rules 2026 requires that books of account maintained in electronic form remain accessible in India at all times, and that a backup of those books be maintained on servers physically located in India and updated at the close of every business day.
Rule 46 as a whole prescribes the books to be kept under Section 62 of the Income-tax Act 2025. Sub-rule (8) is the part that deals with electronic records specifically.
Two obligations sit inside it and they are separate. Accessibility is about being able to produce the records in India on demand. Daily backup is about a complete copy existing on Indian soil at the end of each working day.
Key terms explained
- Books of account: defined in Section 2(19) of the Income-tax Act 2025 to include ledgers, day books, cash books and other books, whether kept manually, digitally, or as printouts of digital data.
- Accessible in India: retrievable from within India at any time. A licence that expires, a vendor account that is suspended, or data locked behind an overseas administrator can all break this.
- Daily backup: a copy taken at the close of each business day. Frequent but irregular backups do not satisfy the rule.
- Form No. 26: the audit report and statement of particulars under Section 63, prescribed by Rule 47. It consolidates the erstwhile Forms 3CA, 3CB and 3CD into one form.
- Data centre region: the physical location where your cloud vendor stores your organisation’s data. For most cloud accounting products this is fixed when the account is created and cannot be changed later without a fresh organisation.
Who this applies to
You are covered if you fall under Section 62 of the Income-tax Act 2025, which prescribes who must keep books, or under Section 63, which prescribes who must get accounts audited.
Under Rule 46, specified professionals including legal, medical, engineering, architectural, company secretary and information technology professionals must maintain prescribed books where gross receipts exceed ₹1,50,000 in any one of the three preceding tax years.
Individuals and Hindu Undivided Families carrying on business are covered where income exceeds ₹2,50,000 or turnover exceeds ₹25,00,000 in any one of the three preceding years. Companies and LLPs are covered as a matter of course. Foreign companies with a permanent establishment in India are covered to the extent of books relating to Indian operations.
There is no size exemption inside the rule itself. If you are required to keep books and you keep them electronically, Rule 46(8) applies to you.
What Form No. 26 asks your auditor
The books of account clause in Form No. 26 requires the tax auditor to state:
- the name, and where applicable the version, of the accounting software used
- the name of any cloud storage or other software used to store the books
- the location, with IP address and country, where that storage sits
- the address of the India-located backup server
- whether Rule 46(8) has been complied with
Read that list again from the auditor’s side. Your auditor cannot sign it from memory. They will ask you for a technical confirmation from your software vendor, and the sensible firms are already updating their engagement letters to say so. If you are unclear on who falls into tax audit, start there before worrying about server addresses.
The practical check, step by step
Step 1: Identify where your organisation actually lives. For Zoho, log in and read the address bar. If it says books.zoho.in your organisation is in the Indian data centre. If it says books.zoho.com it is in the United States. The same logic applies to any cloud product: find the region, not the head office.
Step 2: Get it in writing from the vendor. Ask for a written confirmation of the primary data centre location and the backup location. Your auditor needs a document, not a screenshot of a URL.
Step 3: Decide whether the primary or only the backup needs to move. The rule requires accessibility in India and a daily backup in India. If your primary instance is offshore, the cleanest answer is usually an India-region backup destination rather than a full migration, but check that the backup is genuinely a complete restorable copy.
Step 4: Fix the backup schedule to a day-end cut-off. Pick a time, write it into an internal policy, and run it at that time every working day. Businesses running across time zones should document the cut-off they have chosen.
Step 5: Keep a timestamped backup log. Date, time, file size and destination server for each backup event. This log is your evidence if an Assessing Officer asks whether the daily requirement was met.
Step 6: Confirm the audit trail is on and cannot be disabled. For companies this is a separate obligation under Section 128(1) of the Companies Act 2013 read with the MCA notification dated 31 March 2022, and your statutory auditor reports on it independently of the income tax position.
Step 7: Hand the pack to your auditor before the audit starts. Vendor confirmation, backup policy, backup log, and the software name and version. Doing this in March saves a fortnight in September.
What you need on file
- Written vendor confirmation of primary and backup data centre locations
- Internal backup policy stating the day-end cut-off
- Timestamped backup log for the year
- Software name and version
- Audit trail configuration evidence (companies and LLPs)
- Restoration test note, showing a backup was actually restored at least once
The position at a glance
| Item | Requirement from 1 April 2026 |
|---|---|
| Governing rule | Rule 46(8), Income-tax Rules 2026 |
| Notified by | Notification No. 22/2026 [GSR 198(E)], 20 March 2026 |
| Accessibility | Books in electronic form accessible in India at all times |
| Backup frequency | Daily, at the close of each business day |
| Backup location | Server physically located in India |
| Audit report | Form No. 26 under Rule 47, Section 63 |
| Penalty on taxpayer | ₹25,000 under Section 441 |
| Penalty on auditor for wrong certification | ₹10,000 |
| First audit reports covering it | Tax Year 2026-27 |
Four mistakes worth avoiding
- Assuming an Indian vendor means Indian storage. The organisation was created on the .com domain years ago and nobody checked. Read the URL, then confirm in writing.
- Treating “we back up to the cloud” as compliance. The bucket is in Singapore or Virginia and the backup requirement is not met. Map the backup destination explicitly to an Indian region.
- Weekly or “continuous” backups without a day-end copy. No single point-in-time copy exists for a given business day. Fix a cut-off and log it.
- Migrating the organisation in October. You lose audit trail continuity mid-year and create a second set of opening balances. Plan any region change for a year boundary, and get an accounting health check first if the file is already messy.
Penalties and consequences
Failure to keep and maintain books of account as required attracts a penalty of ₹25,000 under Section 441 of the Income-tax Act 2025.
An auditor who certifies compliance with Rule 46(8) in Form No. 26 without proper verification faces a penalty of ₹10,000.
Beyond the fixed penalties, non-compliance exposes the taxpayer to best-judgment assessment, because records that cannot be produced or verified may be rejected as evidence of income and expenditure.
Where electronic records are relied upon in proceedings, Section 63 of the Bharatiya Sakshya Adhiniyam 2023, which replaced Section 65B of the Indian Evidence Act, requires a certificate signed by a responsible official confirming the computer was in regular use. Weak backup discipline undermines that certificate.
How these provisions interact
Rule 46(8) of the Income-tax Rules 2026 prescribes the storage standard, while Rule 47 and Form No. 26 create the disclosure mechanism that makes non-compliance visible to the department in the year it happens.
Section 128(1) of the Companies Act 2013 read with the MCA notification dated 31 March 2022 imposes an audit trail requirement on companies that is separate from Rule 46(8), so a company can satisfy one and fail the other.
Section 441 of the Income-tax Act 2025 supplies the penalty for failure to maintain books, and it operates independently of any addition to income that a best-judgment assessment under the same Act may produce.
Zoho Books against the requirement
| Requirement | What to verify in Zoho Books |
|---|---|
| Accessible in India | Organisation on the .in domain, active subscription, Indian admin with full rights |
| Daily India backup | Vendor confirmation of India-region storage plus a scheduled export retained on an Indian server |
| Audit trail | Enabled at organisation level and not disabled for any user role |
| Software name and version for Form No. 26 | Product name and edition, taken from the vendor confirmation |
| Restorability | A test restore performed and documented once in the year |
The wider software choice is a separate question. If you are still deciding, we have compared cloud versus desktop on the practical points, and if you already run Tally, moving a Tally file into Zoho Books sets out what a clean migration involves. If you bill on subscription, how subscription revenue should be recognised is the other thing your auditor will ask about.
Key takeaways
- Rule 46(8) of the Income-tax Rules 2026 requires electronic books of account to remain accessible in India at all times and to be backed up daily on servers physically located in India, with effect from 1 April 2026.
- Form No. 26, the tax audit report prescribed under Rule 47 for Section 63 audits, requires the auditor to disclose the accounting software name, the cloud storage used, the server IP address and country, and the India-located backup server address.
- Failure to maintain books as required attracts a penalty of ₹25,000 under Section 441 of the Income-tax Act 2025, and an auditor certifying compliance without verification faces a penalty of ₹10,000.
- The fastest practical check for a Zoho Books user is the domain in the address bar, because books.zoho.in places the organisation in the Indian data centre while books.zoho.com does not.
Frequently asked questions
Q: What is Rule 46(8) of the Income Tax Rules 2026?
A: It requires books of account kept in electronic form to remain accessible in India at all times, with a daily backup maintained on servers physically located in India.
Q: Do I really need my accounting data on an Indian server?
A: The backup must be in India. The rule is framed around accessibility in India plus an India-located daily backup, rather than a blanket ban on offshore primary storage.
Q: Is Zoho Books compliant with Indian data rules?
A: It can be, provided your organisation sits in the Indian data centre. Check whether your URL reads zoho.in or zoho.com, then get written confirmation from the vendor for your auditor.
Q: What is Form No. 26?
A: Form No. 26 is the audit report and statement of particulars under Section 63 of the Income-tax Act 2025, prescribed by Rule 47. It replaces the earlier Forms 3CA, 3CB and 3CD.
Q: What is the penalty for not keeping daily backups?
A: ₹25,000 under Section 441 of the Income-tax Act 2025 for failure to maintain books as required, with a separate ₹10,000 penalty on an auditor who certifies compliance incorrectly.
Q: Does Rule 46(8) apply to small businesses?
A: It applies to anyone required to maintain books under Section 62 who keeps them electronically. There is no separate small business exemption inside the rule, though businesses below the book-keeping thresholds are outside it.
Q: What is the difference between zoho.in and zoho.com?
A: They are different data centre regions for the same product. The .in domain places your organisation’s data in India, which is what matters for this rule.
Q: Is a backup on AWS Singapore acceptable?
A: No. The rule requires the backup server to be physically located in India, so an offshore region does not satisfy it however reliable it is.
Q: Who has to maintain books under Section 62?
A: Specified professionals above ₹1,50,000 of gross receipts in any of the three preceding years, and individuals and HUFs in business above ₹2,50,000 of income or ₹25,00,000 of turnover, along with companies and LLPs.
Q: Does the audit trail requirement apply to LLPs?
A: The MCA audit trail notification is framed for companies under the Companies Act 2013. LLPs should still expect the accessibility and backup expectations of Rule 46(8) to apply to their books.
If you want this checked properly
Most businesses will pass this with an afternoon of work, a vendor letter and a scheduled export. The ones that will not are those whose organisation was set up on the wrong region years ago, and that is a decision better made before the year closes than during the audit.
Our Zoho Books setup and monthly close work includes confirming the data centre region and putting the backup evidence pack together for your auditor. If the file itself needs attention first, an accounting health check tells you what is wrong before you touch anything.