What is the difference between storage-only and full records management?

Storage-only keeps your boxes on a shelf and charges a flat per-box fee. Full records management adds file-level indexing, retention scheduling, managed retrieval, secure destruction to BS EN 15713, and audit trails on top of the same physical storage.

Is records management worth the extra cost for a small business?

If your archive is under about 100 boxes, largely dormant, and well-indexed internally, storage-only is usually fine. Once you cross a few hundred boxes or need regular retrievals, the hidden cost of staff time and overdue destruction often exceeds the management fee.

Does the ICO require a formal records management programme?

The UK GDPR and Data Protection Act 2018 do not mandate a specific programme, but they require personal data not to be kept longer than necessary and to be processed securely. A documented retention schedule, audit trail, and certified destruction process are the practical evidence regulators look for.

Can I move from storage-only to full records management later?

Yes. A reputable provider will catalogue and barcode your existing boxes during an indexing project, apply retention dates against your schedule, and migrate you onto the managed service without moving the physical archive.

How much of a typical archive is past its retention date?

In storage-only archives without a managed retention schedule, it is common to find 10 to 30 percent of boxes are eligible for secure destruction but still being stored — and paid for — every month.

Storage-Only vs Full Records Management: What’s the Better Long-Term Option?

If your archive is growing year on year and the only thing your provider does is keep boxes on a shelf, you may be paying for half a service. Storage-only is cheaper on paper, but full records management — indexing, retention scheduling, retrieval, secure destruction, and audit trails — usually costs less over five to ten years once you factor in staff time, compliance risk, and the cost of files you can’t find. Here’s how the two stack up for UK businesses thinking long-term.

What “storage-only” actually gets you

Storage-only is exactly what it sounds like: a third party holds your boxes in a secure facility, and you pay a monthly fee per box. The provider knows which box is on which shelf, and that’s it. If you need a file, you either collect the whole box yourself or pay an ad-hoc retrieval fee. Indexing of the contents is your responsibility, retention dates live in your spreadsheet (or someone’s head), and destruction is a separate phone call when you remember to make it.

For a small archive that rarely gets touched — say, a handful of legal completion files you’re keeping for the statutory period — storage-only is perfectly sensible. The trouble starts when the archive grows past a few hundred boxes, or when more than one person needs access, or when regulators start asking questions.

What full records management adds

Full records management wraps the same physical storage in a managed service layer. The core differences:

File-level indexing — every box and often every file is barcoded and catalogued against your own reference scheme, searchable through a web portal
Retention scheduling — destruction dates are attached to each box on intake, so files are flagged the moment they’re eligible for disposal
Managed retrieval — request a file by reference and get it back as a scan (often same day) or a physical delivery, with chain of custody logged at every step
Secure destruction — shredding to BS EN 15713 with destruction certificates that satisfy auditors and the ICO
Audit trails — every request, retrieval, return, and destruction event timestamped against the user who triggered it

The base storage fee is usually similar to a storage-only quote; the management layer is added on top, but the activity-based charges (retrievals, destructions) are often lower per event because the infrastructure is already there.

The real cost comparison over five years

Take a business with 500 archive boxes and an average of 30 retrievals a year. On a pure storage-only contract, the monthly fee looks attractive — but each retrieval is billed individually, often with a minimum charge for a courier run, and indexing labour falls on your team. If a clerk spends two hours a week locating, logging, and re-filing boxes at £18 an hour fully loaded, that’s £1,872 a year in hidden staff cost before you’ve paid the provider a penny extra.

The bigger long-term cost is what happens at destruction time. Boxes held beyond their lawful retention period are a GDPR liability — the UK Data Protection Act 2018 requires personal data not to be kept “longer than necessary.” Without a managed retention schedule, most storage-only customers carry 10–30% dead boxes they’re still paying to store. On 500 boxes, that’s 50–150 boxes of pure waste, every month, for years.

Compliance and audit: where storage-only falls short

UK regulators — the ICO, FCA, SRA, and HMRC among them — expect you to demonstrate not just that records exist, but that you control them. That means knowing exactly what you hold, why you hold it, who has accessed it, and when it will be destroyed. Storage-only contracts give you none of that out of the box. In an ICO investigation, “the box is in a warehouse somewhere in Manchester” is not a defensible answer. ICO fines for serious GDPR breaches can reach £17.5 million or 4% of global turnover, and a documented records management programme is one of the clearest mitigating factors the regulator weighs.

Industry-specific rules sharpen the point. Solicitors keeping completion files under SRA guidance, accountants holding records for the six-year HMRC window, and HR teams retaining personnel files post-employment all need defensible disposal at the end of the retention period — not “we’ll get round to it when someone notices.”

When storage-only is still the right call

Full records management isn’t always the better option. Storage-only makes sense when:

The archive is small (under ~100 boxes) and largely dormant
You already have a robust internal indexing system and a named records owner
Retrievals are genuinely rare (a handful a year)
You’re holding files purely to satisfy a fixed statutory period before bulk destruction

If any of those stops being true — the archive grows, staff turn over, retrieval frequency picks up, or a regulator starts paying attention — the calculus flips quickly.

How to decide for your business

A simple test: add up your monthly storage cost, your retrieval fees over the last year, and an honest estimate of staff time spent on archive admin. Then ask how many of your boxes are past their retention date but still on the shelf. If hidden costs and dead stock together exceed the management fee on a full records contract, you’re already paying for records management — you’re just not getting it.

For most UK businesses with more than a few hundred boxes, full records management wins on a five-to-ten-year view. It’s not always cheaper line-by-line, but it removes the two costs that quietly grow every year: staff time and compliance risk. Pair it with selective document scanning for high-access files and you get the audit trail of a managed archive with the speed of digital retrieval. More long-form guides are in our Resources library.