# How long UK businesses must keep records: the legal minimums by record type

UK record retention by type: tax, VAT, payroll, minimum wage, working time, health and safety and anti-money laundering, plus UK GDPR's limits.

**In short:** There is no single UK retention rule. Among the main rules, legal minimums run from two years for working time records to 40 years for some health records. Six years covers company tax, VAT and minimum wage records, but PAYE records need only three.

Six years is the figure most people reach for when asked how long a UK business must keep its records. Several of the main rules do use it, but as a general answer it is wrong often enough to matter. There is no single retention law. Each type of record has its own rule, set by its own statute or regulator, and among the main rules covered here the legal minimums run from two years for working time records to 40 years for some health records.

Two further complications sit on top of that. Each period starts from a different event, so "six years" for VAT and "six years" for minimum wage records are not measured from the same day. And UK GDPR pushes in the opposite direction: personal data should not be kept longer than it is needed, so keeping everything forever is not a safe default either.

What follows sets out the main rules by record type, separates legal minimums from common practice, and notes where the law sets a ceiling as well as a floor. It describes the law as published on legislation.gov.uk and in official guidance in October 2026. It isn't legal advice, and contracts, insurers and sector regulators can ask for more.

## Where "six years" comes from

Several of the most widely used rules do land on six years. HMRC tells limited companies to keep records "for 6 years from the end of the last company financial year they relate to", and the legal basis is paragraph 21 of Schedule 18 to the [Finance Act 1998](https://www.legislation.gov.uk/ukpga/1998/36/schedule/18/paragraph/21), which runs to the sixth anniversary of the end of the return period, or an earlier day if HMRC specifies one in writing. HMRC's VAT record-keeping notice asks for "at least 6 years". Minimum wage records must be kept for six years. And under the [Limitation Act 1980](https://www.legislation.gov.uk/ukpga/1980/58/section/5), a claim for breach of an ordinary contract cannot be brought more than six years after the cause of action arose.

The coincidence makes six years a convenient default. But plenty of rules are shorter, some are much longer, and the clocks start at different points: the date a record was made, the end of a tax year, the end of a financial year, the end of a customer relationship or the date of the last entry.

## Tax and accounting records

For the self-employed, HMRC's guidance is to keep records "for at least 5 years after the 31 January submission deadline of the relevant tax year". Its own example: a 2022 to 2023 return sent online by 31 January 2024 means keeping the records until at least the end of January 2029. If the return goes in more than four years late, the records must be kept for 15 months after it is sent.

Companies face two separate rules, and they don't match. Section 388(4) of the [Companies Act 2006](https://www.legislation.gov.uk/ukpga/2006/46/section/388) requires accounting records to be preserved for three years from the date they are made by a private company, and six years by a public company. HMRC's corporation tax rule is six years from the end of the last company financial year, and longer if a transaction spans more than one accounting period, an asset is expected to last more than six years, the return was late or a compliance check is open. A private company that kept its books only for the Companies Act period would fall short of the tax requirement.

VAT has a wrinkle of its own. HMRC's [Notice 700/21](https://www.gov.uk/guidance/record-keeping-for-vat-notice-70021), section 2.4, says business records for VAT should generally be kept for at least six years, and that where this causes serious storage problems or undue expense HMRC may allow some records to be kept for a shorter period. The underlying power, paragraph 6(3) of Schedule 11 to the [Value Added Tax Act 1994](https://www.legislation.gov.uk/ukpga/1994/23/schedule/11/paragraph/6), lets HMRC require records to be preserved "for such period not exceeding 6 years" as it specifies. Six years is both what HMRC asks for and the most the Act allows it to ask.

Some company records have longer statutory periods. Minutes of directors' meetings must be kept for at least ten years from the date of the meeting ([section 248](https://www.legislation.gov.uk/ukpga/2006/46/section/248)), as must members' written resolutions and general meeting minutes ([section 355](https://www.legislation.gov.uk/ukpga/2006/46/section/355)).

## Payroll and employment records

Employment records are where the rules diverge most. HMRC's [PAYE guidance](https://www.gov.uk/paye-for-employers/keeping-records) asks employers to keep payroll records, including pay, deductions, reports and payments to HMRC, for three years from the end of the tax year they relate to. It points out that minimum wage and holiday records follow different rules.

The [National Minimum Wage Regulations 2015](https://www.legislation.gov.uk/uksi/2015/621/regulation/59), regulation 59(8), require records to be kept for six years, beginning with the day on which the pay reference period after the one they relate to ends. The six-year wording was substituted by amending regulations in force from 1 April 2021.

Working time records are kept for the shortest period of any rule here. Regulation 9 of the [Working Time Regulations 1998](https://www.legislation.gov.uk/uksi/1998/1833/regulation/9) requires records adequate to show compliance with the working time limits and the night work requirements, retained "for two years from the date on which they were made". Since 1 January 2024 an employer need not record each worker's daily hours if it can show compliance another way.

For right to work checks the period comes from Home Office guidance. The [employer's guide dated 1 October 2026](https://assets.publishing.service.gov.uk/media/6abd2b2c26660e5f62a7f193/FINAL_-_Employer_s_guide_to_right_to_work_checks.pdf) says copies should be kept for the duration of the worker's employment and for two years afterwards, then securely destroyed. Keeping them is what preserves the employer's statutory excuse against a civil penalty.

The Home Office has also measured how well employers follow that rule. Research carried out for it by Verian interviewed 2,152 employers by telephone and online between December 2023 and April 2024. The 542 who said they use an identity service provider for digital checks were asked how long they keep a record of the check. Only 24 per cent gave the correct answer, the length of employment plus two years. More than four in ten named a shorter period (36 per cent the length of employment only, 5 per cent one year after the check, 3 per cent six months), and 27 per cent named a longer one. These are employers' own answers, not a check of what they hold.

![Bar chart: of 542 employers using identity service providers, 24 per cent said they keep records for the correct period, 36 per cent for employment only and 27 per cent for longer.](https://unforged.ai/media/9c65f296d1e9-right-to-work-practice-1280.webp)

How long employers say they keep right to work check records. Source: Home Office, Employer awareness of, and self-reported compliance with, Right to Work checks (April 2025)

For recruitment records, the ICO's example is that, without a clear business reason, an employer should not keep unsuccessful applicants' records beyond the statutory period in which a claim arising from the recruitment could be brought. For discrimination complaints to an employment tribunal that period has just changed. Section 123 of the [Equality Act 2010](https://www.legislation.gov.uk/ukpga/2010/15/section/123) now gives six months from the act complained of, in place of three, after an amendment by the Employment Rights Act 2025 that came into force on 1 October 2026. The transitional provisions in [S.I. 2026/954](https://www.legislation.gov.uk/uksi/2026/954/regulation/4/made), regulation 4, mean the amendment does not apply where the act complained of happened before that date, so the three-month period still governs earlier acts. Tribunals can also extend either period where that is just and equitable.

## Health and safety

The longest periods covered here are in health and safety. Under [RIDDOR 2013](https://www.legislation.gov.uk/uksi/2013/1471/regulation/12), regulation 12, records of reportable incidents and over-three-day injuries must be kept for at least three years from the date of entry. The rules on hazardous substances go much further. Under the [COSHH Regulations 2002](https://www.legislation.gov.uk/uksi/2002/2677/regulation/11), a health surveillance record must be kept for at least 40 years from the last entry. Monitoring records that show the personal exposures of identifiable employees also have a 40-year period, and other monitoring records five years ([regulation 10](https://www.legislation.gov.uk/uksi/2002/2677/regulation/10)). The [Control of Asbestos Regulations 2012](https://www.legislation.gov.uk/uksi/2012/632/regulation/22) set the same 40 years for the health records of employees exposed to asbestos in licensable work.

## Money laundering and regulated firms

Businesses covered by the [Money Laundering Regulations 2017](https://www.legislation.gov.uk/uksi/2017/692/regulation/40), including banks and other financial institutions, external accountants, tax advisers, independent legal professionals and estate and letting agents, must keep customer due diligence records and enough transaction records to reconstruct each transaction. Regulation 40 sets the period at five years from when the firm knows, or has reasonable grounds to believe, that an occasional transaction is complete or a business relationship has ended. Transaction records within a relationship need not be kept for more than ten years.

Regulation 40 also does something most retention rules don't. Once the period expires, the firm must delete personal data obtained for the purposes of the regulations, unless an enactment or court proceedings require it to be kept, the person has consented, or the firm has reasonable grounds to believe it is needed for legal proceedings. Here the law sets a maximum as well as a minimum.

For FCA-regulated firms, [SYSC 9.1](https://handbook.fca.org.uk/handbook/sysc9/sysc9s1) requires a common platform firm to keep records of its MiFID business for at least five years, and sets the same minimum for insurance-based investment product records. For other business the FCA's guidance is that records should be retained "for as long as is relevant for the purposes for which they are made". For insurance-based investment products, COBS 9A.4 and COBS 10A.7 set record-keeping rules for suitability and appropriateness records that can require longer.

## Limitation periods: why practice runs longer than the law

Much of what businesses keep beyond the statutory minimums is kept for one reason: a claim might arrive. The Limitation Act 1980 does not tell anyone to keep anything. It sets how long someone has to sue, and so how long a document might be needed as evidence. In England and Wales the main periods are six years for simple contract ([section 5](https://www.legislation.gov.uk/ukpga/1980/58/section/5)) and tort ([section 2](https://www.legislation.gov.uk/ukpga/1980/58/section/2)), and twelve years for an action on a specialty, which includes a deed ([section 8](https://www.legislation.gov.uk/ukpga/1980/58/section/8)), and for recovering land ([section 15](https://www.legislation.gov.uk/ukpga/1980/58/section/15)). Personal injury claims have three years from the injury or, if later, from when the person knew of it ([section 11](https://www.legislation.gov.uk/ukpga/1980/58/section/11)). Negligence claims for latent damage have a 15-year longstop ([section 14B](https://www.legislation.gov.uk/ukpga/1980/58/section/14B)).

![Bar chart: personal injury claims have 3 years, contract and tort 6, deeds and land 12, and the negligence longstop is 15 years.](https://unforged.ai/media/a6d14b1cefc0-limitation-periods-1280.webp)

Main limitation periods in England and Wales, in years. Source: Limitation Act 1980, legislation.gov.uk

These periods are where common practices like "contract end plus six years" or "twelve years for anything signed as a deed" come from. They are risk decisions, not legal duties, and they don't apply across the UK: in Scotland most contractual obligations are extinguished after five years under section 6 of the [Prescription and Limitation (Scotland) Act 1973](https://www.legislation.gov.uk/ukpga/1973/52/section/6).

## The other direction: UK GDPR

Where records contain personal data, Article 5(1)(e) of [UK GDPR](https://www.legislation.gov.uk/eur/2016/679/article/5) adds a counterweight. Personal data must be kept in a form that identifies people "for no longer than is necessary for the purposes for which the personal data are processed".

The [ICO's guidance on storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/) is clear that UK GDPR sets no specific time limits for different types of data: it is for the organisation to decide and justify how long it keeps data. It expects a retention policy with standard periods where possible, and warns against keeping data "just in case". Data kept to meet a legal requirement, such as tax or health and safety records, is not kept for longer than necessary. Data kept to defend a possible claim should be deleted once such a claim could no longer arise. The ICO treats industry norms, such as the six years credit reference agencies keep consumer credit data, as a good starting point but not a guarantee of compliance. Data moved offline is still being processed, and deleting from a live system means deleting from its backups too.

The Home Office figures on right to work checks show both failure modes in one question: some employers saying they delete too early to keep their statutory excuse, others saying they keep check records for longer than the guidance supports.

> A retention schedule that only lists periods is half a schedule. For each record type, write down the trigger that starts the clock (date made, end of tax year, end of financial year, end of relationship, last entry) and whether the period is a legal minimum, a legal maximum or your own policy. The right period counted from the wrong starting point still gives the wrong date.

## Folio

Keeping a record for its full period and disposing of it when the period ends is the job [Folio](https://unforged.ai/folio/product) does. Each record is locked for as long as its retention class says, and when retention ends Folio disposes of it. A hold keeps records through a dispute, and every view and change is recorded with the reason given. Folio is designed to support record-keeping obligations under UK GDPR, and it is in private beta.

Folio is in private beta, and we'd love you to try it: [Join the beta](https://unforged.ai/contact?topic=other\&product=folio)

## Sources

- HMRC, [Business records if you're self-employed: how long to keep your records](https://www.gov.uk/self-employed-records/how-long-to-keep-your-records), GOV.UK
- HMRC and Companies House, [Running a limited company: company and accounting records](https://www.gov.uk/running-a-limited-company/company-and-accounting-records), GOV.UK
- HMRC, [PAYE and payroll for employers: keeping records](https://www.gov.uk/paye-for-employers/keeping-records), GOV.UK
- HMRC, [Record keeping for VAT (VAT Notice 700/21)](https://www.gov.uk/guidance/record-keeping-for-vat-notice-70021), last updated 18 March 2024
- [Finance Act 1998, Schedule 18, paragraph 21](https://www.legislation.gov.uk/ukpga/1998/36/schedule/18/paragraph/21)
- [Value Added Tax Act 1994, Schedule 11, paragraph 6](https://www.legislation.gov.uk/ukpga/1994/23/schedule/11/paragraph/6)
- Companies Act 2006, sections [248](https://www.legislation.gov.uk/ukpga/2006/46/section/248), [355](https://www.legislation.gov.uk/ukpga/2006/46/section/355) and [388](https://www.legislation.gov.uk/ukpga/2006/46/section/388)
- [National Minimum Wage Regulations 2015, regulation 59](https://www.legislation.gov.uk/uksi/2015/621/regulation/59)
- [Working Time Regulations 1998, regulation 9](https://www.legislation.gov.uk/uksi/1998/1833/regulation/9)
- Home Office, [Employer's guide to right to work checks, 1 October 2026](https://assets.publishing.service.gov.uk/media/6abd2b2c26660e5f62a7f193/FINAL_-_Employer_s_guide_to_right_to_work_checks.pdf)
- Home Office, [Employer awareness of, and self-reported compliance with, Right to Work checks](https://www.gov.uk/government/publications/employer-awareness-of-right-to-work-checks/employer-awareness-of-and-self-reported-compliance-with-right-to-work-checks), 1 April 2025
- [Equality Act 2010, section 123](https://www.legislation.gov.uk/ukpga/2010/15/section/123)
- [The Employment Rights Act 2025 (Commencement No. 5 and Transitional Provisions) (Amendment) Regulations 2026 (S.I. 2026/954), regulation 4](https://www.legislation.gov.uk/uksi/2026/954/regulation/4/made)
- [Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, regulation 12](https://www.legislation.gov.uk/uksi/2013/1471/regulation/12)
- Control of Substances Hazardous to Health Regulations 2002, regulations [10](https://www.legislation.gov.uk/uksi/2002/2677/regulation/10) and [11](https://www.legislation.gov.uk/uksi/2002/2677/regulation/11)
- [Control of Asbestos Regulations 2012, regulation 22](https://www.legislation.gov.uk/uksi/2012/632/regulation/22)
- [Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 40](https://www.legislation.gov.uk/uksi/2017/692/regulation/40)
- FCA Handbook, [SYSC 9.1 General rules on record-keeping](https://handbook.fca.org.uk/handbook/sysc9/sysc9s1)
- Limitation Act 1980, sections [2](https://www.legislation.gov.uk/ukpga/1980/58/section/2), [5](https://www.legislation.gov.uk/ukpga/1980/58/section/5), [8](https://www.legislation.gov.uk/ukpga/1980/58/section/8), [11](https://www.legislation.gov.uk/ukpga/1980/58/section/11), [14B](https://www.legislation.gov.uk/ukpga/1980/58/section/14B) and [15](https://www.legislation.gov.uk/ukpga/1980/58/section/15)
- [Prescription and Limitation (Scotland) Act 1973, section 6](https://www.legislation.gov.uk/ukpga/1973/52/section/6)
- [UK GDPR, Article 5](https://www.legislation.gov.uk/eur/2016/679/article/5)
- ICO, [Principle (e): storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/)