Most UK businesses must keep financial and tax records for at least 6 years, employment records for 6 years after an employee leaves, and health and safety records for up to 40 years. Once the legal retention period has passed and the documents serve no further business purpose, they should be securely shredded rather than left in storage, where they become a GDPR and fraud risk.
Why document retention matters (not just for compliance)
UK businesses sit under several overlapping rules at once: the Companies Act 2006, HMRC requirements, UK GDPR and the Data Protection Act 2018, and sector-specific regulators. There is no single law that lists every retention period for every document, which is why so many businesses either keep everything “just in case” or shred too early and risk a fine.
Under UK GDPR’s storage limitation principle, personal data should only be kept for as long as it’s needed for the purpose it was collected. Holding onto records past their useful life doesn’t just take up space, it increases your exposure if those records are ever lost, stolen or involved in a data breach.
UK document retention periods at a glance
| Document type | Recommended retention period | Legal basis |
|---|---|---|
| VAT records | 6 years from the end of the accounting period | HMRC / VAT Act 1994 |
| Company tax returns and accounting records | 6 years from the end of the financial year | Companies Act 2006 / HMRC |
| Self-assessment records (self-employed) | 5 years after the 31 January submission deadline | HMRC |
| Payroll and payslip records | 3 years minimum (6 years recommended) | Income Tax (PAYE) Regulations 2003 |
| Employee personnel files (after leaving) | 6 years after employment ends | Limitation Act 1980 |
| Disciplinary and grievance records | 6 years after employment ends | Employment law best practice |
| Accident/health and safety records | 3 years (up to 40 years for industrial disease exposure) | RIDDOR / Control of Substances Hazardous to Health |
| Insurance policies and claims records | 6 years after policy ends (longer for employer’s liability) | Employers’ Liability (Compulsory Insurance) Regulations |
| Contracts and agreements | 6 years after the contract ends (12 years if signed as a deed) | Limitation Act 1980 |
| Bank statements | 6 years | HMRC / general business practice |
| Personal data (GDPR-related) | As long as necessary, then securely deleted | UK GDPR storage limitation principle |
These are general guidelines, not legal advice. Retention periods can vary depending on your sector, contract terms and whether litigation is ongoing, check gov.uk or speak to your accountant for your specific circumstances.
What influences how long you should keep a document?
- Statutory minimums: some records (VAT, payroll, accident books) have a legal minimum you can’t shred before, regardless of business need.
- Limitation periods: contracts and agreements are often kept for 6 years (or 12 for deeds) because that’s how long a claim can be brought under the Limitation Act 1980.
- Ongoing disputes or investigations: if a document is relevant to a live legal matter, it must be kept even past its normal retention date (a “legal hold”).
- Operational need: some records are useful for audits, renewals or historical reference even after the legal minimum has passed.
- Sensitivity: the more sensitive the data (medical, financial, children’s records), the stronger the case for shredding as soon as the retention period allows, rather than keeping it “just in case”.
What happens if you keep records too long?
Over-retention isn’t just clutter, it’s risk. Every extra filing cabinet or storage box of old records is:
- A bigger target for a data breach: more personal data sitting around means more exposure if there’s a break-in, a lost laptop or a misplaced box of files.
- A compliance liability: the ICO has fined UK organisations for failing to dispose of personal data securely once it was no longer needed, including a Northern Ireland health trust fined £225,000 after patient records were found abandoned and unsecured.
- A cost: off-site storage, archive boxes and office space all cost money for documents that no longer serve any purpose.
How to build a simple document retention policy
- List your document categories: invoices, payroll, HR files, contracts, correspondence.
- Set a retention period for each, using the table above as a starting point and confirming anything sector-specific with your accountant or legal adviser.
- Decide a review point: e.g. every January, flag anything that has passed its retention date.
- Choose a secure destruction method: cross-cut shredding on-site is the standard recommended by the Information Commissioner’s Office for paper records containing personal data.
- Keep a Certificate of Destruction: this is your evidence that disposal happened securely and compliantly, useful if you’re ever audited.
When it’s time to shred
Once a document has passed its retention period and has no further legal, financial or operational use, it should be destroyed securely rather than put in general waste or recycling. A locked console or shredding sack kept in the office between collections, paired with a scheduled or one-off on-site shredding service, keeps the process simple and auditable.
ShredBank’s scheduled shredding service is built for exactly this: regular, compliant clear-outs so records never pile up past their retention date. For a larger backlog of old files you’ve just identified as due for disposal, our one-off clear-out service handles bulk destruction in a single visit.
Frequently asked questions
How long should a small business keep invoices in the UK?
HMRC recommends keeping invoices and other VAT records for 6 years from the end of the relevant accounting period.
Can I shred documents before the retention period ends?
No, shredding before the statutory minimum has passed can leave you unable to produce records for an HMRC enquiry, an employment tribunal or an audit, and may itself be a compliance breach.
Do digital copies count, or do I need to keep the paper original?
For most document types, a clear scanned copy is acceptable to HMRC and under UK GDPR, provided it’s a true and complete copy. Once documents are scanned to an acceptable standard, the paper originals can usually be securely shredded.
What’s the safest way to dispose of documents once the retention period ends?
Cross-cut, on-site shredding with a Certificate of Destruction is the method recommended by the ICO, as it ensures documents are unreadable and the process is fully auditable.