What are the main document retention periods for UK businesses?

Key periods: financial records 6 years, personnel files 6 years after employment ends, health and safety records 3 years (COSHH records 40 years), simple contracts 6 years after expiry, deeds 12 years, VAT records 6 years, PAYE records 3-6 years, and board minutes permanently.

How do I create a document retention schedule?

Identify all record types across your organisation, research the legal retention requirement for each, set retention periods based on the longest applicable legal requirement, define trigger events (when the retention period starts), assign department ownership, document everything clearly, and review annually.

Best Document Retention Schedule for UK Businesses

A document retention schedule is one of the most important governance tools a UK business can have — and one of the most commonly neglected. Without one, you either keep everything forever (expensive, and a data protection risk) or make ad-hoc decisions about what to destroy (risky, and potentially illegal). A proper retention schedule tells you exactly what to keep, for how long, and when it can be safely destroyed.

What a Retention Schedule Is

A retention schedule is a policy document that lists every type of record your organisation creates or receives, specifies how long each type must be retained, and states the legal or regulatory basis for that retention period. It is both a compliance tool and a practical management tool.

A good retention schedule should be:

Comprehensive: It covers all record types across all departments
Specific: It states exact retention periods, not vague guidance
Referenced: Each retention period cites the specific law, regulation or business reason
Actionable: It provides clear triggers for when the retention period starts and when destruction is due
Reviewed regularly: Updated annually or when legislation changes

UK Legal Retention Requirements

There is no single UK law that covers all document retention. Requirements come from multiple sources depending on the record type.

Financial and Tax Records

Accounting records: 6 years from end of financial year (Companies Act 2006)
Tax records (self-assessment): 5 years after 31 January filing deadline
Corporation tax records: 6 years from end of accounting period
VAT records: 6 years from date of supply
PAYE records: 3 years after end of tax year (6 years recommended)

Employment Records

Personnel files: 6 years after employment ends (Limitation Act 1980)
Recruitment records (unsuccessful): 6-12 months (ICO guidance)
Working time records: 2 years (Working Time Regulations 1998)
Sickness and absence records: 3 years after absence
Maternity/paternity records: 3 years after end of tax year in which maternity period ends
Redundancy records: 6 years from date of redundancy
Training records: 6 years after employment ends

Health and Safety

Risk assessments: Duration of validity plus 3 years
Accident records: 3 years from date of incident (RIDDOR: 3 years from date of report)
Health surveillance records: 40 years (Control of Substances Hazardous to Health Regulations)
Fire safety records: permanently while premises are occupied

Contracts and Legal

Simple contracts: 6 years after expiry (Limitation Act 1980)
Contracts executed as deeds: 12 years after expiry
Insurance policies: permanently (claims may arise years later)
Board minutes: permanently
Statutory registers (companies): permanently

GDPR and Data Protection

UK GDPR adds a critical overlay to your retention schedule. The storage limitation principle (Article 5(1)(e)) requires that personal data is kept only for as long as necessary for its purpose. Keeping personal data beyond the legally required period exposes you to GDPR complaints and ICO enforcement.

Your retention schedule should identify which record types contain personal data and ensure that the stated retention period is genuinely necessary — not just a convenient round number. When records reach the end of their retention period and contain personal data, destruction is not just good practice; it is a legal requirement.

Building Your Retention Schedule

Step by step:

1. Identify all record types: Work with each department to list every type of record they create or receive
2. Research retention requirements: For each type, identify the applicable law, regulation or business need
3. Set retention periods: Choose the longest applicable period. If multiple regulations apply (e.g., tax law says 6 years, employment law says 6 years after leaving), use the longer effective period
4. Define triggers: Specify when the clock starts — end of financial year, end of employment, expiry of contract, etc.
5. Assign ownership: Each record type should have a department or person responsible for reviewing and authorising destruction
6. Document the schedule: Create a clear, accessible document that all staff can understand
7. Review annually: Update when legislation changes, business activities change, or new record types are created

Using Your Storage Provider

A good storage provider helps you implement your retention schedule in practice. When boxes are deposited, the destruction date is recorded in the tracking system. As boxes approach their destruction date, the provider flags them for your review. You authorise destruction, the provider carries it out, and you receive destruction certificates.

This means your retention schedule is not just a policy document — it is actively managed and enforced, reducing both your storage costs and your compliance risk.

Get a Free Quote

Every business is different, so the best way to understand your options is to get in touch with our team. We provide clear, no-obligation advice — usually within the same day.

Call us on 01691 650355 or use the form below.