The Archive You Are Liable For: A Director’s Schedule for Keeping Less and Proving More
Photo: R. Milverton Drake, Public domain, via Wikimedia Commons
As at 12 November 2026, most owner-managed companies are holding more records than they need, in more places than they realise. The instinct to keep everything is understandable. Paper feels harmless, and digital storage appears cheap. In practice, an uncontrolled archive creates cost, slows down responses to advisers and regulators, and increases data-protection risk. A retention schedule is therefore not a filing-room project. It is a board-level control over what the company can prove, what it must keep and what it should no longer hold.
Retention is a governance decision
UK GDPR requires personal data to be kept no longer than is necessary for the purpose for which it is processed. That principle applies to payroll files, customer records, recruitment notes, marketing lists and even the unstructured contents of shared drives and email inboxes. Separately, company, tax and payroll law set minimum periods for certain records. Those minimums are a floor, not a target. Keeping every record indefinitely is rarely justified and can be harder to defend than a documented, consistent policy.
For a director, the practical question is simple: if the company were asked to justify a record today, could it explain why it still exists, who can access it and when it will be destroyed? If the answer is no, the record is part of an uncontrolled archive.
Start with the statutory floor
The periods below are indicative and should be checked against current guidance and the company’s own circumstances. They are not a substitute for professional advice where a dispute, enquiry or sector-specific rule applies.
- Accounting records: a private company must generally keep adequate accounting records for three years from the date they are made; a public company for six years.
- Corporation Tax: supporting records should generally be kept for six years from the end of the accounting period.
- VAT: records should generally be kept for six years, although HMRC can require longer in some cases.
- Payroll and PAYE: records should generally be kept for three years after the end of the tax year to which they relate.
- Contracts: a practical default is six years after the contract ends for simple contracts in England and Wales, and twelve years for deeds. Scotland has different limitation rules, so advice should be taken where relevant.
- Insurance: policies and claims correspondence should be kept for the policy period and any claims limitation period, not simply until renewal.
- Company registers and statutory books: these should be maintained for as long as the company exists, with certain historic entries kept for statutory periods after a change.
- Board and shareholder minutes: keep permanently, or at least for the life of the company plus a prudent period, because they evidence decisions that may be challenged years later.
The key discipline is to distinguish between a minimum retention period and a justified retention period. A record may be kept longer than the minimum if there is a clear reason, such as an ongoing warranty, a pension obligation or a known dispute. That reason should be recorded.
A one-page schedule that a small team can use
A retention schedule does not need to be elaborate. It needs to be owned, reviewed and followed. A workable format is:
| Record type | Minimum retention | Clock starts | Owner | Disposal method |
|---|---|---|---|---|
| Accounting records and ledgers | 3 years for a private company; 6 years for tax support | Date made or end of accounting period | Finance lead | Secure deletion or shredding |
| VAT returns and supporting invoices | 6 years | End of VAT period | Finance lead | Secure deletion or shredding |
| Payroll, PAYE and RTI records | 3 years after end of tax year | End of relevant tax year | Payroll lead | Secure deletion or shredding |
| Customer and supplier contracts | 6 years after end; 12 years for deeds | Contract end or breach | Director or operations lead | Secure deletion |
| Insurance policies and claims | Policy period plus claims limitation period | Policy expiry or claim closure | Operations lead | Secure deletion |
| Company registers and minutes | Permanent while company exists | Date of entry | Company secretary or director | Restricted archive |
| HR and recruitment records | 6 years after employment ends, subject to advice | End of employment | HR lead | Secure deletion |
| Marketing consents and lists | Until consent withdrawn or purpose ends | Consent or last engagement | Marketing lead | Secure deletion |
The schedule should also state where each record class is held: paper cabinet, server, cloud platform, email, accountant’s system or archive box. A record that cannot be located cannot be managed or destroyed reliably.
Apply the storage-limitation test
Before retaining any record that contains personal data, ask four questions. What is the purpose for keeping it? Is that purpose still live? Who needs access? What is the destruction date? If the purpose has ended and no legal or contractual reason remains, the default should be deletion. This is particularly important for HR files, customer correspondence, CCTV, visitor logs and unstructured email archives.
The test should be applied consistently. A company that keeps every email but destroys invoices early is not controlled; it is simply inconsistent. The schedule should cover both paper and digital records, including backups and shared drives.
When deletion must pause
A retention schedule must never become a licence to destroy evidence. Routine deletion should be suspended when a legal hold is triggered. Common triggers include a threatened or active claim, an HMRC enquiry, an ICO investigation, an employment tribunal, an insolvency process, an insurance claim or a contractual warranty dispute. The hold should identify the relevant record classes, the people who must preserve them and the date it was imposed. It should be lifted only when the matter is closed and the decision is recorded.
In a small company, the director should be told immediately when a dispute or enquiry begins, so that automatic deletion does not defeat the company’s own position. Preservation includes metadata, email threads and versions, not just final documents.
Secure disposal a small team can actually follow
Disposal should be simple enough to happen without a project team. A five-step routine is usually sufficient:
- Classify the records and confirm the retention period has expired.
- Check for any legal hold, dispute, enquiry or insurance notification.
- Destroy paper by cross-cut shredding or a certified confidential waste provider, and digital records by secure deletion from all locations, including shared drives and backups where practicable.
- Record what was destroyed, when, by whom and under which schedule entry.
- Sample-check the result and keep the destruction certificate or log.
Where an external provider is used, the company should confirm its security controls and obtain evidence of destruction. For digital records, deleting a file from a laptop is rarely enough if copies remain in email, cloud sync, backup or a former employee’s account.
Make the schedule stick
A retention schedule works when one person owns it, one calendar prompts its review and one log records exceptions. Review it annually, and whenever the company changes accountant, payroll provider, insurer or cloud platform. Include it in induction for new staff and in the exit routine for leavers. The aim is not an empty archive. It is an archive the company can explain, defend and control. Larsen Howie’s view is that good records management is less about storage and more about discipline: keep what has a purpose, destroy what does not, and be able to prove the difference.
