What should a retention schedule include?

A retention schedule is a table listing record types, retention periods, legal or business reasons for keeping them, and the required disposal action.

Why is a data retention policy important for UK businesses?

It helps demonstrate accountability, reduce compliance risk, control storage costs, support audits, and ensure personal data is not kept longer than necessary.

When should personal data be deleted?

Personal data should be deleted, anonymised, or securely archived when it is no longer needed and there is no legal or business reason to retain it.

Can all business records use the same retention period?

Not always. Different records often need different retention periods depending on their purpose, legal requirements, and risk profile.

Are there special retention rules for certain types of records?

Yes. HR records, payroll records, health and safety documents, tax records, client files, contracts, and regulated-sector records may all be subject to specific retention considerations.

How do limitation periods affect retention policies?

Limitation periods indicate how long legal claims can usually be brought, so organisations often retain relevant records long enough to defend potential claims.

What should a UK records retention policy include?

A policy should identify record categories, retention periods, legal bases, responsibilities, review processes, storage requirements, disposal methods, and exceptions such as legal holds.

What is a legal hold in records management?

A legal hold suspends normal deletion when records may be needed for litigation, investigations, audits, or regulatory enquiries.

How often should a data retention policy be reviewed?

Policies should be reviewed regularly, especially after legal changes, business changes, new systems, regulatory updates, or changes in the types of data processed.

Can AI help create a UK data retention and records management policy?

Yes. An AI document generator can help create a structured first draft, but organisations should review and adapt it to their records, risks, and legal obligations.

EN-GB>Governance>Data Retention and Records Management Policy>UK Retention Drivers and Policy Considerations

UK Retention Drivers And Policy Considerations

Created: 8 Jun 2026

This article summarises key UK retention drivers and policy considerations to help readers interpret dataset insights and align records practices with operational, legal, and compliance needs. For broader guidance, see AI Generated Data Retention and Records Management Policy for use in the United Kingdom.

Basis for Retention	Relevant Record Types	Policy Relevance	Typical Retention Impact	Practical Importance
Legal obligation
UK GDPR storage limitation principle	All personal data records	Requires justified, time-limited retention of personal data.	No fixed period retain only as necessary.	High
Data Protection Act 2018 compliance	Personal data, special category data, criminal offence data	Supports lawful handling, retention limits and accountability.	Varies by lawful purpose and sector.	High
Legal obligation, Audit or assurance
UK GDPR accountability evidence	RoPA, DPIAs, policies, consent records, breach logs	Requires evidence that privacy duties were met.	Usually retained while processing continues plus audit period.	High
Record of processing activities	Article 30 processing records and data maps	Retention schedule should reflect processing purposes and owners.	Keep current and archive superseded versions briefly.	High
Personal data breach documentation	Breach registers, investigation files, notifications	Requires retention of breach facts, effects and remedial action.	Often 6 years or longer for serious incidents.	High
Legal obligation, Dispute or claims management
Data subject rights request evidence	SAR files, identity checks, response logs, exemptions	Preserves evidence of timely and lawful responses.	Often 2 to 6 years after closure.	Medium
Legal obligation, Regulatory requirement
Marketing consent and PECR compliance	Consent logs, suppression lists, marketing preferences	Needs proof of consent and ongoing suppression.	Keep consent while relied on suppressions may be indefinite.	High
Dispute or claims management
Simple contract limitation period	Contracts, orders, invoices, correspondence, delivery records	Supports defence or enforcement of ordinary contract claims.	6 years from breach or contract end.	High
Deed or specialty limitation period	Deeds, guarantees, leases, settlement deeds, security documents	Longer claim window requires longer document retention.	12 years from breach or termination.	High
Tort claim limitation period	Incident files, advice records, product records, service logs	Retains evidence for negligence and civil wrong claims.	Usually 6 years, subject to special rules.	High
Personal injury claim limitation	Accident reports, risk assessments, training and PPE records	Injury claims may arise after incident or knowledge date.	At least 3 years often longer for defence.	High
Latent damage longstop	Professional advice, design, construction and engineering files	Hidden defects can extend practical evidence needs.	Up to 15 years longstop in negligence.	High
Dispute or claims management, Legal obligation
Litigation hold or preservation duty	Potentially relevant documents, emails, chats, logs and backups	Suspends deletion where proceedings or disclosure are likely.	Until dispute and appeal risk end.	High
Legal obligation
Corporation tax records	Company tax returns, calculations, ledgers, receipts	Tax evidence must be available for HMRC enquiries.	Normally 6 years from financial year end.	High
Companies Act accounting records	Accounting records, invoices, receipts, asset records	Companies must retain accounting records for statutory periods.	Private companies 3 years public companies 6 years.	High
VAT recordkeeping	VAT invoices, returns, credit notes, import and export records	VAT evidence must support returns and inspections.	Usually 6 years.	High
Legal obligation, Regulatory requirement
Making Tax Digital records	Digital VAT records and digital links	Requires retention in compliant digital form.	Aligns with VAT retention, usually 6 years.	High
Legal obligation
PAYE payroll records	PAYE records, tax codes, payments, deductions, reports	HMRC requires payroll evidence after tax year end.	3 years from tax year end.	High
National Minimum Wage records	Pay calculations, hours, rates, deductions, worker records	Evidence needed for wage compliance and HMRC enforcement.	At least 6 years for records after April 2021.	High
Working time records	Hours records, opt-outs, night work, rest records	Shows compliance with working time limits and obligations.	2 years from creation.	High
Right to work check evidence	Right to work copies, online check confirmations	Evidence supports statutory excuse against civil penalties.	Employment duration plus 2 years.	High
Regulatory requirement, Legal obligation
Sponsor licence recordkeeping	Sponsored worker documents, contact details, absence records	Sponsor compliance depends on available worker records.	Follow Home Office guidance often employment plus audit period.	High
Dispute or claims management
Employment tribunal claim risk	Personnel files, grievance, disciplinary and dismissal records	Short tribunal limits still require evidence retention.	Often 6 years after employment ends.	High
Equality Act claim risk	Recruitment, promotion, pay, grievance and adjustment records	Supports defence of discrimination and equal pay claims.	Often 6 to 7 years for employment evidence.	High
Legitimate business need, Dispute or claims management
Recruitment decision evidence	Applications, CVs, interview notes, shortlists, test results	Balances discrimination claim defence against data minimisation.	Usually 6 to 12 months longer with consent or dispute.	Medium
Legal obligation, Dispute or claims management
Health and safety compliance evidence	Risk assessments, training, inspections, maintenance, PPE records	Evidence demonstrates compliance and supports injury claim defence.	Often 3 to 6 years longer for hazardous exposure.	High
Accident book records	Accident book entries and workplace incident records	Supports statutory accident recording and injury claim handling.	At least 3 years from entry.	High
Legal obligation
RIDDOR reports	Reportable injuries, diseases and dangerous occurrence records	Requires traceable records of reportable workplace events.	At least 3 years.	High
COSHH health surveillance records	Exposure records, health surveillance, medical records	Long-latency occupational disease evidence needs long retention.	Health records commonly 40 years.	High
Asbestos exposure records	Asbestos exposure, medical surveillance and monitoring records	Very long latency disease risk requires extended retention.	Medical records 40 years exposure records often 40 years.	High
Legal obligation, Dispute or claims management
Employers liability insurance certificates	Employers liability insurance certificates and policies	Helps identify insurer for historic workplace injury claims.	Indefinite retention recommended for older liabilities.	High
Legal obligation
Fire safety risk assessment records	Fire risk assessments, drills, alarm tests, maintenance logs	Proves fire safety management and review history.	Keep current and superseded versions for several years.	High
Statutory company registers	Registers of members, directors, secretaries and PSCs	Core legal evidence of ownership and company administration.	Long-term some registers effectively permanent.	High
Legal obligation, Audit or assurance
Company minutes and resolutions	Board minutes, shareholder resolutions, written resolutions	Records corporate decisions and authority.	At least 10 years often permanent for key decisions.	High
Annual accounts and audit trail	Annual accounts, directors reports, audit reports	Supports statutory filing, audit and stakeholder review.	Usually 6 years or longer for corporate history.	High
Legal obligation, Regulatory requirement
AML customer due diligence records	CDD, KYC, transaction records, risk assessments, SAR records	Regulated firms must retain AML evidence for inspection.	5 years after relationship or transaction ends.	High
Suspicious activity report handling	Internal reports, MLRO decisions, SAR submissions, consent requests	Needs secure retention and strict access controls.	Usually at least 5 years under AML controls.	High
UK sanctions compliance evidence	Screening results, licences, frozen asset reports, decisions	Supports OFSI reporting, licensing and enforcement response.	Often 6 years or longer for regulated firms.	High
Regulatory requirement, Audit or assurance
FCA regulated firm records	Client files, advice records, compliance monitoring, complaints	FCA rules often prescribe record retention by activity.	Commonly 5 years, 6 years, or indefinite depending record.	High
Regulatory requirement, Dispute or claims management
Financial services complaint records	Complaint files, final responses, redress calculations	Firms must evidence complaint handling and outcomes.	At least 3 years or 5 years depending activity.	High
Regulatory requirement
MiFID investment services records	Orders, transactions, communications, client instructions	Investment firms need reconstructable transaction evidence.	Often 5 years up to 7 years if requested.	High
Legal obligation, Regulatory requirement
Pension scheme administration records	Member data, contributions, benefit calculations, trustee records	Members may need evidence decades after employment.	Long-term, often member lifetime plus years.	High
Automatic enrolment pension records	Assessment, opt-out, contributions and enrolment records	Employers must prove pension duties were met.	Usually 6 years opt-out notices 4 years.	High
Charity accounting records	Charity accounts, trustees minutes, donations, grants	Charities must evidence stewardship and reporting compliance.	Usually 6 years 3 years for some smaller charities.	High
Legal obligation
Gift Aid declaration records	Gift Aid declarations, donor details, claim schedules	HMRC may check charity tax relief claims.	6 years after last claimed donation.	High
Legal obligation, Regulatory requirement
Public records management code	Public authority administrative and operational records	Public bodies need structured appraisal, retention and transfer.	Varies includes transfer or destruction schedules.	High
Legal obligation, Audit or assurance
Freedom of Information request records	FOI requests, searches, exemptions, responses, review files	Public authorities need audit trail of request handling.	Often 3 to 6 years after closure.	Medium
Environmental information request records	EIR requests, environmental datasets, responses, exemptions	Public bodies need evidence of access request compliance.	Often 3 to 6 years after closure.	Medium
Regulatory requirement, Audit or assurance
NHS records management code	Health records, social care records, administrative records	Sets sector-specific health and care retention schedules.	Varies widely many health records 8 years or longer.	High
Legal obligation, Legitimate business need, Dispute or claims management
Safeguarding records	Child protection concerns, referrals, incident logs, case files	Records may be needed for future safeguarding or inquiries.	Often until age 25 or longer serious cases longer.	High
Legal obligation, Legitimate business need
School pupil records	Pupil files, attendance, SEN, safeguarding, assessment records	Schools need sector schedules for pupil lifecycle records.	Often until age 25 for core pupil files.	High
Legal obligation, Regulatory requirement
Building safety golden thread	Building design, safety case, approvals, change records	Higher-risk building information must be accurate and available.	For building lifecycle and occupation period.	High
Legal obligation
CDM health and safety file	Health and safety file, design risk information, maintenance data	File must be available for future works and maintenance.	For life of structure or project relevance.	High
Legal obligation, Dispute or claims management
Product safety traceability	Batch records, technical files, test reports, recalls	Supports recalls, safety investigations and liability defence.	Often product lifecycle plus 10 years or more.	High
Legal obligation, Contractual requirement, Dispute or claims management
Consumer rights and warranty claims	Sales records, warranties, returns, refunds, complaint correspondence	Evidence supports statutory consumer remedies and disputes.	Usually up to 6 years for claims.	High
Contractual requirement, Dispute or claims management, Legitimate business need
Insurance claim and coverage evidence	Policies, claims files, notifications, loss adjuster reports	Records prove coverage, notification and claim value.	Policy term plus limitation period long-tail claims longer.	High
Legitimate business need, Contractual requirement, Dispute or claims management
Intellectual property ownership evidence	Assignments, licences, invention records, design files, brand use	Preserves proof of ownership, use and licensing rights.	Life of IP right plus limitation period.	High
Property title and lease evidence	Title deeds, leases, licences, rent reviews, surveys	Records evidence property rights and occupation obligations.	Ownership or lease term plus 12 years for deeds.	High
Legal obligation, Audit or assurance, Dispute or claims management
Public procurement audit trail	Tender documents, evaluation scores, award decisions, contracts	Supports transparency, challenge defence and audit review.	Usually contract term plus 6 years deeds 12 years.	High
Contractual requirement, Audit or assurance
Grant funding terms	Grant agreements, claims, evidence, outputs, monitoring reports	Funders often impose audit and clawback record duties.	Often 6 years after grant closure terms may vary.	Medium
Audit or assurance, Regulatory requirement
Audit working papers	Audit files, testing evidence, management letters, confirmations	Auditors and organisations need evidence of assurance work.	Often at least 5 to 6 years.	Medium
Audit or assurance, Legitimate business need
Internal audit and risk assurance	Internal audit reports, risk registers, control testing	Shows governance, control improvements and assurance history.	Often 6 years, longer for major findings.	Medium
Legitimate business need, Audit or assurance, Dispute or claims management
Cyber incident and security logging	Security logs, SIEM alerts, incident tickets, forensic images	Retention must support detection, investigation and breach evidence.	Often 6 to 12 months for logs incidents longer.	High
Contractual requirement, Audit or assurance, Legitimate business need
ISO management system evidence	Policies, risk assessments, audit results, corrective actions	Certification audits require controlled documented information.	Certification cycle plus evidence period, often 3 years.	Medium
Legitimate business need, Dispute or claims management
Customer complaint handling	Complaints, responses, refunds, remedial action, correspondence	Supports trend analysis, service improvement and dispute defence.	Usually 2 to 6 years depending claim risk.	Medium
Contractual requirement, Legitimate business need, Dispute or claims management
Supplier contract management	Supplier contracts, SLAs, due diligence, performance reviews	Records prove obligations, performance and termination rights.	Contract term plus 6 years deeds 12 years.	High
Legal obligation, Contractual requirement, Audit or assurance
Processor contract and due diligence records	DPAs, SCCs, due diligence, audits, subprocessors	Shows compliant outsourcing and processor oversight.	Contract term plus limitation period.	High
Legal obligation, Audit or assurance
International data transfer evidence	IDTAs, SCCs, transfer risk assessments, safeguards	Demonstrates lawful restricted transfers and safeguards.	While transfer continues plus audit period.	High
Legal obligation, Dispute or claims management, Legitimate business need
Whistleblowing report records	Disclosure reports, investigation files, outcomes, retaliation evidence	Requires secure retention for investigation and employment claims.	Often 6 years after closure longer if serious.	High
Legal obligation, Dispute or claims management, Audit or assurance
Fraud and bribery investigation evidence	Investigation files, gifts registers, due diligence, approvals	Evidences prevention procedures and investigation response.	Often 6 years serious matters longer.	High
Legal obligation, Audit or assurance
Modern slavery compliance records	Statements, supplier due diligence, risk assessments, training	Supports transparency statement and supply chain assurance.	Often 6 years for audit trail.	Medium
Legal obligation, Regulatory requirement
Environmental permit compliance records	Monitoring results, waste transfers, emissions, permit reports	Permit conditions may require specific retention and reporting.	Often 6 years permit conditions may differ.	High
Legal obligation
Waste transfer notes	Waste transfer notes and waste descriptions	Shows lawful transfer and duty of care compliance.	At least 2 years.	Medium
Hazardous waste consignment notes	Consignment notes and hazardous waste returns	Evidence supports hazardous waste duty of care.	Usually 3 years.	Medium
Legal obligation, Audit or assurance
ESOS compliance evidence	Energy audits, calculations, lead assessor records, notifications	Qualifying organisations need evidence for compliance audits.	At least 2 compliance periods recommended.	Medium
Legal obligation, Regulatory requirement
Clinical trial master file retention	Trial master files, consent, protocol, safety reports, data	Research records must support inspection and participant safety.	Often at least 5 years longer for advanced therapies.	High
Regulatory requirement, Legal obligation
Pharmacovigilance records	Adverse event reports, safety databases, signal assessments	Supports medicine safety monitoring and regulator inspection.	Long-term often product authorisation plus 10 years.	High
Legal obligation, Regulatory requirement
Food safety traceability records	Supplier, batch, delivery, recall and HACCP records	Enables food traceability, withdrawals and recalls.	Depends product shelf life often 6 months to 5 years.	High
Drivers hours and tachograph records	Tachograph data, duty rosters, drivers hours records	Transport operators must evidence drivers hours compliance.	At least 12 months working time records often 2 years.	High
Regulatory requirement, Audit or assurance
Vehicle operator maintenance records	Inspection sheets, defect reports, maintenance and repair records	Operator licence compliance depends on maintenance evidence.	Often at least 15 months.	High
Legal obligation, Regulatory requirement
Export control records	Export licences, end-user undertakings, shipping and screening records	Supports licence compliance and regulator inspection.	Often at least 4 years licence terms may vary.	High
Legal obligation
Customs import and export records	Customs declarations, commercial invoices, shipping documents	HMRC may inspect trade and duty evidence.	Usually 4 years for customs records.	High
Contractual requirement
Contractual retention clauses	Project records, deliverables, audit evidence, service reports	Customer or supplier contracts may set minimum periods.	As agreed commonly 6 or 7 years.	High
Legitimate business need, Audit or assurance
Business continuity evidence	BCP plans, tests, incident logs, recovery reports	Records show resilience testing and response capability.	Often 3 to 6 years for test and incident evidence.	Medium
Legitimate business need, Contractual requirement, Dispute or claims management
M&A and corporate transaction records	Due diligence, warranties, disclosure letters, completion bibles	Supports warranty, indemnity and ownership evidence.	Often 6 to 12 years or permanent for key records.	High
Legal obligation, Dispute or claims management
Insolvency and restructuring evidence	Creditor files, board papers, transactions, forecasts, asset records	Supports investigations, creditor claims and director conduct review.	Often 6 years or longer after insolvency closure.	High
Legal obligation, Contractual requirement
Employee share scheme tax records	Option grants, exercises, valuations, EMI notifications, returns	Supports tax reporting and employee entitlement evidence.	Often 6 years after tax year or scheme end.	Medium
Legitimate business need, Legal obligation, Dispute or claims management
CCTV footage retention	CCTV footage, access logs, incident clips, disclosure logs	Retention should be short unless incident footage is needed.	Often 30 days incidents retained until resolved.	Medium
Legitimate business need, Dispute or claims management
Physical security access logs	Visitor logs, badge records, door access logs	Retention should match security and investigation needs.	Often 3 to 12 months incidents longer.	Medium
Legitimate business need, Legal obligation, Dispute or claims management
Worker monitoring evidence	Device logs, email monitoring, productivity and location records	Requires proportionate retention and clear privacy justification.	Short retention unless needed for investigation or compliance.	High
Legitimate business need, Dispute or claims management, Audit or assurance
Email and collaboration record value	Emails, Teams or chat records, attachments, shared files	Retention should preserve records, not entire mailboxes unnecessarily.	Varies by content transitory messages short.	High
Legitimate business need, Audit or assurance
Backup and disaster recovery copies	System backups, snapshots, archives, restore media	Backup cycles must not undermine deletion commitments.	Often 30 days to 12 months depending recovery needs.	High
Legal obligation, Legitimate business need
Archiving, research and statistics exemption	Research datasets, anonymised analytics, statistical records	Longer retention may be allowed with safeguards and minimisation.	Potentially extended if safeguards and purpose limits apply.	Medium
Regulatory requirement, Dispute or claims management, Legal obligation
Regulatory investigation hold	Notices, correspondence, evidence packs, investigation files	Deletion should pause when regulator enquiries are active.	Until enquiry closes plus appeal or limitation period.	High

What Drives Record Retention Periods In The UK?

UK retention policies are usually driven by a combination of limitation periods, tax and accounting duties, employment law, sector regulation, and data protection storage limitation. The strongest practical anchors are often 6 years for ordinary contract claims and many tax/accounting records, 12 years for deeds and specialty contracts, and longer periods for health and safety, pensions, safeguarding, regulated financial services, and corporate constitutional records.

How Should A UK Retention Policy Balance GDPR And Legal Hold Requirements?

The UK GDPR does not prescribe fixed retention periods, but it requires personal data to be kept no longer than necessary. A policy should therefore identify the specific driver for each record category, set a default deletion point, and include a legal hold override where litigation, regulatory investigation, audit, insurance notification, or a subject access request requires preservation.

Which Records Commonly Need Longer Retention?

Company registers, constitutional records, board approvals and major transaction records may need long-term or permanent retention because they evidence corporate existence, authority and ownership.
Tax, VAT, PAYE, payroll and accounting records commonly require at least 6 years, with special rules for some VAT and tax situations.
Employment, health and safety, accident, exposure, pension and safeguarding records may need extended retention because claims can arise years later and statutory or regulatory expectations may be lengthy.
Regulated financial services, anti-money laundering and sanctions records should reflect FCA, AML and UK sanctions requirements, not only general commercial limitation periods.

What Should Be Documented In A Data Retention Policy?

A strong UK policy should map each record type to a retention basis, retention period, trigger date, owner, disposal method, and exceptions. It should also explain how the organisation handles archived records, back-ups, litigation holds, statutory registers, audit trails, and personal data minimisation.

UK Retention Drivers and Policy Considerations

Want to Generate Your own Data Retention and Records Management Policy?

Docaro AI can help you write your own Data Retention and Records Management Policy for use in the United Kingdom in minutes.

Generate Your Document Now

FAQs

What is a UK data retention policy?

A UK data retention policy sets out how long an organisation keeps records, why they are retained, who is responsible, and how records are securely deleted or archived.

What drives data retention periods in the UK?

Does UK GDPR specify exact retention periods?

How should organisations decide how long to keep records?

What is records management?

Show All FAQs