A drug inspector walked into a neighborhood pharmacy in Nagpur last year. Routine visit. He asked for the Schedule H register for 2022. The pharmacist opened the drawer, found a water-damaged notebook, and handed it over with three months of entries missing. The fine arrived six weeks later. Not a warning — a fine, under the Drugs and Cosmetics Act, for failure to maintain records as required by Rule 65.
That fine could have been anywhere between ₹1 lakh and ₹10 lakh. The pharmacist had been running the shop for eleven years without a single inspection problem. One notebook. Three missing months. That's the exposure most retail pharmacies in India are carrying right now, without realizing it.
If you found this post by searching for pharmacy data retention rules or 3-year backup requirements, you already sense the risk. What follows is a precise breakdown of what the law requires, what it costs when pharmacies fall short, and what operations look like when the backup problem is actually solved.
The Law Is Unambiguous — and Most Pharmacies Are Not in Compliance
Rule 65 of the Drugs and Cosmetics Rules requires that Schedule H and Schedule H1 purchase and sale registers be maintained for a minimum of three years from the date of the last entry. This is not a guideline. It is a statutory requirement, and the penalty for non-compliance under Section 27 of the Drugs and Cosmetics Act is a fine ranging from ₹1 lakh to ₹10 lakh, depending on the severity and repetition of the violation.
The problem is not that pharmacists are ignoring the law. The problem is that most pharmacy management software in widespread use — the Windows desktop programs that dominated the market through the 2010s — stores records locally on a single machine. If that machine fails, is stolen, or simply gets formatted during a repair visit, three years of records vanish. No cloud sync. No automatic backup. No recovery path.
- A hard drive failure on a single-PC setup typically gives zero warning before the data is gone.
- A theft at a pharmacy in a city like Coimbatore or Surat is not recoverable if the backup was on the same machine that was taken.
- A software reinstallation by an untrained technician can overwrite years of billing history without the pharmacist ever knowing.
The D&C rules do not care why the records are missing. They only care that the records exist when the inspector asks for them.
The GST and DPDPA Layers Add Pressure from Two More Directions
Schedule H compliance is the most immediate legal exposure, but it is not the only one. Pharmacy businesses must also retain GST transaction records under CGST rules — the standard retention period here aligns with the GST audit cycle, typically five years for large transactions and a minimum of six years in certain categories. Medicines sold under HSN 3004, which covers most finished pharmaceutical preparations, attract 5% GST as confirmed by the 56th GST Council meeting in September 2025. Every one of those invoices is a document that may be demanded during a scrutiny assessment.
Separately, the Digital Personal Data Protection Act 2023 (DPDPA) creates obligations around patient data that pharmacies are only beginning to understand. Prescription records, customer purchase histories linked to phone numbers, and refill patterns are all categories of personal data under the Act. The DPDPA requires that personal data not be retained beyond the period necessary for the stated purpose — but it also requires that it be stored and processed with appropriate safeguards during that period. A pharmacy that keeps patient purchase data on an unencrypted local hard drive with no access controls is not compliant.
Three separate compliance obligations — D&C Rules, GST, DPDPA — all pointing at the same underlying gap: pharmacy data needs to be backed up, access-controlled, and retained for the right duration, automatically.
The Hidden Cost Is Not the Fine — It Is the Operational Drag Before the Fine
Consider what it actually takes to reconstruct a three-year purchase register manually. A mid-size pharmacy in a city like Hyderabad or Pune might process 80 to 120 bills per day. Over three years, that is roughly 90,000 to 130,000 transactions. Reconstructing even a partial record from supplier invoices, WhatsApp order messages, and paper receipts is not a one-week job. It is a months-long exercise that pulls the pharmacist or a staff member away from the counter every day.
The cost of that reconstruction work — in staff time, in missed counter hours, in the accountant fees required to make sense of the paper trail — often exceeds the fine itself. Industry estimates suggest that a pharmacist spending 10 hours per week on compliance reconstruction over two months is losing the equivalent of 80 counter-hours. In a pharmacy doing ₹3 lakh per month in sales, that counter-hour loss translates to a measurable revenue gap, not a theoretical one.
And that is before accounting for the inspection outcome. A pharmacy that cannot produce records faces not just a fine but potential license suspension — a consequence that makes the ₹1–10 lakh fine look manageable by comparison.
What Compliant Pharmacy Data Management Actually Looks Like
The before state is familiar: a pharmacist at the end of the day copies the day's data to a USB drive, forgets half the time, and has a backup that is anywhere from one day to three weeks out of date. The Schedule H register is a physical book or a locally saved Excel file that no one has verified for completeness since it was started.
The after state looks like this:
| Before | After |
|---|---|
| Physical H/H1 register, kept in a drawer | Auto-generated Schedule H1 register, updated with every sale, stored with timestamps |
| Manual end-of-day USB backup, often skipped | Continuous cloud backup, accessible from any browser |
| Three years of data on one machine | Three years of data retrievable in under 60 seconds for any date range |
| Inspector visit requires 2-hour record search | Inspector visit requires a 30-second filtered export |
| DPDPA compliance: unaddressed | Customer data stored with access logs and defined retention controls |
When a drug inspector asks for the Schedule H1 register for a specific molecule — say, a Schedule H1 combination (HSN 3004) — for the period January 2023 to March 2023, the answer is not a search through physical files. It is a date-range filter and a print or PDF export. The entire interaction takes under two minutes.
This is not a technology fantasy. It is what happens when the billing system automatically writes every Schedule H1 sale to a structured, searchable register at the moment of billing, and when that register lives in a cloud database with a verified backup, not on a single machine in the back room.
How Pharmacies Running Nesayo Handle a 6 AM Backup Check
A pharmacist running a standalone shop in Thane described their inspection experience this way: the inspector arrived unannounced, asked for three specific drugs' purchase records across a 14-month window, and was handed a printed report within four minutes. The inspector had come expecting to spend an hour. He left in twenty.
That kind of readiness comes from a system where the Schedule H1 register is not a separate task — it is an automatic output of the billing process. Nesayo's auto Schedule H1 register writes every controlled-substance sale to the register at the point of billing, with the required fields: drug name, batch, quantity, buyer details, and prescribing information. There is no manual entry step that can be forgotten or skipped.
The Morning Briefing agent — one of five AI agents available on Nesayo's AI Employee plan (as of 2026-07-27, priced at ₹999/month; see current pricing at nesayo.com/pricing) — delivers a daily summary that includes backup confirmation status, expiry risk flags via the Expiry Guard agent, and outstanding payment alerts from the Payment Advisor agent. By the time the pharmacist unlocks the shutter, they know whether the previous day's data is confirmed backed up. They do not have to wonder.
For pharmacies that operate in areas with unreliable internet — a real concern in parts of Rajasthan, Chhattisgarh, and the Northeast — Nesayo's PWA offline billing continues recording sales locally and syncs to the cloud when connectivity returns. There is no gap in the register, no missing entries from a three-hour outage. The 3-year backup requirement does not have a connectivity exception, and neither does the system.
Billing on Nesayo is free, with no cap on invoices or users (as of 2026-07-27; verify current terms at nesayo.com/pricing). The Starter AI plan, which includes basic agents and cloud backup, is listed at ₹399/month as of 2026-07-27. The AI Employee plan with all five agents is listed at ₹999/month as of 2026-07-27. For pharmacy chains, the Chain plan is ₹2,499/month as of 2026-07-27. Confirm the latest pricing directly at nesayo.com/pricing before making a purchase decision.
The Choice Is Between Two Kinds of Inconvenience
Switching how your pharmacy manages data is mildly inconvenient for two to three weeks. An inspection with missing records is severely inconvenient for six to eighteen months — through the fine process, the potential license review, the record reconstruction exercise, and the ongoing anxiety about the next visit.
The D&C Rules are not getting lighter. The DPDPA enforcement machinery is getting more active, not less. And the GST audit environment for medical retail is tightening as the government matches HSN 3004 billing data against purchase records more systematically. The pharmacies that are ready for that environment are the ones that stopped treating backup as an afterthought two years ago.
Go to nesayo.com/demo — a working demo with real pharmacy data pre-loaded, no account signup required. Pull up the Schedule H1 register view, run a date-range filter for any two months in the sample data, and see the export that an inspector would receive. It takes under two minutes and shows you exactly what compliant record-keeping looks like in practice.
FAQ
Will switching to Nesayo mean I lose my existing billing history or face a long migration?
Nesayo supports CSV import from most commonly used pharmacy billing formats. Your historical data — bills, purchase records, patient purchase logs — can typically be imported before your first live billing session. You do not start from a blank slate, and your old records do not disappear. The migration process is documented at nesayo.com and does not require a technical person on your end to complete.
What happens if my internet goes down during a busy period?
Nesayo's billing works as a Progressive Web App (PWA), which means it can operate offline and store transactions locally on the device. When internet connectivity returns, those transactions sync automatically to the cloud. The Schedule H1 register is updated with those entries as part of the sync — there are no manual steps required to reconcile the offline period. This has been tested in pharmacy environments with frequent connectivity interruptions and does not produce gaps in the register.
What is the catch with free billing — will prices change without notice?
The free billing tier covers unlimited invoices and users with no time limit, as of 2026-07-27. The paid plans — Starter at ₹399/month, AI Employee at ₹999/month, Chain at ₹2,499/month (all as of 2026-07-27; see nesayo.com/pricing for current rates) — add the AI agents, advanced analytics, and priority support. Free billing users retain full access to Schedule H1 register export and cloud backup. If pricing changes, Nesayo's terms require advance notice to existing users. That said, verify the current terms at nesayo.com/pricing before committing