Document Retention & Compliance – United Kingdom (UK)

In the United Kingdom, document retention rules are not overseen by a single authority.
Instead, responsibility is shared across several regulators, depending on document type and purpose.

HM Revenue & Customs (HMRC) — Tax & Accounting Records

HMRC oversees retention requirements for business and tax records, including accounting documents, VAT records, payroll information, and other tax-related data. UK companies must keep these records for minimum statutory periods — typically at least 6 years after the end of the relevant financial period, and in some cases longer if specified by law or review requests. HMRC may inspect or check records for compliance with tax obligations.

➡️ See official guidance on running a limited company and record obligations:

Information Commissioner’s Office (ICO) — Personal Data & GDPR

The ICO enforces data protection law, including the UK GDPR and the Data Protection Act 2018. It requires organisations to keep personal data no longer than necessary and to justify retention decisions. The ICO also expects organisations to manage retention schedules, review retained personal data regularly, and dispose of data securely in line with lawful purposes.

➡️ See ICO guidance on retention schedules:

Companies House — Statutory Registers & Corporate Records

Companies House enforces corporate recordkeeping under the Companies Act 2006. Certain statutory registers and company records must be retained for prescribed periods or for the lifetime of the company, such as member registers or director records, even if the business structure changes.

➡️ See Companies House Guidance:

The National Archives — Public Sector Records

For government and public authorities, The National Archives provides official guidance on retention and disposal policies. While this directly governs public bodies, private organisations can use it as a best-practice benchmark for records that may have historical or legal value.

Industry & Sector Regulators

In regulated sectors, additional authorities may set specific retention rules, such as:

FCA (Finance) — financial services records
HSE (Health & Safety) — safety and accident records
CQC (Care Quality Commission) — health and social care documentation

These apply on top of HMRC, ICO, and statutory record requirements.

How These Work Together

Retention compliance in the UK is not governed by a single authority. Instead, organisations must ensure that they meet the requirements of:

Tax and accounting law (HMRC)
Data protection Law (ICO / UK GDPR)
Company Law (Companies House / Companies Act)
Industry-specific regulations where applicable

A retention policy that accounts for all of these obligations helps organisations meet their legal, regulatory, and data protection duties without conflict.

Summary

In the UK, document retention requirements are set and enforced by multiple bodies — HMRC for tax and business records, the ICO for personal data protection, Companies House for corporate records, and various industry regulators.

Common UK Document Retention Periods (Indicative Guidance)

Table with UK Common Document Retention Periods

Beyond Retention Periods: What UK Organisations Must Also Consider

Document retention periods alone do not ensure compliance. UK regulators, auditors, and courts expect organisations to manage records in a way that preserves their integrity, evidential value, and lawful handling throughout the entire document lifecycle.

Retention defines how long documents are kept. Compliance depends on how those documents are managed while they are retained.

Information Integrity and Evidential Value (UK Context)

In the UK, documents are routinely relied upon as evidence during tax audits, employment disputes, contractual claims, regulatory inspections, and legal proceedings. For a document to carry evidential weight, organisations must be able to demonstrate that it is:

Accurate and complete
Protected from unauthorised alteration
Linked to a clear source and business context
Controlled through defined access and versioning
Supported by audit trails where appropriate

A document that has been retained for the correct period but cannot be trusted as authentic or reliable may offer little protection in practice.

Retention Must Be Balanced With UK GDPR Requirements

UK GDPR introduces additional obligations that directly affect retention decisions. Personal data must not be kept longer than necessary, even where minimum statutory retention periods apply.

Organisations must be able to justify:

Why a document is retained
How long it is retained for
When it will be reviewed or disposed of

Over-retention increases exposure during audits, data protection investigations, and legal discovery, and may itself constitute a compliance failure.

Demonstrating Compliance in Practice

UK regulators do not assess compliance based on intent alone. Organisations are expected to demonstrate control through evidence, which may include:

Documented retention policies and schedules
Defined ownership and accountability for records
Access controls aligned to business roles
Audit trails showing access, changes, and disposal
Consistent and secure disposal practices

Where controls cannot be evidenced, compliance is often assumed to be absent.

Why This Matters

In the UK, document retention is rarely overseen by a single regulator. Organisations must satisfy overlapping requirements from tax authorities, data protection regulators, company law, and industry-specific bodies.

A structured approach to document management and records management helps organisations apply retention rules consistently, preserve evidential value, and reduce compliance risk across all applicable obligations.