Download GST notices and orders from the GST common portal for the correct GSTIN, save every attachment, and preserve the untouched files exactly as received. Your evidence package should also contain the GSTIN, reference number or RFN, issue date, issuing-officer details, verification information, download timestamp, and a SHA-256 hash. Verify the document through the portal’s Verify RFN service before relying on it in an audit, appeal, or dispute.
What you should preserve
A GST notice is an electronic portal record, not merely a PDF received by email or printed for a file. The defensible package is the original portal download plus the information that lets another person identify and verify it.
As an Amazon Associate I earn from qualifying purchases.
- The notice or order PDF in its original, unedited form.
- Every attachment downloaded with the notice, including annexures, worksheets, statements and correspondence.
- The GSTIN to which the document relates.
- The notice or order reference number, including the RFN where one is shown.
- The issue date, financial year and proceeding or form reference.
- The issuing officer’s name, designation, jurisdiction and other details visible on the document.
- Any visible signature, seal, QR code, verification text or system-generated footer.
- A record of the portal path used, the UTC time of download, the user or staff member who downloaded it and the files obtained.
- The result of an independent Verify RFN check.
- A SHA-256 hash recorded at intake and checked after copying or migration.
Keep the untouched download as a read-only master. Make a separate working copy for highlighting, annotations, redactions or OCR. Store at least one independent backup, preferably encrypted, and keep the verification result with the same evidence package.
Before you start: prepare a controlled intake
Use a dedicated folder for the particular GSTIN and proceeding before you sign in. Decide who is authorised to download, who may annotate a working copy and where the backup will be stored. This prevents a common failure: several staff members downloading different versions into a shared folder and no one knowing which file was first received.
#1 Best Overall
Have the notice email, SMS or internal case reference available only as a locating aid. Treat the portal record as the authoritative electronic source. Note the browser, device or user account if your organisation keeps an access log; these details are useful when a later reviewer asks who obtained the file.
How to download a GST notice or order
1. Sign in for the correct GSTIN
Sign in to the GST common portal using the account that has access to the relevant GSTIN. If an organisation has several registrations, confirm the GSTIN displayed in the account before opening any notice. A document downloaded under the wrong registration can be genuine yet irrelevant to the matter you are handling.
Check the legal name, state or jurisdiction and, where displayed, the financial year. Do not assume that a user who can see one registration can see every registration. If an authorised adviser is downloading on the business’s behalf, record the client GSTIN and the adviser’s identity in the intake log.
2. Open the notices or orders area
Use the portal’s notices and orders section and select the relevant notice or order reference. Portal labels can change, so follow the current menu presented after login rather than relying on an old screenshot. GST Council instructions provide for electronic service or uploading of, among other records, the FORM GST DRC-01 notice summary and FORM GST DRC-07 order summary.
Open the record rather than relying on a notification heading alone. Confirm that the notice type, period, tax head and reference shown on the detail page correspond to the matter in your case file. If the portal lists multiple versions or related orders, capture each relevant record and state their relationship in your log.
3. Download the PDF and every attachment
Download the principal notice or order and each attachment separately. Do not assume that an attachment shown in a list is embedded in the PDF. Open the portal’s attachment list, download each file and check that the number of files saved matches the number displayed online.
Attachments can contain the computation, statement of facts, relied-upon documents, payment details or a reply template. Missing one can make the principal PDF misleadingly incomplete. After downloading, open each file once, confirm that it is readable, and compare its filename with the portal list. If a file is a ZIP, preserve the ZIP as downloaded and also record the names of its contents after extraction; do not replace the original ZIP with the extracted folder.
Retain the portal-generated filename as received. You may create an additional internal filename that is easier to search, but do not rename over the original. A stable internal pattern is:
GSTIN_RFN-or-reference_YYYY-MM-DD_document-type_original-filename
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
For example, an internal copy might include the GSTIN, the RFN, the issue date and “DRC-01-notice,” while the untouched master remains in its original download folder. Avoid characters that your backup system cannot handle, and keep a separate mapping if your system shortens long filenames.
4. Capture the intake record immediately
Before moving files between devices, create an intake log. Record the following for each notice:
Recommended Free Tools
- GSTIN and legal name, if shown.
- Reference number and RFN.
- Notice or order type and financial year.
- Issue date and any service or upload date displayed by the portal.
- Issuing officer, designation and jurisdiction.
- Portal menu path used to reach the record.
- UTC download timestamp.
- Account, employee or adviser who performed the download.
- Original filename, file size and file type for every downloaded file.
- Whether a verification result or related correspondence was also downloaded.
Use UTC in the log even if staff work in different time zones. If your internal system also records local time, keep both values and identify the time zone. Record failed attempts as well as successful ones when the failure affects completeness or timing.
5. Calculate a SHA-256 hash
A hash gives you a repeatable fingerprint for each file. It is operational evidence of whether the bytes changed after download; it is not a substitute for the GST portal’s own authentication process and is not presented here as a specific CGST Rule 26 requirement.
On a system with the standard command-line utilities, calculate the value with sha256sum filename.pdf on Linux or macOS. On Windows PowerShell, use Get-FileHash .filename.pdf -Algorithm SHA256. Windows Command Prompt also supports certutil -hashfile filename.pdf SHA256. Save the resulting value in the intake log, along with the filename and date. Hash every attachment, not just the principal PDF.
How to verify whether a GST notice is genuine
Use Verify RFN after downloading
GSTN’s 25 September 2024 advisory says taxpayers can verify a document’s validity, issuer and purpose both before login and after login. After signing in, the advisory gives this path:
Dashboard → Services → User Services → Verify RFN
The pre-login verification page identified in the advisory is https://services.gst.gov.in/services/verifyRfn.
- Open Verify RFN using the post-login menu or the pre-login page.
- Enter the requested reference or RFN details exactly as shown on the downloaded notice.
- Submit the query and save the returned result as a PDF, printout or screenshot according to your record-keeping policy.
- Compare the returned issuer, purpose, reference information and document details with the downloaded notice.
- Record the verification date and time, the account or person who performed it and whether the result matched.
A matching result supports the document’s provenance. If the portal returns no record, a different issuer, a different purpose or a different reference, stop and investigate rather than treating the PDF as established evidence. Preserve the query and result, including a “no match” result, so the chronology is clear.
Do not reject a notice solely because the PDF has no visible signature
GSTN explains that computer-generated show-cause notices, assessment orders, refund orders and similar documents may not display a visible digital signature on the PDF. The underlying JSON or order details are stored in the GST system with the issuing officer’s digital signature. Consequently, a missing visible signature is not, by itself, proof that the notice is invalid. Perform the RFN check and compare the returned details with the document.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Conversely, a visible signature image is not a reason to skip verification. A copied or altered PDF can contain a convincing image. Treat visual features as information to preserve, not as an independent substitute for the portal check.
Understand the legal authentication framework
CGST Rule 26 provides for electronic authentication through a digital signature certificate, an e-signature or another notified verification method. It also provides that notices, certificates and orders under the relevant chapter are issued electronically by the proper officer or an authorised officer. The rule explains the legal framework; the portal verification record helps connect that framework to the particular notice in your possession.
How to build an evidence package that survives review
Separate the master from working files
- Place the first portal downloads in a dedicated master folder.
- Set the master files to read-only or place them in storage that prevents ordinary editing.
- Copy the files to a working folder for notes, highlighting, redaction or text extraction.
- Keep a clear filename distinction such as
_MASTER,_WORKINGand_VERIFICATION; never save an edited file over the master.
Read-only status alone does not prove immutability if someone with sufficient permissions can change it. Restrict write access, log access where possible and preserve the original hash. If your document system creates previews, OCR files or thumbnails automatically, store them outside the master folder or label them as derivatives.
Keep all related material together
Use one evidence-package folder for the notice, attachments, RFN result, intake log and relevant portal correspondence. Include the original file and, if useful, a human-readable copy of the verification result. If you use screenshots, retain the full screen context, date and time, but do not let a screenshot replace the downloaded document and RFN result.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAdd a short index listing every file, its role and its hash. This makes it possible for an auditor, adviser or lawyer to confirm that an attachment was not omitted. Keep correspondence that explains a corrected download or portal outage, but distinguish it from the notice itself.
Back up and check transfers
- Maintain at least one separate backup, ideally encrypted and stored on a different device or location.
- Recalculate the SHA-256 hash after copying to a backup, migrating systems or handing the package to an adviser.
- Compare the new value with the intake value and investigate any mismatch before using the copy.
- Periodically open the PDF and attachments to confirm that they remain readable.
- Log who accessed or transferred the package and why, especially for an appeal or litigation file.
An encrypted USB drive can be one backup option, but the device is only a storage aid. It does not authenticate a notice, and it should not be the only copy. Keep the master and backup physically or logically separate so a single loss, corruption event or accidental deletion does not remove both.
Portal original, RFN result or screenshot: which is strongest?
Different records answer different questions. The portal download establishes what file was obtained; Verify RFN addresses whether the portal recognises the reference and identifies the issuer and purpose; a screenshot or printout is mainly a convenience copy.
| Record | Independent verifiability | Resistance to unnoticed alteration | Attachments and metadata | Best use |
|---|---|---|---|---|
| Portal-original PDF package | Can be checked against the portal reference and RFN | Strong when the untouched file, access controls and hash are preserved | Complete only if every listed attachment and intake detail is saved | Primary audit, appeal or litigation file |
| Portal Verify RFN result | Directly checks the reference with the GST portal | Strong when the returned result is saved and its retrieval is logged | Confirms issuer, purpose and reference information; it may not reproduce every attachment | Authentication companion to the original package |
| Screenshot or printout | Limited; the viewer cannot independently query the portal from the image alone | Easy to alter or crop and usually lacks the original file metadata | Often incomplete and may omit attachments or portal context | Readable working aid or contingency record, not the sole evidence |
For most taxpayers, the portal-original package together with the RFN verification result provides the strongest chain of proof available from the taxpayer side. A printout may be useful in a meeting, but retain the electronic originals for later comparison.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #4
What to do when verification or downloading fails
The RFN is not found
- Check every character in the RFN or reference number, including leading zeroes and punctuation.
- Confirm that you selected the correct GSTIN and notice type.
- Try the post-login and pre-login Verify RFN routes separately.
- Save the failed result, the date and time, and the exact value entered.
- Do not alter the PDF or discard it while the discrepancy is being investigated.
Also compare the reference printed in the PDF with the reference in the portal’s notice list. If they differ, preserve both views and note which screen supplied each value. Do not repeatedly edit a copied number in the PDF to make it match the portal.
The returned issuer or purpose does not match
Compare the GSTIN, officer, jurisdiction, issue date, reference and proceeding purpose line by line. A mismatch can indicate a wrong reference, a portal display issue, an incorrectly supplied document or a fraudulent copy. Preserve both the document and the mismatch evidence, then seek advice from the appropriate tax professional or authority before relying on it.
An attachment will not download or open
Record the attachment name and the portal error, retry from the notice page and check whether the browser completed the download. Keep the principal notice, the error evidence and the intake log. Do not create a replacement attachment by editing the PDF. If a later download succeeds, hash the successful file and note the separate download time.
If the portal displays an attachment count, record that count and the number actually obtained. A package can be marked incomplete until every listed file is retrieved or the inability to retrieve it is documented.
Free tools Windows power users keep installed
One-click scans. No signup required.
The PDF opens but appears unsigned
Use Verify RFN rather than judging validity from the visual appearance of the PDF. Preserve any visible signature information and the verification result together.
A copied file has a different hash
Stop using the copy as a presumed duplicate. Re-copy from the untouched master, calculate the hash again and check whether a transfer, compression, OCR or annotation step changed the bytes. Keep the original value and document the resolution. Never overwrite the original with the version that has the unexpected hash.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retention and access controls
There is no single retention period that safely applies to every GST notice, order or attachment. The appropriate period depends on the record, the proceeding, the applicable law and any audit, assessment, refund, appeal or litigation timetable. Confirm the current rule and the notice-specific context before deleting anything.
Until that review is complete, keep the evidence package accessible to the people handling the matter, but restrict ordinary editing and deletion rights. If the record is transferred to an adviser, auditor or lawyer, provide a copy of the master package, the hash log and the RFN result, and record the transfer.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Do not rely on a cloud provider’s automatic retention or version history as your only preservation control. Confirm that the service keeps the original bytes, maintains access permissions and allows recovery of attachments. When a matter closes, document the authorised disposition date and retain any hold or appeal instruction that prevents deletion.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
A practical checklist
- Correct GSTIN confirmed.
- Notice or order selected from the portal notices/orders area.
- PDF downloaded without editing.
- Every listed attachment downloaded.
- Original filenames retained.
- Internal filename includes GSTIN, reference or RFN and issue date.
- Issue date, financial year, officer and jurisdiction recorded.
- UTC download time and downloader recorded.
- SHA-256 hash calculated for each file.
- Verify RFN completed through the portal.
- Issuer, purpose and reference compared with the document.
- Verification result saved with the package.
- Read-only master separated from working copy.
- Encrypted or otherwise protected backup created.
- Hashes checked after copying or migration.
- Retention period confirmed for the specific record and proceeding.
Frequently Asked Questions
Can I rely on a GST notice PDF that has no visible digital signature?
Not seeing a signature on a computer-generated PDF does not by itself invalidate the notice. GSTN states that the underlying JSON or order details may carry the issuing officer’s digital signature. Verify the RFN and compare the returned issuer, purpose and reference with the PDF.
Is a screenshot of the GST portal enough for an appeal?
A screenshot is a useful convenience or contingency record, but it is easy to crop or alter and may omit attachments and metadata. Keep the untouched portal download, every attachment and the saved Verify RFN result as the primary package.
What should I do if Verify RFN returns no record?
Check the RFN character by character, confirm the GSTIN and notice type, and try both the post-login and pre-login routes. Save the failed query, date, time and entered value. Preserve the PDF and investigate before relying on it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Should I hash only the main notice PDF?
No. Hash the principal PDF and every downloaded attachment. Record each filename, size, hash and intake date, then recalculate hashes after copying, migration or transfer.
Can I annotate the downloaded notice?
Make annotations, redactions, OCR output or highlights only on a working copy. Keep the first portal download read-only or in access-controlled storage and never overwrite its original hash.
What information should accompany a GST notice in a tax file?
Keep the GSTIN, reference or RFN, issue and service or upload dates, financial year, form or proceeding, officer and jurisdiction, portal path, UTC download time, downloader, filenames, hashes, all attachments and the RFN verification result.
How long must I keep a GST notice?
The correct period depends on the record, proceeding, applicable law and any audit, assessment, refund, appeal or litigation timetable. Confirm the current rule and the notice-specific context before deletion; do not assume one universal period.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Does Rule 26 require a particular SHA-256 procedure?
No. SHA-256 is an operational integrity control for showing whether file bytes changed. CGST Rule 26 addresses electronic authentication and electronic issuance by the proper or authorised officer; it does not make the hash procedure a substitute for portal authentication.
The Bottom Line
Download the notice and every attachment from the correct GSTIN, preserve the first files as an access-controlled master, and verify the reference through Dashboard → Services → User Services → Verify RFN or the pre-login service. Keep the issuer, purpose, dates, officer details, UTC intake log, SHA-256 hashes, working copy and independent backup together. That package is far more reliable for an audit, appeal or dispute than a screenshot or an edited PDF.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
