How Long Should a UK Business Keep Data Before Deleting It?
If a new customer has just asked how long you keep their data, you are in good company. It turns up in more procurement checks every year, and most business owners have no answer ready, because UK law gives you no delete-by date. It gives you a short list of records you must keep, most of them for six years, and one rule for everything else. Under the ICO's storage limitation principle, you keep personal data only for as long as you have a purpose for it. This post gives you the periods, the rule, and a way to make the deleting happen on its own.
Keeping everything is the risky option
Most business owners assume that keeping every email and file forever is the safe choice. UK law treats it the other way round. The ICO's guidance says you "should not keep data indefinitely 'just in case'". You must "be able to justify why you need to keep personal data". The ICO does not have to prove that you should have deleted something. You have to explain why you kept it.
Every business has a hoard. It is the folder for a client who left in 2018, still holding their team's contact details and a scan of somebody's passport. It is the mailbox of a team member who left three years ago, suspended because deleting felt too final. It is the CVs from a job you filled in 2022. None of it earns you anything, and all of it counts against you in a breach.
The fines at the top end are £17.5 million or 4% of worldwide turnover.
Which records does the law make you keep?
The best-known is HMRC's. A limited company must keep its company and accounting records for six years from the end of the financial year to which they relate. It is longer if a transaction spans two accounting periods, equipment will outlast six years, a return was late, or HMRC opened a check. Miss this and HMRC can fine you £3,000 or disqualify you as a director.
Company law stacks more on top. Board minutes are kept for ten years, and the register of members is kept for the life of the company. Payroll runs the other way. PAYE records only need three years, but National Minimum Wage records need six, so in practice you have a reason to keep both for six as they are related.
| Records Every UK Employer Must Keep, and for How Long | ||
| Record | Shortest period the law allows | Where the rule comes from |
|---|---|---|
| Company and accounting records | Six years from the end of the financial year they relate to. Longer in a few cases, listed above. | HMRC. Up to £3,000 fine, or disqualification as a director. |
| Board minutes and resolutions | Ten years from the date of the meeting or resolution. | Companies Act 2006. |
| Register of members | For the life of the company. | Companies Act 2006. |
| PAYE records | Three years from the end of the tax year they relate to. | HMRC. Penalty of up to £3,000. |
| National Minimum Wage records | Six years from the end of the following pay reference period. | National Minimum Wage Regulations, enforced by HMRC. |
| Right to Work checks | The full length of employment, then two years after the person leaves. | Home Office. Civil penalty of up to £60,000 per worker. |
| Pension auto-enrolment records | Six years. Opt-out notices four years. Scans are acceptable. | The Pensions Regulator. |
| Annual leave and holiday pay records (from 6 April 2026) | Six years, whether or not the team member still works for you. | Employment Rights Act 2025. Failing to keep them is a criminal offence. |
Does your regulator add its own rules?
Accountants, solicitors, estate and letting agents, and tax advisers come under the Money Laundering Regulations 2017. Customer due diligence records are kept for five years after the transaction is completed or the relationship ends, and never more than ten. Regulation 40 then goes further than most people expect. Once the period expires, you "must delete any personal data obtained for the purposes of these Regulations", unless another law says otherwise.
FCA-regulated firms have their own list, with some pension records kept indefinitely and most others for three or five years. Whatever your regulator says takes precedence over the general periods here, so check their requirments first.
What about the data nobody makes you keep?
Most of what your business holds has no legal period at all. Client project files, prospect lists, chat history, and the day-to-day emails of every team member fall into this group. You decide how long they stay, and the ICO expects you to say why.
The reason that holds up is a claim you might have to defend. In England and Wales, the Limitation Act 1980 provides six years to bring a claim for a simple contract and twelve years for a deed. Keeping a client's contract and the emails behind it for six years after the work ends is a reason you can write down. The same goes for accident records and insurance correspondence.
The reason that does not hold up is "you might need to defend a claim" applied to everything. It covers the signed contract. It does not cover eight years of a client's routine emails, their team's personal details, or the photos from a site visit. None of those help you in court.
A useful test is to write one sentence explaining why you still have something, without using the word "just". If the sentence will not come, the data has no purpose, and the storage limitation principle says it should be deleted.
How does Kimbley IT make the deleting happen?
Nobody puts a reminder in their diary to delete a client folder in six years' time, so the deleting has to be automatic. Google Vault, which is part of Google Workspace by Kimbley IT, does two jobs, and almost nobody knows they have it.
The first job is retention rules. You tell Vault how long to keep a category of data, and when the period is up the data is deleted. The rules cover Gmail, Drive, Chat, Calendar, Groups, and the Gemini app. Leavers' mailboxes might get a 90-day rule, closed client projects a twelve-month rule, and payroll records a six-year rule. Kimbley IT sets these up from the retention schedule you agree on together.
The second job is the opposite. If a dispute starts, Vault can place a hold on specific data so it is kept even where a rule would have deleted it. A few years ago a client's business partner produced an email with a date that would have triggered a £250,000 liability. The team member who sent it was certain the date had been altered. Vault found the original in minutes, and Kimbley IT exported it with the metadata showing the change. The claim was dropped.
Vault is a retention and discovery tool. It is not a backup. If a team member accidentally deletes a file, Vault will not restore it, so you still need a separate backup.
What should you do?
Split your data into four groups. What the law makes you keep, what your regulator makes you keep, what you choose to keep with a written reason, and the hoard.
Take the legal and regulated periods as given. Use the table above and your regulator's figures. When two rules cover the same record, keep the one with the longer match.
Write one sentence for everything you choose to keep. If you cannot write it without the word "just", the period is zero.
Clear the hoard in one sitting. A clear-out that turns into a six-week project with a weekly meeting never finishes. Set aside a morning, go through the ex-client folders, suspended mailboxes, and old CVs, and delete.
Frequently asked questions
-
Email has no retention period of its own. An email that is part of an accounting, contract, or HR record inherits that record's period, usually six years. Everything else should be deleted when it has no ongoing purpose. Setting a default retention rule for mailboxes, with longer rules for specific labels, is the practical way to manage it.
-
Keep payroll and holiday records for six years and Right to Work checks for two years after they leave. Their mailbox and personal files have no statutory period, so choose a short one, typically thirty to ninety days, move anything the business needs, and delete the rest.
-
There is no statutory period. Six months after the role closes is the common choice, because that is the time limit for bringing a discrimination claim at an employment tribunal. Keeping CVs longer needs a reason, such as the candidate agreeing to be considered for future roles.
-
The ICO says a small organisation doing occasional, low-risk processing may not need a documented policy. In practice, a one-page schedule is worth writing. Customers and their procurement teams increasingly ask for it before signing, and it is your evidence if the ICO asks why you hold something.
-
No. Google Vault retains data for a set period, preserves it under legal hold, and lets you search and export it. It does not restore files or emails deleted by accident. You need a separate backup for that alongside your Vault retention rules.
The periods in this post were checked in September 2026 and apply to most UK businesses. Kimbley IT is an IT support provider, not a firm of solicitors, so confirm the periods for your own records before you rely on them.
Book a call
If you want help putting this into practice, book a video call with Kimbley IT using the form below. Kimbley IT can draft your retention schedule with you, set up the matching Vault rules, and show you the rules running.
