# How long can you keep personal data under UK GDPR? The law sets no single time limit, so the decision, and the reason for it, sit with you. The Assurance Desk. Published 22 October 2026. Last checked 22 October 2026. Part of the guide [What are the UK GDPR principles? All seven, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md). **The short answer.** UK GDPR sets no single time limit for keeping personal data. Article 5(1)(e) says you keep it only as long as your purpose needs it. The ICO says you must be able to justify the period you choose ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5) and [ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). ## Does UK GDPR say how long to keep data? No. UK GDPR does not set a time limit for each type of data. The ICO says the choice is yours, based on how long your purposes need the data ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). The rule behind this is storage limitation, one of the [UK GDPR principles](/guides/uk-gdpr-seven-principles). Article 5(1)(e) says personal data must be kept in a form that identifies people for no longer than is necessary for its purposes ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 22 October 2026). You also carry the proof. Article 5(2) makes the controller, the organisation in charge of the data, responsible for showing that it meets the principles ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 22 October 2026). The ICO says its storage limitation guidance is under review because of the Data (Use and Access) Act, so the detail may change ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). ## How long should you keep common business records? Common business records often have a period set by another UK rule, not by UK GDPR. The ICO says keeping data to meet a legal requirement, such as tax or audit records, is not keeping it too long ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). The table shows records most UK employers hold, with the period GOV.UK gives for each. It is not a full list, and your sector may have its own rules ([GOV.UK, PAYE and payroll for employers: Keeping records](https://www.gov.uk/paye-for-employers/keeping-records), [GOV.UK, Running a limited company: your responsibilities: Company and accounting records](https://www.gov.uk/running-a-limited-company/company-and-accounting-records), [GOV.UK, Checking a job applicant's right to work](https://www.gov.uk/check-job-applicant-right-to-work) and [GOV.UK, The National Minimum Wage and Living Wage: Employers and the minimum wage](https://www.gov.uk/national-minimum-wage/employers-and-the-minimum-wage), checked 22 October 2026). Keeping too little also causes problems. Without full payroll records, GOV.UK says HMRC may estimate what you owe and charge a penalty of up to £3,000 ([GOV.UK, PAYE and payroll for employers: Keeping records](https://www.gov.uk/paye-for-employers/keeping-records), checked 22 October 2026). **Common employer records and the periods GOV.UK gives for them** | Record | How long to keep it | Note | | --- | --- | --- | | PAYE payroll records | 3 years from the end of the tax year they relate to | Minimum wage records follow a different rule | | Records proving you paid the minimum wage, created on or after 1 April 2021 | At least 6 years, counted from the last day of the pay reference period after the one they cover | Paper or computer records are both fine | | Limited company accounting records | 6 years from the end of the last company financial year they relate to | Longer in some cases, such as equipment expected to last more than 6 years | | Copies of right to work documents | During the person's employment and for 2 years after they stop working for you | GOV.UK also says to follow data protection law | Source: GOV.UK, PAYE and payroll for employers: Keeping records, https://www.gov.uk/paye-for-employers/keeping-records (checked 22 October 2026); GOV.UK, The National Minimum Wage and Living Wage: Employers and the minimum wage, https://www.gov.uk/national-minimum-wage/employers-and-the-minimum-wage (checked 22 October 2026); GOV.UK, Running a limited company: your responsibilities: Company and accounting records, https://www.gov.uk/running-a-limited-company/company-and-accounting-records (checked 22 October 2026); GOV.UK, Checking a job applicant's right to work, https://www.gov.uk/check-job-applicant-right-to-work (checked 22 October 2026) ## How long should you keep employee records? Employee records have no single period under UK GDPR. Parts of the file have their own rules, such as payroll records and right to work copies ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), [GOV.UK, PAYE and payroll for employers: Keeping records](https://www.gov.uk/paye-for-employers/keeping-records) and [GOV.UK, Checking a job applicant's right to work](https://www.gov.uk/check-job-applicant-right-to-work), checked 22 October 2026). When someone leaves, the ICO gives an example. The employer should delete what it is unlikely to need again, such as emergency contact details, previous addresses or death-in-service beneficiary details ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). Then there are job applicants you did not hire. The ICO says not to keep their recruitment records beyond the legal period for bringing a claim about the recruitment. The exception is a clear business reason ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). ## What is a data retention policy, and do you need one? A data retention policy, or retention schedule, lists the records you hold, what you use them for and how long you plan to keep them ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). The ICO describes it as a document that sets out how you manage, store and delete records. If a law makes you keep something for a set time, record that reason in the policy ([ICO, Common data protection mistakes (and how to fix them)](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/common-data-protection-mistakes-and-how-to-fix-them/), checked 22 October 2026). A small organisation doing occasional low-risk processing may not need a written policy. It must still review its data regularly, and delete or anonymise what it no longer needs ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). The ICO's starting point is simple. Have a reason to keep information, not a reason to get rid of it. Do not keep data just in case you might use it one day ([ICO, Common data protection mistakes (and how to fix them)](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/common-data-protection-mistakes-and-how-to-fix-them/) and [ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). ## What should you do when the retention period ends? When a retention period ends, the ICO says review whether you still need the data. Erase or anonymise it unless there is a clear reason to keep it for longer ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). Deleting means deleting everywhere. The ICO says that if you delete data from a live system, you should also delete it from that system's backups. Backups and archives need their own retention periods ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/) and [ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 22 October 2026). An email moved to a Deleted items folder has not been deleted, the ICO says. Destroy personal data securely ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/) and [ICO, Common data protection mistakes (and how to fix them)](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/common-data-protection-mistakes-and-how-to-fix-them/), checked 22 October 2026). **At the end of a retention period** 1. Review: Check whether you still need the data for its purpose. 2. Keep only with a reason: Keep it longer only with a clear justification, such as a legal requirement. 3. Erase or anonymise: Delete the data, or anonymise it so it no longer identifies anyone. 4. Include the backups: Delete it from backups of the same system, which have their own retention periods. The order follows ICO guidance on storage limitation. Source: ICO, Principle (e): Storage limitation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/ (checked 22 October 2026); ICO, How do we find and retrieve the relevant information?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/ (checked 22 October 2026) ## How does retention affect subject access requests and breaches? Retention affects a [subject access request](/guides/subject-access-request-what-to-do), where a person asks for a copy of their data. The ICO says the request covers the information you hold when it arrives ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 22 October 2026). Old data makes requests harder. The ICO says it may be more difficult to answer one if you kept information too long. Searching thousands of old documents takes longer than searching a few hundred current ones ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/) and [ICO, Common data protection mistakes (and how to fix them)](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/common-data-protection-mistakes-and-how-to-fix-them/), checked 22 October 2026). Routine deletion can carry on while you deal with a request. Deleting or changing data only because of the request is not acceptable. Under the DPA, the ICO says, changing requested information to stop it being disclosed is an offence ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 22 October 2026). You do not need to rebuild data you deleted as part of your normal records management to answer a request ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 22 October 2026). UK GDPR Article 5(1)(f) requires appropriate security for personal data, including against accidental loss. The ICO adds that the more personal data you hold, the more security you need ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5) and [ICO, Common data protection mistakes (and how to fix them)](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/common-data-protection-mistakes-and-how-to-fix-them/), checked 22 October 2026). If old records are lost or stolen, our guide to [when to report a personal data breach](/guides/personal-data-breach-when-to-report) sets out the next steps. For payroll, GOV.UK says tell HMRC as soon as possible if you do not have records and cannot replace them ([GOV.UK, PAYE and payroll for employers: Keeping records](https://www.gov.uk/paye-for-employers/keeping-records), checked 22 October 2026). ## What to do 1. List the personal data you hold, what you use it for and how long you plan to keep each type ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). 2. Check GOV.UK for any period another UK rule sets, such as payroll or company records ([GOV.UK, PAYE and payroll for employers: Keeping records](https://www.gov.uk/paye-for-employers/keeping-records) and [GOV.UK, Running a limited company: your responsibilities: Company and accounting records](https://www.gov.uk/running-a-limited-company/company-and-accounting-records), checked 22 October 2026). 3. Write your reasons in a retention policy, unless your processing is occasional and low risk ([ICO, Common data protection mistakes (and how to fix them)](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/common-data-protection-mistakes-and-how-to-fix-them/) and [ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). 4. At the end of each period, erase or anonymise what you no longer need, including copies in backups ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), checked 22 October 2026). 5. Tell staff not to delete or change data because a subject access request has arrived ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 22 October 2026). ## Common questions ### Can you keep personal data forever under UK GDPR? Not as a general rule. The ICO says not to keep data indefinitely just in case. The exception is data kept only for public interest archiving, research or statistics ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 22 October 2026). ### Is there a 6 year rule for keeping data under UK GDPR? No. UK GDPR sets no period. A 6 year period comes from other rules, such as limited company accounting records and minimum wage records ([ICO, Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), [GOV.UK, Running a limited company: your responsibilities: Company and accounting records](https://www.gov.uk/running-a-limited-company/company-and-accounting-records) and [GOV.UK, The National Minimum Wage and Living Wage: Employers and the minimum wage](https://www.gov.uk/national-minimum-wage/employers-and-the-minimum-wage), checked 22 October 2026). ## Where next - [What are the UK GDPR principles? All seven, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md) - [DSAR: what to do when a subject access request arrives](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md) - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md) - [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md) - [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md) ## Sources - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/5 (checked 22 October 2026) - ICO, Principle (e): Storage limitation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/ (checked 22 October 2026) - GOV.UK, PAYE and payroll for employers: Keeping records: https://www.gov.uk/paye-for-employers/keeping-records (checked 22 October 2026) - GOV.UK, Running a limited company: your responsibilities: Company and accounting records: https://www.gov.uk/running-a-limited-company/company-and-accounting-records (checked 22 October 2026) - GOV.UK, Checking a job applicant's right to work: https://www.gov.uk/check-job-applicant-right-to-work (checked 22 October 2026) - GOV.UK, The National Minimum Wage and Living Wage: Employers and the minimum wage: https://www.gov.uk/national-minimum-wage/employers-and-the-minimum-wage (checked 22 October 2026) - ICO, Common data protection mistakes (and how to fix them): https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/common-data-protection-mistakes-and-how-to-fix-them/ (checked 22 October 2026) - ICO, How do we find and retrieve the relevant information?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/ (checked 22 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.