Which Business Records Must You Keep for Six Years in the UK?

Most business owners know they should be keeping records. Fewer know exactly which ones, for how long, or what HMRC can do about it if the answer turns out to be wrong. For the majority of tax and accounting documents, the minimum period is six years. This article sets out what that covers, where the exceptions are, and what you should do with records once their time is up.

Where the Six-Year Rule Comes From

Two pieces of legislation are largely responsible for the six-year standard.

HMRC’s VAT and Corporation Tax rules require businesses to hold supporting records so that tax returns can be checked in the event of an enquiry. HMRC can go back six years where errors are the result of carelessness, and further still in cases of deliberate non-compliance.

The Limitation Act 1980 gives a claimant six years from the date of a breach to bring a contract claim in England and Wales. That means you need documentary evidence available for the same period if you want to be able to defend one.

VAT Records

All VAT-registered businesses must retain their VAT records for a minimum of six years from the date of issue or the end of the VAT period concerned. HMRC’s VAT Notice 700/21 is clear about what that includes:

• VAT invoices issued and received
• Credit notes and debit notes
• Purchase and sales daybooks
• VAT account summaries
• Till rolls and daily gross takings records
• Import and export documentation

Businesses using Making Tax Digital are also required to keep digital copies of their VAT records for six years. The format has changed but the retention period has not.

Corporation Tax and Accounting Records

HMRC requires private limited companies to keep accounting records and all supporting documents for six years from the end of the financial year they relate to. Annual accounts, management accounts, ledgers, bank statements, invoices, and expense records all fall within that.

There is one point that regularly causes confusion. The Companies Act 2006 permits private companies to dispose of accounting records after three years. HMRC’s Corporation Tax rules require six. The longer period applies for tax purposes, so applying a six-year standard across all financial records is the correct approach and the one most accountants will advise.

Business Contracts and Agreements

Contracts, purchase orders, warranties, and related correspondence should be kept for at least six years after they expire or are ended. The reason is the limitation period under the Limitation Act 1980. If a dispute arises over a contract, the other party has six years to bring a claim. You need your records to be available for that entire window. Where a contract was executed as a deed, the limitation period extends to twelve years.

Statutory Registers and Company Records

Statutory registers, including the register of members, register of directors, and minutes of general meetings, must be maintained for the lifetime of the company. These sit outside the standard six-year framework and should be treated as permanent records.

Records With Shorter Retention Periods

Not everything requires six years.

PAYE and payroll records must be kept for three years after the end of the tax year they relate to, in accordance with HMRC’s guidance for employers. That covers P11s, P60s, P45s, payroll summaries, and records of statutory payments such as Statutory Sick Pay and Statutory Maternity Pay. Where records may be relevant to redundancy calculations or potential employment tribunal claims, separate obligations can apply under employment law and it is worth taking specific advice in those situations.

Construction Industry Scheme records, including payment and deduction statements, subcontractor contracts, and verification documents, must be retained for three years after the end of the relevant tax year.

Sole traders and partners completing a self assessment tax return must keep their records for five years and ten months after the end of the tax year they relate to. In practice that means records should be in place until January of the sixth year following the tax year. HMRC publishes the detail on GOV.UK. Where a return is filed late, records should be kept for fifteen months after the date of filing.

Sector-Specific Requirements

Some industries have requirements that go beyond the standard framework. Charities must keep accounting records and fundraising documentation for six years or more under Charity Commission regulations. Accident and injury reports under RIDDOR must be retained for three years. Pension records and occupational health records can carry significantly longer obligations. Businesses in regulated sectors should always verify the specific rules that apply to them.

Retention Periods at a Glance

The Penalties for Getting It Wrong

HMRC can impose a fixed penalty of up to £3,000 for each accounting period in which records are found to be inadequate. That is per period, not a single one-off charge. A warning will often come first, but repeated or serious failures can lead to formal assessment, higher tax demands, and the loss of reliefs a business would otherwise be entitled to claim.

Company directors face separate exposure under the Company Directors Disqualification Act 1986 if statutory records are missing. Businesses without adequate documentation are also at a significant disadvantage in any tax enquiry or commercial dispute, with no paper trail to fall back on.

Disposing of Records Once the Retention Period Ends

Holding onto records past their retention date creates problems of its own. Under the UK GDPR, personal data must not be kept for longer than is necessary for the purpose for which it was collected. Expired records containing personal information should be destroyed promptly and securely.

For paper documents, cross-cut shredding is the appropriate method. Strip cutting offers a lower level of protection and should be avoided for anything sensitive or confidential. Shredding services should operate in accordance with BS EN 15713, the British Standard for the secure destruction of confidential material. It covers the collection, transportation, and destruction process, and any reputable provider will issue a Certificate of Destruction for each job. That certificate should be filed and kept as part of your compliance records.

Digital storage media requires the same care. Deleting files does not remove the underlying data. Hard drives and USB drives should be securely overwritten using specialist software or physically destroyed. Putting old equipment in the recycling is not an acceptable option where it holds confidential business data.

Documents awaiting destruction should be held in locked, tamper-evident containers until they are collected or destroyed on site. A log should be kept recording what was destroyed, when, and by whom.

Building a Retention Policy That Works

A written retention policy is the most practical way to stay on top of these obligations consistently. It does not need to be a lengthy document. A good policy covers the main categories of records the business holds, assigns a retention period to each one drawn from HMRC guidance and any sector-specific rules, sets a point in the year for a review, defines the approved method of disposal for each record type, and names the person responsible for keeping it current.

Reviewing it once a year is enough for most businesses. The important thing is that it exists in a form that staff can follow, rather than being left to individual judgement.

Shredsec: Secure Document Shredding for UK Businesses

When records reach the end of their retention period, secure disposal is not optional.

Contact Shredsec for a free assessment of your document disposal requirements.

Sources: HMRC VAT Record Keeping | GOV.UK: Running a Limited Company | Limitation Act 1980 | HMRC: PAYE for Employers | GOV.UK: Self Assessment | ICO: UK GDPR

Contact Shredsec to discuss your shredding requirements.