Section 23(2) in The Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009
(2)Save as otherwise required for the purpose of any ongoing investigation, criminal complaint or legal proceedings, the intermediary or person in-charge of computer resources shall destroy records pertaining to directions for interception of information within a period of two months of discontinuance of the interception or monitoring or decryption of such information and in doing so they shall maintain extreme secrecy.
