Picture a drug inspector walking into a pharmacy and asking for the Schedule H1 register entries from 28 months ago. The pharmacist opens a drawer, finds a spiral notebook with the last 11 months, and then stands very still. The notebook before that one was thrown out when they shifted premises. From that moment, the pharmacy is paying for legal advice before anything else is even decided.
The rules are not ambiguous about this. Under Rule 65(3)(h) of the D&C Rules, the Schedule H1 register must be maintained for three years and be open for inspection. Not "however long your old software keeps records." Three full years. Selling a Schedule H1 drug without a prescription is punishable under Section 27(d) of the Drugs and Cosmetics Act, 1940: imprisonment of one to two years and a fine of not less than ₹20,000 — and a register you cannot produce makes every H1 sale in it hard to defend.
If your billing system sits on a single Windows desktop in the billing counter and has never had its data backed up off that machine, you are one hard-drive failure away from losing everything, usually at the worst possible moment.
---
Your Hard Drive Is Not a Backup Strategy
Walk into many standalone pharmacies and you will find the same setup: one desktop, one copy of a billing application, data stored locally in a proprietary database format. The owner may have a weekly USB backup if they are diligent. Many do not.
Hard drives wear out. A pharmacy billing machine runs six to ten hours a day, often in a room with fluctuating power (despite a UPS) and seasonal heat. When that drive fails — and a three-year retention window is a long time to bet that it will not — your Schedule H1 entries, your GST-compliant sales records, and your patient prescription history disappear with it.
Recreating three years of records from paper copies is possible only if you kept paper copies. Many pharmacies stopped doing that the day they installed the software. Reconstruction, even where it is possible, means a very large amount of staff time and CA fees.
- Hardware failure does not excuse a missing register.
- "We had a software problem" is not an accepted explanation at a drug inspection.
- Partial records leave the gap exactly where the inspector is looking.
---
The GST Angle Nobody Tells You About
Your Schedule H1 register is not just a drug-law document. It is also the source of truth for a significant portion of your GST reconciliation. Most prescription medicines fall under HSN 3004, taxable at GST 5% from 22 September 2025 (after the 56th GST Council meeting). Every line in that register ties to an invoice that is part of your GSTR-1 filing.
If an inspector or a GST officer requests invoice-level data for a prior period and your records do not go back three years, you are exposed on two fronts simultaneously — the D&C violation and a potential GST mismatch.
The financial exposure here is not theoretical. A single GST audit with unexplained gaps in invoice records can result in interest at 18% per annum on the disputed amount plus penalties. For a pharmacy doing ₹80 lakh a year in prescription sales, even a 2% disputed amount at 18% interest over two years is a material number.
---
Patient Data Has Its Own Compliance Clock Now
The Digital Personal Data Protection Act 2023 — DPDPA 2023, whose obligations are being phased in — introduces a new layer of obligation that most pharmacy owners have not yet internalized. When you capture a prescription photo, store a patient's mobile number, or log a purchase tied to an identifiable person, you are processing personal data as a "data fiduciary."
DPDPA 2023 requires that personal data be retained only as long as necessary for the stated purpose, then deleted — but it also requires that you can demonstrate you had proper consent and storage practices for the entire period the data was held. That means your record of how you stored data, where it went, and who could access it must itself be auditable.
A pharmacy that kept patient prescription records on an unencrypted local drive, accessible to anyone who sat at the billing counter, may find itself in a difficult position as DPDPA enforcement ramps up. The fines under DPDPA can reach ₹250 crore for significant data breaches — a figure that sounds remote until you realize the Act covers neighborhood pharmacies, not just hospitals.
---
What Compliant Operations Actually Look Like
Here is what three-year pharmacy data retention looks like when it is working correctly, compared to the default state at most independent pharmacies.
| Typical standalone pharmacy today | Compliant operation |
|---|
| Schedule H1 records | Local desktop, single copy | Logged at billing and backed up off-site |
| Backup frequency | Weekly USB if remembered | Automatic and off-site |
| Inspection readiness | Hours to compile records manually | H1 sales already logged at billing; the pharmacist completes prescriber addresses before the register is shown |
| GST reconciliation | Cross-reference paper + software | Invoice-level data tied directly to H1 entries |
| Patient data access controls | Shared login, no audit trail | Role-based access, access log maintained |
| DPDPA posture | Unstructured, undocumented | Retention policy enforced, deletions logged |
The difference is not just about avoiding penalties. A pharmacist who can hand an inspector a complete Schedule H1 register on request does not spend the next six months in legal correspondence. That time has a real rupee cost.
---
How Nesayo Handles the Records Behind a Drug Inspection
Because Nesayo billing works as a PWA — it runs in the browser with offline capability — there is no single desktop to fail. If the billing counter's machine dies, the pharmacist switches to a laptop or a tablet and billing continues. The data is not on that machine, apart from bills saved offline, which sync when the connection returns — keep the billing page open until it does. It is backed up automatically, off the premises, and you can export your data at any time, on any plan. Nesayo does not yet export the H1 log as its own CSV or PDF.
Schedule H1 sales are logged automatically at billing: date, medicine, batch, quantity and bill number, with the patient and prescriber names entered on the bill. Nesayo does not record the prescriber's address yet, so the pharmacist adds it to complete the Rule 65(3)(h) register — and that finished register is what you show an inspector. Ask the chat for the H1 register and it lists the latest entries, so a missing prescriber name can be caught the next morning, not at the inspection.
Every medicine carries its HSN code from a catalogue of more than 2.5 lakh medicines, so the invoice behind each H1 sale is the same invoice your GST return is built from. On the Full plan, Expiry Guard checks near-expiry stock — Schedule H1 products included — every six hours, and a Tally export gives your accountant a file to load without re-entering data.
The pharmacy owner does not need to hire an extra person for this. The log is a byproduct of normal billing.
---
The Choice in Front of You Right Now
Every month you continue with a local-only backup is another month added to the gap that a drug inspector could find. The D&C Rules do not have a grace period for "we were meaning to fix this." The penalties in the Drugs and Cosmetics Act were set by Parliament, not by a bureaucrat having a bad day.
Nesayo's billing is free, permanently, with no expiry; new pharmacies also get the Full plan free for their first month, with no card; after it, the Free plan is manual billing and manual stock with no AI features. As of October 2026, the Essential plan is ₹249 per month (voice billing, prescription scanning and Refill Radar), and the Full plan is ₹549 per month for all five agents — Morning Briefing, Expiry Guard, Refill Radar, Stock Sense and Payment Advisor. Cloud-backed Schedule H1 logging at billing comes with the free tier.
Go to nesayo.com/demo right now — a sample pharmacy is pre-loaded, no account required. Bill a Schedule H1 medicine and see what is logged at billing, with the data sitting in the cloud rather than on the counter PC. It takes two minutes. The inspection that doesn't give you two minutes' warning is the one you are not prepared for.
---
FAQ
What is the minimum period pharmacies must keep Schedule H and H1 records in India?
Under Rule 65(3)(h) of the Drugs and Cosmetics Rules, the separate Schedule H1 register — the prescriber's name and address, the patient's name, the drug and its quantity — must be maintained for three years and be open for inspection. Other sale records under Rule 65 carry their own retention period, so confirm the one that applies to each record with your state drug controller. There is no provision that allows shorter retention for digital records versus paper records.
What is the fine for not maintaining a Schedule H1 register properly?
Selling a Schedule H1 drug without a prescription is punishable under Section 27(d) of the Drugs and Cosmetics Act, 1940: imprisonment of one to two years and a fine of not less than ₹20,000. Failing to keep the register as the Rules require can also lead to suspension or cancellation of the licence. Verify how this applies to your case with a qualified legal advisor, as enforcement practice can vary.
Does the 3-year D&C record retention requirement apply to computerized billing also?
Yes. The D&C Rules do not distinguish between paper and digital records for retention purposes. A computerized Schedule H1 register must be preserved for the same three years. If the software vendor's servers go down or your local machine fails, that is not a defense during an inspection — the obligation to retain the data remains yours.
Is DPDPA 2023 applicable to retail pharmacies, or only hospitals?
DPDPA 2023 applies to any entity that processes digital personal data, including retail pharmacies. When a pharmacy stores a patient's name, mobile number, or prescription details in digital form, it is processing personal data as defined under the Act. The obligations around consent, data security, and retention policies apply to pharmacies of all sizes. Consult a data protection attorney for advice specific to your state and pharmacy size.
Can a drug inspector ask for records from more than 3 years ago?
The D&C Rules set a three-year minimum retention floor, but they do not prohibit an inspector from asking for older records if they exist. In practice, the standard inspection window focuses on the three-year mandatory period. If you have older records, you are not obligated to produce them beyond what the Rules specify — but verify this with your legal counsel in the context of a specific inspection notice.
What happens if my billing software company shuts down — do I lose my Schedule H1 data?
This is one of the most underappreciated risks in pharmacy software. If your data is stored exclusively on a vendor's servers and that vendor closes or suspends operations, your access to historical records can be cut off immediately. Before choosing any software, confirm in writing that you can export a full copy of your Schedule H1 data at any time in a standard format (CSV, PDF, or similar), and that you own that data, not the vendor.
Is there a specific format prescribed by the D&C Rules for a Schedule H1 register?
Rule 65(3)(h) of the D&C Rules specifies what the Schedule H1 register must record at the time of supply: the name and address of the prescriber, the name of the patient, and the name and quantity of the drug. The Rules do not mandate a particular paper size or software format, but the content requirements are fixed. A system meets the content requirement only if every one of those fields — the prescriber's address included — is captured and retained for the full three years.