Digital Sovereignty and Data Localization: Analyzing the Impact of Draft Rule 46 and Form No. 26 on Electronic Records
The landscape of fiscal compliance in India is poised for a structural transformation with the introduction of the proposed Income-tax Act, 2025. As regulatory frameworks evolve to keep pace with the digitization of commerce, the tax authorities are shifting their focus from merely verifying financial outcomes to scrutinizing the digital infrastructure that houses financial data. This paradigm shift is most evident in the transition from the traditional Tax Audit formats (Forms 3CA/3CB/3CD) to the newly proposed Form No. 26.
Effective from the Tax Year 2026–27, the new audit regime introduces stringent mandates regarding data sovereignty, real-time accessibility, and the jurisdictional location of servers. Based on a comprehensive review of the Draft Rules, specifically Draft Rule 46, assessees must prepare for a rigorous compliance environment that intertwines Information Technology (IT) architecture with statutory tax obligations.
The New Reporting Paradigm: Form No. 26
Under the existing regime, assessees often provide generic affirmations regarding the maintenance of books of account in a computerized environment. However, the proposed Form No. 26 seeks to eliminate ambiguity by requiring granular disclosures concerning the physical whereabouts of digital data.
If an assessee maintains books of account utilizing cloud-based software, Enterprise Resource Planning (ERP) systems, or other digital platforms, the auditor is required to explicitly report:
- The IP Address of the server where the data is stored.
- The Country in which the data is physically hosted.
Implications for Cloud-Native Businesses
This disclosure requirement signifies a fundamental departure from legacy audit practices. Previously, the audit function was primarily concerned with the accuracy of accounting entries and adherence to accounting standards. Under the new framework, the audit scope expands to certify the digital location of the financial records.
For assessees relying on global SaaS (Software as a Service) platforms or hosting solutions where data may be sharded across multiple international jurisdictions, this requirement poses a significant identification challenge. Businesses must now possess the capability to substantiate their server locations and map their digital storage infrastructure to specific geographic coordinates to satisfy the requirements of Form No. 26.
The Statutory Mandate: Draft Rule 46(8)
While Form No. 26 addresses the disclosure aspect, the substantive obligation is embedded within Draft Rule 46(8) of the Draft Income Tax Rules, 2026. This rule does not merely suggest best practices; it imposes a binding legal constraint on how electronic records must be managed.