GDPR data retention periods: how long can you keep personal data?

UK GDPR does not set a universal retention period. This guide explains purpose-based retention, selected requirements in other UK laws and how to document and review a proportionate schedule.

UK GDPR's storage limitation principle is purpose-led. Keep identifiable information only for as long as necessary for the lawful purposes for which it is processed. Other legislation and the circumstances of particular records can affect the period.

That principle is easy to state and harder to operationalise. This guide covers how the storage limitation principle works, what other UK laws require for specific record types, and how to build a retention schedule that demonstrates compliance to the ICO.

The short answer

UK GDPR contains no fixed retention periods for personal data. The storage limitation principle in Article 5(1)(e) requires that data is kept in a form which permits identification of individuals “for no longer than is necessary for the purposes for which the personal data are processed”.

The work of compliance is therefore in two parts. First, you define your purposes and what data you need for each. Second, you set a retention period that matches each purpose, document it, and follow it.

Longer retention solely for public-interest archiving, scientific or historical research, or statistical purposes is possible with the required safeguards. It is not a blanket permission to keep all information indefinitely or reuse it for unrelated purposes.

The storage limitation principle in detail

Article 5(1)(e) of the UK GDPR is the source of the obligation. It requires personal data to be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.

Three points are worth unpacking:

“No longer than is necessary” is purpose-led. The legal question is whether you still need the data for a specific, lawful purpose. If the answer is no, you must delete or anonymise it. Holding data “just in case it might be useful later” is not a lawful purpose.

Genuinely anonymised information falls outside UK GDPR where identification is not reasonably likely in the relevant context. Removing names alone may be insufficient. Pseudonymised information remains personal data where it can still be linked to people using additional information.

“For the purposes for which it is processed” ties retention to your stated purposes. If you collected an email address for order confirmations and customer service, you can keep it as long as you need it for those purposes. If you later want to use it for direct marketing, that’s a new purpose with its own retention question — not an extension of the original.

The accountability principle in Article 5(2) requires you to be able to demonstrate compliance. In practice, that means having a written retention schedule and following it.

Debunking the “seven-year” myth

There is no general GDPR requirement to keep or delete information after seven years. Tax and limitation rules can justify particular periods, but their scope and start dates differ and they should not be applied to every record indiscriminately.

To be specific:

UK GDPR sets no fixed retention period for any category of personal data.
HMRC requires companies to retain tax records for at least six years from the end of the accounting period to which they relate, with longer periods in specific situations.
In England and Wales, the Limitation Act 1980 generally provides six years for a simple contract claim from the date the cause of action accrued, subject to exceptions. That is a claim time limit, not a mandatory retention rule; Scotland and Northern Ireland have their own legislation.

A six- or seven-year policy may be justified for a particular record and purpose, but neither is a general UK GDPR requirement. Record the applicable reason and starting point.

Setting retention periods by data category

The practical work of retention compliance starts with mapping your personal data by category, then setting a period for each category based on the purposes that justify keeping it.

The following examples illustrate how to assess categories. Only the stated statutory requirements should be treated as minimum legal periods:

Company accounting records — normally six years from the end of the last company financial year they relate to, with longer periods in specified circumstances. Identify which order information is needed for that requirement.
Marketing records — set a period justified by the relationship, permissions and reasonable expectations, review inactive records, and retain an appropriate suppression record to respect objections. There is no universal two-year rule.
Personnel records — distinguish contracts, performance information, absence, pensions and other documents. Apply the relevant legal duties and justified claims periods rather than assigning all HR information a single employment-tribunal deadline.
PAYE records — HMRC normally requires three years from the end of the tax year they relate to. Minimum wage records have a separate six-year requirement, so identify which obligations each payroll record supports.
Unsuccessful applications — set and explain a period proportionate to recruitment and possible claims. Keeping information for future vacancies needs its own transparent purpose and appropriate lawful basis.
CCTV — use the shortest period justified by the recording purpose, with specific holds where needed for an incident. UK GDPR does not prescribe a 7- to 31-day cycle.
Analytics — determine the shortest period actually needed and configure the tool accordingly. A supplier's default or minimum setting does not by itself justify retention.

These are illustrative, not prescriptive. Your specific obligations depend on your sector, the purposes you’ve documented, and any relevant industry regulation.

Statutory minimums from other regimes

GDPR doesn’t set retention periods, but other UK laws do. The most commonly relevant:

HMRC — six years from the end of the accounting period for company tax records; longer for certain situations like investigations or property-related records.
Company records — different accounting, corporate and statutory records have different requirements. For accounting records, the Companies Act distinguishes public and private companies; tax rules can require a longer period. Do not apply one lifetime-of-company rule to every register or file.
Employment records — PAYE records normally three years after the relevant tax year; qualifying minimum wage records at least six years under the applicable rules; right-to-work evidence for employment and two years afterwards. These are separate requirements, not a single Working Time Regulations wage-record rule.
Financial services — check the particular FCA Handbook rule, product and activity. Retention requirements vary; a general five-year rule should not be applied to every client record.
Healthcare in England — the NHS Records Management Code has record-specific schedules. General adult health records commonly have an eight-year period after last treatment or death; children, maternity, mental health and other records have different rules and review requirements. Check the current schedule for the exact category.
Limitation Act 1980 — in England and Wales, simple contract claims generally have a six-year limit and actions on a specialty generally twelve years, subject to exceptions. These are litigation limits rather than automatic record-retention duties.

Where a statutory minimum applies, you have a legal obligation to retain the data. Article 6(1)(c) of the UK GDPR — processing necessary to comply with a legal obligation — provides the lawful basis. You don’t need consent or legitimate interests to keep tax records.

The reverse is also true: a statutory minimum doesn’t authorise you to keep data beyond that minimum unless you have a separate purpose that justifies the continued retention.

Building a retention schedule

A defensible retention policy is a documented schedule that lists each category of personal data, the purpose that justifies retention, the lawful basis, the retention period, and how the deletion or anonymisation is carried out.

A basic schedule has at least these columns:

Data category — for example, “employee personnel files”.
Purpose — what you use the data for.
Lawful basis — under Article 6 (and Article 9 for special category data).
Retention period — the actual time the data is kept.
Justification — why this period, with reference to statutory minimums or business need.
Deletion method — how data is removed when the period expires, including backups.
Review date — when the schedule entry is next checked.

Review the schedule periodically and when purposes, systems or applicable requirements change. The review frequency should suit the risks; a particular number of years alone does not prove that the programme has failed.

Use documentation proportionate to the organisation's processing. Even a small organisation must justify its retention decisions and delete or anonymise information it no longer needs. A concise schedule can help staff apply those decisions consistently.

Backups and “put beyond use”

System deletion vs backup put-beyond-use diagram

Most retention policies hit a practical problem at the deletion stage: data is easy to delete from live systems but lives on in backups. Backups are designed to capture point-in-time copies, and deleting individual records from them is often technically impossible or commercially disproportionate.

The ICO’s accepted approach is the concept of “putting data beyond use”. If you can demonstrate that backup data:

Is not accessed for any other purpose,
Cannot be used to inform any decision affecting a specific person, and
Will be overwritten or destroyed in line with a routine cycle,

Where immediate deletion from backups is not feasible, the ICO accepts that information may be put beyond use until the established overwrite cycle removes it. Explain this clearly, secure the information and ensure it is not restored into ordinary use contrary to a valid erasure decision.

Maintain controls so information subject to deletion is not reintroduced into normal processing if a backup is restored. The backup lifecycle must be justified; putting information beyond use does not authorise indefinite retention.

For more on how retention interacts with the rest of UK GDPR, see our seven principles guide and our individual rights guide (specifically, the right to erasure).

Frequently asked questions

Is there a GDPR 7-year rule?

No. UK GDPR has no universal seven-year retention rule. Tax, record-specific duties and justified claims periods may influence a schedule, but their scope and start dates differ.

How long can I keep HR records?

There is no single retention period for all HR records. Separate the categories and purposes, then check applicable statutory duties and justified claims needs. Employment tribunal time limits should not be described as a general six-year requirement.

How long can I keep customer data?

Keep identifiable customer information only while a lawful purpose needs it. Some company accounting records have a six-year tax requirement, while marketing and support information require their own assessment. Document the period and review it.

What happens to backups under GDPR?

The ICO accepts that personal data may persist in backups after deletion from live systems, provided the data is “put beyond use” — not accessed for any other purpose, not used in decisions about individuals, and overwritten in due course.

Do I have to delete data on request?

Sometimes. The right to erasure under Article 17 applies in specific circumstances and is subject to exemptions — including where you need the data to comply with a legal obligation or to defend a legal claim.

Can I keep data indefinitely for research?

Longer retention solely for protected archiving, research or statistical purposes may be allowed with the required safeguards. This is not a blanket indefinite-retention rule. Review necessity, safeguards and any other legal requirements, and assess any additional purpose separately.

Make sure your team knows how to handle personal data safely and stay compliant with UK data protection law.

Explore the GDPR & Data Protection Course →

Sources & references

Mark McShane

Health & Safety Training Specialist, Online CPD Academy

Mark writes about data protection, GDPR compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.