A customer contract, a VAT invoice and an employee’s right-to-work check can sit in the same folder, yet each may have a different deletion date. That is the challenge of business legal document retention in the UK: one record may be needed for tax, company law, employment compliance and a potential dispute simultaneously.
Good business record keeping is less about saving everything for seven years and more about identifying why each document exists, when its retention clock starts and what might extend it.
Why one retention period does not fit every record
UK document retention requirements come from HMRC, the Companies Act 2006, employment law, contractual limitation periods and the UK GDPR. Some prescribe minimum periods; others require businesses to assess necessity.
When rules overlap, retain the record for the longest applicable lawful period, while avoiding unnecessary personal information. A schedule should distinguish original records from duplicate working copies.
How long should UK businesses keep common documents?
Accounting and Corporation Tax records
HMRC generally requires limited companies to retain accounting and supporting records for six years from the end of the relevant company financial year. Longer retention can apply to transactions spanning periods, long-lived assets, late returns or ongoing compliance checks.
Company law provides a useful distinction. Private companies generally preserve accounting records for at least three years from creation; public companies have a six-year requirement. The shorter Companies Act period does not override a private company’s separate HMRC obligations.
Sole traders normally keep Self Assessment business records for at least five years after the 31 January filing deadline for the relevant tax year. Enquiries and late returns can change this.
VAT invoices and supporting evidence
VAT-registered businesses generally retain VAT records for at least six years, including sales invoices, purchase invoices, credit notes and VAT accounts. The VAT One Stop Shop scheme requires ten years. The start date for the standard six-year period depends on the record type, so not every invoice expires at a financial year-end.
Payroll and employment records
PAYE records must generally be kept for three years after the relevant tax year ends. Payroll data supporting company profits may need longer retention under tax rules. Minimum wage, statutory leave and other employment obligations can have different requirements.
Right-to-work checks are a clear example: employers should keep evidence securely throughout employment and for two years afterwards, then destroy it securely unless another lawful basis applies.
Company registers and meeting minutes
Corporate governance records should not follow an automatic six-year deletion cycle. Companies must maintain relevant statutory registers, and the Companies Act requires minutes of directors’ meetings to be retained for at least ten years from each meeting.
Keep incorporation documents, articles and significant ownership records accessible while legally relevant. Review the requirements for each register rather than assigning one expiry date to all company records.
Contracts, deeds and potential claims
Contract retention is often confused with limitation law. In England and Wales, the usual limitation period for a simple-contract claim is six years from when the cause of action arises, not necessarily from signing. Claims on deeds can have a twelve-year period, subject to exceptions.
These are limits for certain court claims, not statutory instructions to destroy contracts. Legal records retention should consider warranties, termination, dispute history and continuing rights. Scotland and Northern Ireland have distinct rules, so UK-wide policies may require jurisdiction-specific entries.
Personal data and compliance records
The UK GDPR sets no universal six-year retention period. The Information Commissioner’s Office expects organisations to justify how long identifiable data is needed, review it and erase or anonymise it when its purpose ends. A tax duty may justify retaining necessary details on an invoice, but not unrelated customer profiling information indefinitely.
Sector rules add obligations. Businesses covered by anti-money-laundering regulations generally retain specified due diligence and transaction records for five years after a relevant relationship ends or occasional transaction completes, subject to exceptions. Specialist safety and professional records can follow their own schedules.
A practical example: one invoice, several deadlines
Imagine a UK limited company buying machinery in October 2026. Its invoice supports VAT, Corporation Tax calculations, ownership of a long-lived asset and the supplier’s warranty. Deleting it six years after purchase may be premature if it still proves the asset’s cost or supports an unresolved claim.
The company instead records each retention purpose, assigns the longest relevant review date and flags continuing warranty or tax needs. Unrelated correspondence may be removed earlier. This is more defensible than saving every email indefinitely.
Build a retention schedule people can use
Start with record categories. For each, identify the responsible team, legal basis, retention trigger, minimum period, storage location and disposal method. Note personal data and who can authorise an extension.
Useful triggers include financial year-end, tax year-end, termination of employment, contract expiry, transaction completion and the date of a board meeting. Set a review date rather than treating expiry as automatic deletion permission.
A business compliance checklist, company records management policy and guidance on UK data protection responsibilities can support the schedule. These related resources help staff understand why documents are retained and who approves disposal.
Pause deletion for disputes and investigations
Routine disposal must stop when records may be needed for litigation, an HMRC enquiry, a regulatory investigation or another genuine legal duty. A documented legal hold should identify affected material, suspend deletion and be lifted only when appropriate.
Include shared drives, email archives and backups in the policy. Restrict access, preserve audit trails and securely dispose of paper and digital copies. A file reaching its scheduled date is not automatically safe to delete.
Frequently asked questions
Do UK businesses have to keep every record for six years?
No. Six years is common for company tax and VAT records, but PAYE, board minutes, immigration checks and personal data follow different rules. Classify records by purpose.
Can a UK company keep all records forever?
Indefinite retention brings privacy and security risks. Organisations must justify keeping personal data. Preserve records with a genuine long-term need and review the rest.
Does cloud storage satisfy record-keeping law?
Cloud storage can work if records remain accurate, secure, accessible and retrievable. Some tax records must meet specific digital requirements. A cloud subscription alone is not a compliant retention policy.
When should a retention policy be reviewed?
Review it periodically and when law, business activities, technology or regulatory duties change. Test whether disposal dates, permissions and legal holds work in practice.
Keep what you need, and know why
Effective document retention in the UK connects tax evidence, corporate governance, contractual risk and privacy safeguards. Assign a reason and review date to each category, preserve documents when obligations overlap and remove information when no lawful need remains. The result is a defensible audit trail without a permanent dumping ground.