How long to keep what, and where
Most businesses keep everything forever because deleting anything feels risky. That was a defensible default when the only question was whether a record could be produced on demand. It is a weaker default now that holding personal data longer than needed is itself a liability.
2 min readOadbox
Different statutes, different clocks
Company law, tax law and indirect tax law each prescribe their own retention period for books and supporting records, measured from different starting points — the end of the financial year, the due date of a return, the end of an assessment.
Where proceedings are pending, records must generally be kept until they conclude regardless of the ordinary period. The practical rule is to retain to the longest applicable clock and know why you chose it.
Personal data runs the other way
Data protection law asks you to keep personal data only as long as the purpose requires, and to erase it thereafter. Employee records, customer contact data, biometric attendance and CCTV all sit in this category.
The two requirements are reconciled, not opposed: keep what a statute requires you to keep, for as long as it requires, and delete the rest on a schedule you can describe.
- Write down a retention period per category of record, with the reason.
- Separate statutory records from operational data that merely accumulated.
- Apply the schedule automatically where you can — manual deletion never happens.
- Record disposals, so you can show a policy was followed rather than asserted.
Backups are records too
A deletion policy that leaves the data in seven years of backups has not deleted anything. Equally, a backup regime that cannot restore a specific period defeats the retention obligation it was meant to satisfy.
Both are solved by deciding backup retention deliberately rather than letting it default to whatever the tool does.
Know where it is before you promise anything
You cannot retain, produce or delete data whose location you do not know. For most businesses the surprise is not the accounting system — it is the exports on laptops, the shared drive, the WhatsApp groups and the departed employee's mailbox.
An inventory of where personal data lives is unglamorous work and the necessary precondition for every other commitment in this area.
Retention periods are statute-specific and data protection rules continue to be implemented in phases. Take advice on a schedule for your own business rather than adopting a generic one.
Written by the Oadbox team. Something here not match how it works in your business? We would genuinely like to hear it — connect@oadbox.com.