Data Retention for UK Businesses

Every UK business generates a steady stream of records: invoices, receipts, bank statements, payslips, contracts and tax returns. Knowing how long to keep each type is not just good housekeeping; it is a legal obligation. HMRC, Companies House and data protection law all set expectations, and getting retention wrong can mean penalties, a weaker position in a dispute, or holding personal data longer than you should. This guide explains the main retention periods, how to store records securely and how to dispose of them safely. It forms part of our e-invoicing and digital compliance hub and complements our guidance on digital record keeping .

Why Retention Periods Matter

A clear retention policy protects your business in several ways. If HMRC opens an enquiry, you need the underlying records to support the figures on your returns. If a supplier or customer disputes an invoice, the paperwork is your evidence. And if you destroy records too early, you may be unable to defend a claim or substantiate a deduction.

The opposite problem is just as real. Keeping everything forever means storing personal data longer than necessary, which conflicts with data protection principles and increases your exposure if there is a breach. The aim is a balanced approach: keep what you must for as long as you must, then dispose of it properly.

Accounting and Tax Records

Your accounting records underpin every tax return you file, so they sit at the heart of any retention policy. The required period depends on your structure.

For sole traders, this covers business income, expenses, bank statements and supporting receipts that feed your Self Assessment step by step . For companies, records must be detailed enough to show and explain the company’s transactions, financial position and the figures in your accounts, prepared under UK GAAP or the FRS 105 micro-entity standard.

A practical rule of thumb is to keep records for six years plus the current year, which comfortably covers most situations. Where there is fraud, deliberate error or an asset with a long life (such as property), keep records considerably longer. For expense-specific guidance, see our notes on record keeping for expenses .

VAT Records

If you are VAT-registered, you must keep your VAT records and a complete VAT account that ties your sales and purchase records to the figures on each return. The standard expectation is to retain these records for six years, or longer for certain schemes and capital items.

VAT records typically include:

• Copies of all sales invoices you issue and purchase invoices you receive
• Credit and debit notes
• Import and export documentation
• Your VAT account reconciling input and output tax

Under Making Tax Digital, these records must be kept digitally and linked by digital links through to your return. Keeping a robust VAT audit trail makes inspections straightforward and supports any correcting VAT return errors you later need to make.

Payroll and Employee Records

If you employ staff, PAYE and payroll records carry their own obligations. You must keep details of pay, deductions, tax and National Insurance, reports and payments to HMRC, employee leave and benefits. HMRC generally expects payroll records to be kept for at least three years after the end of the tax year they relate to, though keeping them in line with your other tax records is often simpler.

Employment law adds further considerations:

• Statutory pay records (such as sick or parental pay) have their own minimum periods
• Working time and holiday records should be retained while relevant
• Pension auto-enrolment records have a specified minimum retention period
• Right to work checks should be kept for the duration of employment and a period afterwards

Because payslips and HR files contain personal data, treat them with the same care described in the data protection section below.

Company and Statutory Records

Limited companies must maintain statutory registers and company records, many of which are filed with or available to Companies House. Some of these have no fixed disposal date because they must reflect the company’s history for as long as it exists.

Records in this category include:

• The register of members (shareholders) and people with significant control
• Register of directors and directors’ service addresses
• Minutes of board and general meetings and copies of resolutions
• Contracts, loan agreements and details of charges
• Accounting records and copies of filed accounts

Some statutory records should be kept for the life of the company and beyond, while others (such as meeting minutes) have a long minimum period. If you are early in your company journey, our guide to your first year of company accounts sets out what to put in place from the start.

Storing Records Securely

Records can be kept on paper or digitally, and HMRC accepts digital copies of original documents provided they are legible and complete. Digital storage is usually the better choice: it is searchable, easy to back up and aligns with Making Tax Digital.

When storing records, aim for:

• Reliable backups, ideally with copies held in more than one location
• Access controls so only authorised people can view sensitive data
• Logical organisation by year and record type for quick retrieval
• Format longevity, avoiding obscure file types that may not open in future

Good accounting software handles much of this automatically. For wider guidance on systems and controls, see our risk and compliance guides .

Data Protection Considerations

Much of what you store is personal data, which brings UK data protection law into play. Two principles matter most for retention. Storage limitation means you should not keep personal data for longer than you need it. Data minimisation means you should only hold what is genuinely necessary in the first place.

In practice this means documenting your retention periods, having a lawful basis for keeping records, and being able to respond if an individual asks what data you hold. Where a legal obligation (such as HMRC or pension rules) requires you to keep records, that obligation provides your justification for retaining the data for that period. Once the obligation ends, the case for keeping the data usually ends too.

Safe Disposal

When a retention period expires, dispose of records securely rather than simply discarding them. The method should match the sensitivity of the information.

Keep a simple log of what you destroy and when, so you can show your disposal followed your own policy. A consistent, documented process protects you against both HMRC challenge and data protection complaints, and keeps your systems free of clutter you no longer need.

Related

• Digital record keeping
• Keeping a VAT audit trail
• Record keeping for expenses
• Risk and compliance guides
• Key filing deadlines