How Long to Keep Business Records in the UK: 12 Rules by Document

Sole traders keep tax records for 5 years after the 31 January filing deadline, limited companies for 6 years from the end of the financial year, VAT records for 6 years and PAYE and CIS records for 3 years after the tax year ends, and HMRC can charge up to £3,000 for each failure. Health and safety records run longer, up to 40 years for COSHH. This guide puts every period in one table, with the law behind it, and the rules that changed in 2026.

The carrier bag of receipts, the folder of invoices from a client who closed in 2021, the payslips from a cleaner who left: every owner has a pile and the same two questions. What has to be kept, and when can it go? The answers are scattered across a dozen Acts and regulations, the periods are counted from different dates, and getting it wrong costs either a penalty or a storage unit. Knowing how long to keep business records is a one-page job once somebody has done the reading.

Below is that page: the twelve retention rules a UK small business meets, the date each clock starts from, the penalties, what HMRC says about scans and fading receipts, the 2026 changes to digital records, company registers and tribunal time limits, and the admin an AI agent can run so the folder empties itself on the right day. Every period was checked on GOV.UK, legislation.gov.uk or the HSE site on 24 October 2026.

How we checked the periods

1. Statute first. Every row names the Act or regulation and the section, read on legislation.gov.uk, with the GOV.UK guidance page alongside.
2. The start date matters as much as the length. "Five years" from the filing deadline is not five years from the invoice, so each row says what the clock runs from.
3. The longest rule wins. Where a document is caught by two rules (a payslip is a PAYE record and a minimum-wage record), the table gives the longer period.
4. 2026 changes checked. Making Tax Digital for Income Tax, the company register changes of November 2025 and the tribunal time limit change of October 2026 all alter what to keep.
5. No invented periods. Where the law sets no period, the table says so and gives the ICO's or HMRC's own words instead.

The 12 rules in one table

Two corrections to what most online lists still say. There is no longer a legal duty to keep sickness-absence records for Statutory Sick Pay: it was revoked on 6 April 2014, although HMRC can still ask you to prove what you paid, and GOV.UK still lists sickness absence under the three-year PAYE rule. And company statutory registers are not "kept forever": since 18 November 2025 companies no longer need to hold their own registers of directors, secretaries, residential addresses or people with significant control (the information is filed at Companies House instead), while the register of members must still be kept and entries for former members can be removed after ten years.

Sole traders and partners: five years, from the deadline

The rule for the self-employed is five years after the 31 January submission deadline of the tax year the records relate to. The records for the tax year to 5 April 2026, filed by 31 January 2027, must therefore be kept until 31 January 2032. If you file more than four years late, the period becomes 15 months from the date you file. The records that count are the ones that support the return: sales invoices, receipts for expenses, bank statements, mileage logs, stock takes and the working papers that turn them into the figures on the form.

HMRC's guidance on companies, employers and contractors states a penalty of up to £3,000 for each failure to keep adequate records, and the self-employed pages point to the same power in the Taxes Management Act. HMRC's own manual says the full penalty is reserved for serious cases; the more common cost is an enquiry you cannot answer, which ends with HMRC's estimate of your profit rather than yours.

Limited companies: six years, and sometimes longer

Companies keep records for six years from the end of the financial year they relate to. The six years stretch when a transaction covers more than one accounting period, when an asset such as a van or a machine will still be in use after six years, when the Company Tax Return is filed late, or when HMRC has opened a compliance check: in each case the records are kept until the matter is closed. The Companies Act 2006 separately requires accounting records to be kept for three years (six for public companies), but HMRC's six-year rule governs in practice because the tax return relies on the same documents.

VAT: six years, digitally

VAT records, including the VAT account, sales and purchase invoices and import and export paperwork, are kept for six years, or ten years for sales made through the One Stop Shop. Since Making Tax Digital for VAT, the records must be held in software that links digitally to the return; HMRC's notice is explicit that manually transferring data between systems "is not acceptable". The practical consequence is that a six-year retention policy for a VAT-registered business is really a six-year software subscription, or a six-year archive of exported files that still open.

Employers: PAYE at three years, minimum wage at six

PAYE records go back three years from the end of the tax year: what you paid, what you deducted, reports sent to HMRC, employee leave and absences, and expenses and benefits. HMRC can estimate what you owe and charge up to £3,000 where the records are missing. Statutory maternity, adoption and paternity pay records follow the same three years.

The trap is the National Minimum Wage. Since 1 April 2021, records showing that each worker was paid at least the minimum rate must be kept for six years, counted from the end of the pay reference period after the one they cover. A payslip is therefore a three-year PAYE record and a six-year minimum-wage record at the same time; the longer period wins, so keep payroll for six years. Construction contractors keep CIS payment and deduction records for three years, with the same £3,000 penalty.

Health and safety: three years, and forty

The accident book is a three-year record, counted from each entry, and RIDDOR reports of serious injuries and dangerous occurrences are kept for three years from the date of the record. The long ones are the exposure records: health surveillance records under COSHH and health records under the asbestos regulations are kept for 40 years from the last entry, because the illnesses they are designed to catch appear decades later. Asbestos medical certificates are kept for four years and records of notifiable non-licensed asbestos work for 40 years. The asbestos register itself has no retention period in the regulations; the HSE expects it to be a living document, reviewed at least once a year.

Contracts and invoices: the six-year claim window

Tax law tells you when HMRC can ask; the Limitation Act 1980 tells you when a customer or supplier can sue. A claim for breach of a simple contract can be brought for six years from the breach, and a claim on a deed for twelve, so a contract, the quote it rests on and the invoices and correspondence that show what was delivered are worth keeping for six years after the job ends, whatever the tax rules say. This is the rule most owners miss, and it is the one that matters in a dispute: the email in which the client agreed the scope is evidence only if it still exists.

Personal data: no fixed period, but a written one

UK GDPR sets no number. The storage limitation principle says personal data must not be kept longer than necessary, and the ICO's guidance tells organisations to "establish and document standard retention periods" and to review them. Keeping data because the law requires it (tax, payroll, health and safety) is a necessary purpose; keeping a customer list "in case" is not. For job applicants the ICO gives no figure, only that records should not be kept beyond the period in which a claim could be brought. That period changed on 1 October 2026: the Employment Rights Act 2025 extended the Equality Act time limit for tribunal claims from three months to six for acts on or after that date, so the old habit of deleting unsuccessful applications after six months is now cutting it fine. Twelve months, written into the schedule, is the safer figure.

Scans, fading receipts and digital records in 2026

HMRC accepts scanned copies of paper records, and VAT Notice 700/21 together with the Compliance Handbook say the paper original can be discarded once the image is a complete and legible copy, including anything on the reverse. That is the answer to the carrier bag: photograph every receipt the week you get it, because the National Archives warns that text on thermal till paper "can disappear within a period of only a few years" and the receipt you need in year five may be blank.

The 2026 change is Making Tax Digital for Income Tax. From 6 April 2026, sole traders and landlords with qualifying income over £50,000 keep their records digitally and send quarterly updates from software, with the £30,000 group following in April 2027 and the £20,000 group in April 2028. The retention period is unchanged, five years after the 31 January deadline, but the records must now exist in a digital form, and the original invoices and receipts, or complete copies of them, still have to be kept behind the software entries.

How an AI agent keeps the folder honest

The periods are fixed; the work is the admin of applying them, and that is what an agent does well.

• Writes your retention schedule. Tell the agent your business type, whether you are VAT registered, whether you employ anyone and whether you work with hazardous substances, and it drafts the one-page schedule from the table above with your own dates filled in.
• Scans and files receipts as they arrive. Photograph the receipt, drop it in a project folder, and the agent names it by date, supplier and amount and logs it in the expenses sheet, so the thermal fade never matters.
• Sets the deletion reminders. A Jobbit automation can run on the first of each month, list what has passed its period and ask you to confirm the deletion, which is the review the ICO wants to see documented.
• Keeps the exports readable. When you change accounting software, the agent exports the six-year archive to open formats and checks the files still open.
• Answers the auditor. When HMRC asks for the records behind one figure, the agent finds the invoices, statements and working papers that support it from the project files.

ChatGPT, Claude, Gemini, Microsoft Copilot, Manus and Meta's Muse will all explain the rules if you ask. What they do not do is hold the files, run the monthly check and send the reminder. Jobbit's agent does those three from one project, and brings in a bookkeeper from its human network when a year-end needs one.

Your plan for this week

• Monday: write the schedule. Twelve rows, your dates. Use the table above and give each row an owner, even if the owner is you.
• Tuesday: photograph the pile. Every paper receipt from the last tax year, scanned and named. Discard the thermal paper once the image is complete.
• Wednesday: find the oldest file you must keep. For a sole trader that is the tax year to April 2021, due in January 2022 and kept until January 2027. Anything older than your schedule says can go.
• Thursday: check the six-year rows. Minimum-wage payroll, VAT and company records all run six years; make sure your software export or archive goes back that far.
• Friday: fix the applicant folder. Set a twelve-month deletion for unsuccessful applications and write it into the schedule, now that the tribunal limit is six months.

Read next

• How to Write a Receipt in the UK: 6 Things It Must Show, Free Template in One Message
• AI Policy for Small Business: A Free Template With 10 Rules Staff Will Actually Follow
• Self-Employed Expenses: 40 Things You Can Claim in 2026 (and 10 You Cannot)

Frequently asked questions

How long do I need to keep business records in the UK?

Five years after the 31 January filing deadline if you are self-employed, six years from the end of the financial year for a limited company, six years for VAT records and three years from the end of the tax year for PAYE and CIS records. Health and safety exposure records under COSHH run 40 years, and contracts are worth keeping six years after the job because that is how long a claim can be brought.

How long should a sole trader keep receipts?

Five years after the 31 January deadline of the tax year they belong to, so receipts for the year to April 2026 are kept until 31 January 2032. A photographed copy is fine as long as it is complete and legible, including anything on the back, and the paper can then go.

What is the penalty for not keeping business records?

HMRC can charge up to £3,000 for each failure to keep or preserve the records needed for a return, and HMRC's manual reserves the full amount for serious cases. The more common cost is an enquiry you cannot support, which ends with HMRC estimating your profit or your PAYE liability.

Can I keep business records digitally instead of on paper?

Yes. HMRC accepts scans and photographs as long as the copy is complete and legible, and VAT-registered businesses and, from April 2026, higher-earning sole traders and landlords must keep records digitally under Making Tax Digital. Keep the files in a format that will still open in six years and back them up.

How long should I keep CVs from people I did not hire?

UK GDPR sets no number; the ICO says not to keep them beyond the time in which a claim could be made. Since 1 October 2026 the Equality Act time limit for tribunal claims is six months rather than three, so a twelve-month retention period written into your schedule is the safer choice.

Do I have to keep paper copies of receipts?

No. HMRC's VAT notice and its Compliance Handbook both say the original can be discarded once a complete, legible image exists, and thermal receipts fade within a few years anyway. The quickest way to stay on the right side of every rule is to let an agent file each receipt the week you get it; Jobbit's agent does that from a photo, on the free plan with no card.