Business and archive document storage: UK retention rules explained

For any UK business generating paperwork — invoices, contracts, HR files, correspondence — a genuinely common question is how long records actually need to be kept before they can be safely destroyed, and it's a question that off-site archive storage answers a bit differently depending on the type of document involved. This is general information rather than legal advice, and a business with specific compliance concerns should check current guidance or take professional advice for its particular situation.

Under UK GDPR, the core principle is that personal data should be kept only for as long as necessary for the purpose it was originally collected — there's no single blanket retention period that applies to all personal data everywhere. Instead, organisations are expected to set their own retention periods for different categories of data, document the reasoning behind them, and be able to justify why a particular period was chosen if asked. This applies as much to a filing cabinet of paper HR records as it does to a digital database, and fines can apply for breaching retention principles even where the breach wasn't intentional.

Alongside this general GDPR principle, several more specific statutory retention periods commonly apply to particular categories of UK business records. General financial and corporate records — things like invoices, accounts and tax-related paperwork — are commonly required to be kept for at least 6 years, driven primarily by the Limitation Act 1980 and HMRC's own record-keeping requirements for tax purposes. Some categories carry considerably longer minimums: health-related records are commonly cited as needing at least 8 years, or 25 years where the record concerns a child, and construction records connected to building safety are commonly required to be kept for the entire lifetime of the building under the Building Safety Act 2022 — a genuinely long-term retention obligation for anyone in that sector.

Format matters too, and it's a detail worth planning storage around rather than discovering later. Certain documents — those bearing a notary seal or an original wet-ink signature being common examples — commonly need to be retained in physical form rather than simply scanned and shredded, meaning genuine physical archive storage remains a real business requirement even in an increasingly digital-first environment. Where records are stored digitally instead, they need to be protected against unauthorised access, accidental loss, damage or destruction — a requirement that applies whether records sit on an internal server or with a third-party digital storage provider.

For a business weighing up off-site archive storage against keeping records on-site, the practical case tends to rest on a few consistent points: freeing up expensive office space that would otherwise be taken up by boxes of ageing paperwork, better physical security and often better fire/flood protection than a standard office storeroom, and — provided retention periods and destruction dates are tracked properly — a cleaner audit trail showing exactly what's being kept, why, and for how long. Whichever route is chosen, the starting point is the same: work out which retention period actually applies to each category of record before deciding how, and for how long, to store it.

Frequently asked questions