Most UK businesses keep too much of the wrong thing for too long, and not enough of the right thing for long enough. The rules aren’t complicated – they’re just spread across HMRC, Companies House, GDPR and employment law. This guide pulls them into one place so you can clear out the loft (or the cloud storage) without binning the receipts that matter.
The headline retention periods
For most UK small businesses, four numbers do almost all the work. Sole trader and partnership tax records: at least 5 years from the 31 January Self Assessment submission deadline. Limited company records: at least 6 years from the end of the accounting period. VAT records: 6 years (10 years if you’re on the One Stop Shop / mini-OSS). PAYE records: 3 years from the end of the tax year. Companies House registers (members, directors, PSC) run throughout the life of the company plus 10 years after entries cease.
What “records” actually means
HMRC isn’t prescriptive about format, but the categories matter. Sales invoices and receipts. Purchase invoices and expense receipts. Mileage logs and travel records. Bank and credit card statements. VAT invoices and the digital trail back to source records (mandatory under MTD). Payroll records (employee details, payments, deductions). Statutory company registers for a Ltd – members, directors, PSC. Asset register for capital items. The principle is that the records should be sufficient to substantiate the figures on every return you submit, with enough detail that a third party could reconstruct the return from them.
HMRC’s digital records rules
Photographs and scans of receipts are explicitly accepted, provided the image is legible. Digital records must be searchable and retrievable for the full retention period. Cloud-based accounting software counts, provided the data remains accessible if HMRC asks – which means you shouldn’t simply close a software account at the end of a year and assume you’ve still got the records. Export before cancelling.
When to keep records longer
Several situations push retention beyond the headline minimum. An open HMRC enquiry – keep everything until the enquiry is closed. Suspected error or fraud – HMRC can go back up to 20 years. Property purchase – keep all related records until at least 6 years after disposal. Capital allowances on long-life assets – keep until disposal. Pension records for an employer – typically 6 years after the member leaves service, often longer in practice.
GDPR cross-considerations
UK GDPR pulls in the opposite direction from HMRC: it requires that personal data not be kept longer than necessary for the purpose. There is no conflict with tax retention, because complying with HMRC retention is itself a lawful basis (legal obligation). But once the HMRC retention period ends, GDPR requires you to delete or anonymise personal data unless another lawful basis applies. The instinct of “just keep everything forever” is a GDPR exposure as well as a storage cost. Set a retention policy per data category, review annually, and act on it.
Practical storage approaches
For most small UK businesses, the right answer is cloud-first. A dedicated business folder structure on Google Drive, Dropbox, or within your accounting software, with a consistent naming convention – YYYY-MM-DD_supplier_invoiceNumber makes search trivial. Bank statements: most banks now hold seven or more years online; download and back up annually. Receipts: photograph at the point of expense using your accounting tool’s mobile app. Annual archive: at the end of each tax year, package the closed year into a clearly-labelled folder ready to reach for if HMRC asks.
What you can safely delete (after the retention period)
Once the retention period has lapsed, you can delete: routine receipts and expense records older than 6 years (Ltd) or 5 years (sole trader); old payroll detail (after 3 years from end of tax year); marketing campaign data once the contractual or consent retention period has ended; drafts of contracts where the final signed version exists elsewhere; routine email correspondence not relating to ongoing matters.
What never to delete
Some records you keep effectively for the life of the business, or until well after their underlying matter is closed. Statutory company registers. Original signed contracts (until well after performance and any limitation period has expired). Property records (until well after disposal). Anything subject to an ongoing legal or HMRC matter. Pension records – typically the member’s lifetime plus 6 years.
Frequently asked questions
The questions UK businesses ask most often about how long to keep records.
Can I throw away paper receipts if I have digital scans?
Yes. HMRC accepts digital copies provided they're legible and retrievable for the full retention period. Many accounting tools (FasCash included) capture receipts via phone and store them attached to the transaction record. Once the digital copy is in place, the paper original can go.
Are bank statements alone enough, or do I need to keep the underlying receipts too?
You need both. The bank statement shows that money moved; the receipt or invoice shows what for and at what VAT treatment. HMRC can ask to see the receipt for any expense that supports a tax deduction.
My company has been struck off. Do I still need to keep its records?
Yes. Records relating to a struck-off company should be retained for the same period as if the company were still trading. HMRC can investigate up to 6 years (or longer for fraud) regardless of company status. The records typically pass to whoever was the last director.
How long do I keep records for an employee who has left?
PAYE records (payroll, NI, tax codes) for 3 years from the end of the tax year. Employment contracts and disciplinary records typically 6 years after employment ends (limitation period for breach of contract claims). Pension records longer — often the employee's lifetime plus 6 years.
Do I need to keep records for cancelled invoices that were never paid?
Yes — they're still part of your business records and the corresponding non-payment may have tax implications (bad debt relief for VAT, write-off for Corporation Tax). Keep them for the same retention period as paid invoices.
Can I keep records on Google Drive or Dropbox?
Yes, provided access is reliable for the full retention period and the records are searchable and retrievable. Most accountants now operate cloud-first. The risk to manage: account closure, password loss, or the platform discontinuing service. Regular backups to a second location are sensible.
How long do I need to keep records for HMRC vs GDPR purposes?
They're different. HMRC sets minimum retention (5/6/3 years depending on type). GDPR sets maximum retention ('only as long as necessary'). For tax records, the HMRC minimum is your justification under GDPR. Once the HMRC period ends, you typically must delete or anonymise unless you have another lawful basis.
I'm switching accounting software. What records should I export first?
Everything: chart of accounts, transaction history, attached receipts, invoices issued, bank reconciliations, VAT submissions, payroll records, asset register. Export to a format that doesn't depend on the software (CSV, PDF). Many platforms make full data export easy; some make it deliberately hard. Plan for this before you sign up to a new tool.
