Document retention for accountants: how long to keep what.

Document retention for accountants is two separate questions. How long must your client keep their records, and how long should your firm keep its own copies? The answers come from different rules, and they're rarely the same number.

This guide explains the difference between working copies and records, and what HMRC, Companies House, the money laundering regulations and UK GDPR say about how long to keep each. It ends with a simple policy outline you can adapt. It's written for UK firms and is general information, not legal or tax advice.

Working copies and records are different things

Most files that pass through a practice fall into one of three groups. Sorting them first makes every retention question easier.

• Your client's records. Bank statements, invoices, receipts, payslips. The law usually puts the duty to keep these on the client: the taxpayer, the company or the employer.
• Your firm's records. Working papers, the accounts and returns you prepared, correspondence, engagement letters and due diligence files. These are yours to keep, under your own rules and your professional body's.
• Working copies. The files a client uploads or emails so you can do the job. They sit in inboxes, shared folders, downloads and collection tools. Once you've filed what you need, they're duplicates.

ICAEW's document retention helpsheet makes the same split. It says original records will usually be kept by the client and returned as soon as practicable, with the firm keeping copies as appropriate. It also suggests firms keep their own copies for its indicative periods, plus anything their insurer asks for, in case of a claim.

The working copies are the group most firms forget. They're also the easiest to delete, once the right version is safely filed.

How long the rules say to keep records

The periods below are what each source says on the date shown. Most are duties of your client, not your firm. Each has exceptions, so read the source before relying on it.

HMRC: individuals and the self-employed

GOV.UK sets out three periods for Self Assessment records:

• Self-employed and partners: business records for at least 5 years after the 31 January submission deadline for the tax year.
• Other individuals, returns on time: at least 22 months after the end of the tax year the return is for.
• Other individuals, returns sent late: at least 15 months after the return was sent.

Checked on 21 October 2026 against Business records if you're self-employed and Keeping your pay and tax records.

HMRC: companies, VAT and payroll

• Company records for Corporation Tax: 6 years from the end of the last company financial year they relate to. GOV.UK lists cases where it's longer, such as a late Company Tax Return, an open compliance check, or assets expected to last more than 6 years. Source: Company and accounting records.
• VAT records: at least 6 years, and longer under some schemes. Source: Keeping VAT records.
• PAYE records: 3 years from the end of the tax year they relate to. Minimum wage and holiday pay records have their own rules. Source: PAYE: keeping records.

All three checked on 21 October 2026.

Companies House: the Companies Act 2006

Section 388 of the Companies Act 2006 says a company's accounting records must be kept for 3 years from the date they're made for a private company, and 6 years for a public company.

That's shorter than HMRC's period for the same records. Meeting the Companies Act period doesn't mean the company has met HMRC's. Checked on 21 October 2026 against Companies Act 2006, section 388.

The money laundering regulations

If your firm is supervised for anti-money laundering, regulation 40 of the Money Laundering Regulations 2017 applies to your own due diligence records:

• What to keep: copies of the documents and information you got to meet customer due diligence, and enough supporting records to reconstruct a transaction.
• For how long: 5 years from when you know, or have reasonable grounds to believe, that the business relationship has ended or an occasional transaction is complete.
• A ceiling: transaction records within a business relationship don't have to be kept for more than 10 years.
• Then delete: once the period ends, you must delete personal data obtained for the regulations, unless a listed exception applies, such as another law, court proceedings or the person's consent.

The last point matters. The regulations don't just set a minimum: they expect the personal data to go when it ends. Checked on 21 October 2026 against regulation 40. Your supervisor's guidance may add detail.

UK GDPR: storage limitation

UK GDPR doesn't give a number. Article 5(1)(e) says personal data must be kept no longer than necessary for the purposes it's processed for. The ICO's guidance on storage limitation says:

• you must be able to justify how long you keep personal data, based on your purposes
• you need a policy with standard retention periods where possible
• you should review what you hold and erase or anonymise what you no longer need
• your policy should allow for early deletion when a record isn't being used

Checked on 21 October 2026 against the ICO's Principle (e): Storage limitation. The ICO notes the page is under review after the Data (Use and Access) Act, so check it again before you finalise a policy.

For who's responsible for client documents under UK GDPR, and what to ask the tools you use, see GDPR and collecting client documents.

Why a collection tool shouldn't be your archive

However you collect documents, the route in is a poor place to keep them for years. That's true of an inbox, a shared folder or a dedicated collection tool.

It's not where your records live

Your practice management, document management or accounts software is where your team looks for a file in three years' time. It's where your backups, access rules and retention policy already apply. Files left in a collection route sit outside all of that.

It keeps copies nobody is managing

Every month that working copies stay put, there's more personal data to protect and more to search when someone makes a subject access request. The ICO points to both: extra storage and security costs, and requests that are harder to answer.

Its retention isn't your decision unless you make it one

ICAEW says firms using cloud storage need clear contracts, and providers should follow the firm's retention and destruction policies. Ask any tool you use:

• how long it keeps uploaded files, and from when
• whether you can change that period
• whether it warns you before deleting anything
• how you get everything out, in one go
• what stays after files are deleted, and in backups for how long

If the answers aren't clear, assume the files stay until someone deletes them.

A simple retention policy outline

The ICO expects standard retention periods written down where possible. A short policy that people follow beats a long one nobody reads. Fill in your own periods: the ones that apply depend on your clients, your services, your supervisor and your insurer.

Copy the outline

DOCUMENT RETENTION POLICY: [FIRM NAME]
Owner: [name]          Last reviewed: [date]

1. SCOPE
   Client records we hold, our working papers, due diligence
   files, correspondence and working copies.

2. WHERE EACH TYPE LIVES
   Client records and working papers: [system]
   Due diligence files: [system]
   Working copies arrive in: [inbox / shared folder / tool]

3. RETENTION PERIODS
   [Record type]: [period] from [event]. Source: [rule or body].
   [Record type]: [period] from [event]. Source: [rule or body].

4. WORKING COPIES
   Filed into [system], then deleted from where they arrived
   within [period] of the job being finished.

5. HOLDS
   [Name] can pause deletion for a complaint, claim or enquiry.
   Record the reason and the date it ends.

6. DELETION
   How: [method, including backups and old devices]
   Recorded in: [log]

7. WHAT WE TELL CLIENTS
   Summary in our engagement letter and privacy notice.

8. REVIEW
   Every [12] months, and when rules or our PI policy change.

Keep your periods tied to a source in section 3. When someone asks why you kept or deleted a file, that line is your answer.

How to do this in GarnerDocs

GarnerDocs keeps uploaded files only as long as your firm chooses, then deletes them.

• A period you choose. Pick 30 days, 90 days, 180 days or 1 year, counted from when a request is completed. GarnerDocs suggests 90 days for collection, but the right period is your firm's decision. An owner or admin confirms it before any request can be sent.
• Two warnings before anything goes. The owner, and admins who keep the emails on, get one 14 days and one 3 days before deletion, then a notice afterwards. Shortening the period never deletes files with less than 14 days' notice.
• Everything in one ZIP. Download all files puts every file in folders by document, with earlier versions and a manifest.csv of review decisions, ready to file in your own system.
• Delete early once it's filed. Delete files now removes a completed request's files straight away, after you confirm you've saved what you need. It can't be undone, and copies leave backups within 30 days.
• The record stays. The request, file names, review decisions and history remain after the files go, so you can still see what was asked for and when.

See How long files are kept.

Sources

• Business records if you're self-employed: how long to keep your records, GOV.UK. Checked on 21 October 2026.
• Keeping your pay and tax records: how long to keep your records, GOV.UK. Checked on 21 October 2026.
• Running a limited company: company and accounting records, GOV.UK. Checked on 21 October 2026.
• Charge, reclaim and record VAT: keeping VAT records, GOV.UK. Checked on 21 October 2026.
• PAYE and payroll for employers: keeping records, GOV.UK. Checked on 21 October 2026.
• Companies Act 2006, section 388, legislation.gov.uk. Checked on 21 October 2026.
• Money Laundering Regulations 2017, regulation 40, legislation.gov.uk. Checked on 21 October 2026.
• Principle (e): Storage limitation, ICO. Checked on 21 October 2026.
• Document retention helpsheet, ICAEW. Checked on 21 October 2026.

This guide is general information, not legal or tax advice. Check the rules that apply to your firm and each client, and take advice before you rely on a period.