Company Secretarial Data Room: Evidence You Can Trust

Law and applicability

Companies Act sections 88, 94, 118, 128 and 134; electronic-records, inspection and Secretarial Standards obligations.

A data room should reproduce verifiable company history, not a curated folder of unsigned drafts. A third-party digital platform does not alter statutory retention, signing, location or inspection rights. Tax, HR, ROC and securities data need controlled access because they may contain personal data, confidential transactions or price-sensitive information.

Key statutory decision tests

• Maintain source-controlled folders for constitutional documents, registers, minutes, shares, borrowing, tax and licences.
• Separate draft, Board-approved, executed, digitally signed, submitted and acknowledged documents.
• Record who uploaded a file, its source system, version and permitted access; hash critical executed originals.
• For listed companies, maintain UPSI and access-control separation from ordinary deal-team records.
• Run a completeness check against ROC master data and Board minutes before any bank or investor diligence request.

Practical step-by-step workflow

1. Create a statutory-record taxonomy by section, financial year, legal entity and document type.
2. Use access levels for directors, legal counsel, accountants and external bidders.
3. Keep evidence of edits, downloads, replacements, deletion authority and disaster recovery.
4. Reconcile physical signed originals and records mandated by law to electronic repositories.

Important exceptions and higher-risk transactions

A bank, investor and auditor may ask for the same document for different reasons. Assign documents to appropriate audiences rather than opening all records to all recipients: signed statutory minutes may be reviewable, while access to privilege-sensitive Board advice, customer data or unpublished results needs additional restriction. Document the law or authority under which the record is disclosed and whether masking or read-only review is sufficient.

Create a reconciliation report before any diligence event showing company share capital and securities by series, directors and KMP changes, material filings, charges and unresolved defaults. Where a legal record is missing, publish an exception entry for the data-room administrator rather than manufacturing or backdating a missing resolution. Signed files can be hash-verified to a master archive to detect inadvertent substitution after circulation.

Prepare a controlled index for every data-room disclosure. Each entry should record the source document’s owner, legal entity, execution date, completeness, confidentiality classification, shareable version and expiry or supersession. If a scanned agreement is missing schedules or an auditor report has an unapproved annexure, flag the gap and retrieve the correct executed version. Investors and lenders should receive the facts necessary for the transaction without being misled by incomplete records. Distinguish a data room’s operational convenience from retention and inspection duties for statutory minute books, registers, financial records and beneficial-ownership evidence.

Worked professional example

How the rule works in real companies

Organise corporate records by legal entity, financial year, event and confidentiality level. Separate signed source documents from drafts and portal downloads. A digital data room is not legally equivalent to the company maintaining prescribed statutory registers: authentication, inspection rights, custodianship and long-term retention must remain intact. Use immutable versions for resolutions and final minutes.

During a bank due-diligence exercise the lender requests an allotment resolution, member register extract and SH-7/ PAS-3 trail. A defensible file combines the approval date, signed version, register posting, final forms and ROC receipts; a folder containing only a draft resolution creates ambiguity about whether the transaction was approved.

Document index with owners, legal hold policy, audit logs, hash or version IDs for signed materials, access approvals, statutory register exports, original physical custody locations and retrieval test results.

Documents to retain and reconcile

• Signed resolutions, minutes and version logs
• ROC acknowledgements and charge certificates
• Access-control register and audit trail
• Records-retention mapping and disaster-recovery checks

Common mistakes to avoid

• Treating file presence as proof of legal execution
• Disclosing excessive personal data during diligence
• Replacing minutes with a subsequently edited spreadsheet

Practical questions and answers

Statutory provisions and official references

• Companies Act, 2013 — MCA Act text (read with subsequent amendments)
• ICSI — revised SS-1 and SS-2 applicable from 1 April 2024
• SEBI LODR Master Circular — 30 January 2026

Use the applicable amended provision and actual effective date for the transaction. Current MCA portal instructions and valid circulars govern web-form fields, fees and approved extensions.