Retention is where two rules pull in opposite directions. Tax and employment law require you to keep certain records for years. Data protection law requires you to stop keeping personal data once you no longer need it. Get either side wrong and you have a problem, so the safe position is not "keep everything forever" — it is knowing the periods and clearing out on schedule.
Why keeping too much is a risk
The UK GDPR storage limitation principle says personal data must not be kept longer than necessary for the purpose it was collected for. An archive room full of decades-old personnel files is not cautious; it is a large quantity of personal data you have no lawful reason to hold, sitting in a building, waiting to be lost, flooded or stolen. It also makes subject access requests slower and more expensive to answer, because you must search everything you hold.
Common UK retention periods
These are the periods most UK businesses work to. Your sector regulator, insurer or professional body may require longer, so check those first where they apply.
- Company tax records: at least six years from the end of the accounting period.
- VAT records: six years.
- Payroll, PAYE and wage records: at least three years after the end of the tax year they relate to, though six is common practice.
- Employee records after leaving: typically six years, aligned to the limitation period for contract claims.
- Recruitment and unsuccessful applications: usually six to twelve months, then destroy.
- Contracts and agreements: six years after the contract ends, longer for deeds and property.
- Accident book and health and safety records: three years from the date of the entry, and far longer where the incident involves exposure to hazardous substances.
- Pension and life assurance records: long term, often permanently — treat these as a specialist case.
- CCTV footage: usually days or weeks, not months, unless linked to an incident.
Build a retention schedule you will actually use
A retention schedule does not need to be elaborate. A single table listing each type of record, who owns it, how long it is kept, and what happens at the end is enough to satisfy most auditors and, more importantly, enough for your staff to follow. The test of a good schedule is whether someone new could apply it without asking you.
Give every box and every folder a destruction date when it is created. Boxes marked "Misc — various years" are the reason archive rooms never get cleared: nobody wants to be the person who throws away something that mattered, so everything stays. A date on the lid removes the judgement call.
Do the clear-out once a year
Pick a fixed point in the calendar — often just after year-end — and work through the records that have passed their retention date. Doing this annually keeps the volume manageable and the cost predictable, and it means you can tell a regulator that disposal is a routine process rather than something you do when the cupboard overflows.
Destroying records properly at the end
Reaching the end of a retention period does not mean the paperwork can go in the recycling. Until it is destroyed, it is still personal data and still your responsibility. Secure destruction means a documented process: lockable containers for material awaiting collection, a registered waste carrier, cross-cut destruction, and a Certificate of Destruction recording what was destroyed and when.
Keep those certificates. They are short, they are cheap to file, and they are exactly the evidence you need if someone later asks what happened to a record you no longer hold. A retention schedule tells a regulator what you intended to do; certificates prove you did it.
Do not forget digital media
Retention applies to hard drives, laptops, backup tapes, USB sticks and phones as much as to paper. Old IT equipment left in a store cupboard is one of the most common sources of avoidable breaches, because deleting files and formatting a disk do not reliably remove the data. When a device reaches the end of its life, have it physically destroyed and recorded — ideally with serial numbers listed so your asset register closes out cleanly.
Where to start this week
Walk into wherever your paperwork lives and look for anything dated before the current retention window. In most organisations there is more than expected, and clearing it reduces both your storage costs and your exposure in one go. If you want that handled in a single visit anywhere in the North East, call 0333 360 8269 and we will quote on the volume before anything is collected.