How long should a UK business keep customer records? There is no single number. Data protection law says you must not keep personal data for longer than you need it, while tax, company and contract law set minimum periods for some records. The right answer depends on the type of record, why you hold it and what could go wrong if you deleted it too early or kept it too long.
This guide explains what UK GDPR requires for data retention, the legal minimums that commonly apply to customer records, how to build a simple retention schedule, and how to make deletion happen automatically in your systems rather than relying on someone remembering. Getting data into a shape where this is possible is a core part of our data structure and migration work.
This article is general information, not legal advice. Retention rules depend on your sector, your contracts and where in the UK you operate, and the ICO’s guidance is being updated following the Data (Use and Access) Act. Check current guidance or take professional advice before setting your own retention periods.
The short answer: it depends on the record
Most businesses think of “customer records” as one thing. In practice a single customer generates many different kinds of record, each with its own reason to exist:
- contact details, used to provide the service and keep in touch;
- quotes, orders, contracts and delivery records;
- invoices, payments and refunds, which are also accounting records;
- support tickets, complaints and correspondence;
- marketing consents and preferences;
- website form submissions, call recordings and other incidental data.
Each of these can have a different retention period. Invoices may need to be kept for years for tax reasons, while an enquiry from someone who never became a customer may have no reason to be kept beyond a few months. Treating everything the same, whether by keeping it all forever or deleting it all at once, is usually wrong in both directions.
What UK GDPR says about data retention
The relevant rule is the storage limitation principle. Personal data must be kept in a form that identifies people for no longer than is necessary for the purposes it was collected for. The ICO’s guidance on the storage limitation principle makes several practical points:
- UK GDPR does not set specific time limits for different types of data. It is up to you to decide and justify how long you need it.
- You should not keep data indefinitely “just in case”, or because there is a small chance you might use it.
- You should have a policy setting standard retention periods wherever possible, and periodically review the data you hold.
- When you no longer need personal data, you should erase it or anonymise it so it no longer identifies anyone.
- You may need to keep some information after a relationship ends, for example to deal with complaints or possible legal claims.
The ICO page notes that, due to changes made by the Data (Use and Access) Act, the guidance is under review and may change. The core principle that you must justify how long you keep personal data is not going away, so building a sensible retention schedule now is time well spent.
Legal minimums that affect customer records
Data protection law sets the maximum: no longer than necessary. Other laws often set the minimum, because you need certain records to meet tax and legal obligations. These are the ones that most often apply to customer records in England and Wales.
- Limited companies. GOV.UK’s guidance on company and accounting records says you must keep records for 6 years from the end of the last company financial year they relate to, or longer in some cases. Invoices, sales records and bank statements are included. HMRC can fine you £3,000 for not keeping accounting records.
- Sole traders and partnerships. GOV.UK’s guidance on how long to keep self-employed records says at least 5 years after the 31 January submission deadline of the relevant tax year.
- VAT-registered businesses. HMRC says VAT records generally need to be kept for at least 6 years.
- Contract claims. Under section 5 of the Limitation Act 1980, a claim based on a simple contract cannot be brought more than six years after the cause of action arose. This is why many businesses keep contracts and job records for around six years after the work ends. Scotland and Northern Ireland have their own rules.
- Regulated sectors. Businesses covered by the Money Laundering Regulations 2017, such as accountants, estate agents and some legal services, must generally keep customer due diligence records for 5 years after the business relationship ends.
Notice that these rules apply to specific records, not to every scrap of data about a customer. Keeping invoices for six years does not justify keeping the same customer on your marketing list, or keeping the notes from a sales call that went nowhere.
A practical retention schedule for customer records
A retention schedule is simply a list of the types of record you hold, how long you keep each one, why, and what happens at the end. The periods below are examples of how a typical small service business might set things out. They are starting points to discuss with your adviser, not rules.
- Enquiries that did not become customers. Perhaps 6 to 12 months after the last contact, long enough to follow up, then delete.
- Active customer contact details. For as long as the customer relationship continues, then reviewed when it ends.
- Quotes, contracts and job records. Around 6 years after the work is completed, reflecting the contract claim period.
- Invoices, payments and refunds. At least the tax minimum that applies to you, such as 6 years from the end of the financial year for a limited company.
- Complaints and disputes. Until the matter is resolved and any claim period has passed.
- Marketing consent records. For as long as you rely on the consent, plus enough time to prove you had it.
- Do-not-contact list. Kept for as long as needed to make sure you do not contact people who have opted out, holding only the minimum details.
- Website form submissions. Copied into your CRM or job system, then deleted from the website itself after a short period.
The last point is easy to miss. Our UK GDPR and cookie consent guide covers website data in more detail, including why form plugins quietly storing years of enquiries are a common problem.
When does the retention clock start?
A retention period needs a trigger, and choosing the right one matters as much as choosing the length. Common triggers for customer records are:
- the date of the last contact, for enquiries;
- the end of the financial year, for accounting records;
- the date the work was completed or the contract ended, for job records;
- the date the customer relationship ended, such as an account closure or a long period with no orders.
The last one needs a definition. If a customer has not ordered for three years, are they still a customer? Decide what “ended” means for your business, write it down, and apply it consistently. A clear rule is much easier to automate and to defend than a judgement made case by case.
Deleting, anonymising and backups
When a retention period ends, you have two main options. You can delete the data, or you can anonymise it so it no longer identifies anyone. Anonymisation is useful when you want to keep the business value of the data, such as sales by postcode area or the number of jobs of each type, without keeping the personal details.
True anonymisation means the person cannot be identified, even by combining the data with other information. Replacing a name with a customer number is not anonymisation if you still hold the key that links them.
Backups need thinking about too. The ICO recognises that it is not always possible to erase every trace of data immediately, and says the key issue is to put it beyond use. If you delete data from a live system, you should also delete it from backups of that system, or make sure it cannot be restored and used again. In practice this usually means backups that expire on a fixed cycle.
Our guide to backups and the 3-2-1 rule explains how to set up backups that protect you without keeping data forever.
Handling erasure requests
Customers have a right to ask you to erase their personal data, for example when you no longer need it for the purpose you collected it for. You normally have one month to respond, which can be extended by up to two further months for complex or numerous requests.
The right is not absolute. If you must keep an invoice for tax purposes, you can usually keep it, while deleting the customer’s marketing preferences, notes and any other data you no longer need. Explain clearly what you have deleted, what you have kept and why. This is far easier when your systems already know which customer records fall under which retention rule.
Making retention automatic in your systems
A data retention policy that lives in a document and relies on someone remembering to delete things rarely survives a busy year. The better approach is to build retention into the systems that hold your customer records:
- Record types and dates. Each record carries a type and the date that starts its retention clock, such as the job completion date or last contact.
- Scheduled clean-up. A regular job deletes or anonymises records whose retention period has passed, and logs what it did.
- Review lists. Records that need a human decision, such as customers with open disputes, are flagged for review rather than deleted automatically.
- Legal holds. A way to pause deletion for a specific customer if a claim or complaint is under way.
- Reports. A simple view of what you hold, by type and age, so you can answer questions from customers, auditors or your own team.
Many CRMs and accounts packages have some of these features. The hard part is usually the data itself: customer records spread across old spreadsheets, email inboxes, a legacy database and a website plugin, with duplicates and no reliable dates. That is often the moment to clean up and consolidate, and our article on GDPR and data migration explains how to use a migration to put things right.
Good admin tools make this kind of housekeeping routine. For Eastern Procurement, a not-for-profit framework provider owned by social housing providers in the East of England, we built the website and the back-end admin dashboard behind it, giving the team an easy way to keep everything up to date.
An illustrative example: a home improvement firm
Here is an illustrative example. The business is made up, but its situation is a common one.
A home improvement firm has traded for fifteen years. Its customer records are spread across an old job database, a CRM adopted five years ago, the accounts package, a website form plugin and several email inboxes. Nobody has ever deleted anything. A customer asks for their data to be erased, and the team realises it cannot even find everything it holds about them.
The firm works with its accountant to agree a retention schedule: enquiries kept for 12 months after last contact, job records for 6 years after completion, accounting records for 6 years from the end of the financial year, and a minimal do-not-contact list kept indefinitely. Old job data is migrated into the CRM, with duplicates merged and completion dates added. A monthly automated job then anonymises expired records, keeping the job type and postcode area for reporting. The website plugin is set to delete submissions after 30 days, once they have reached the CRM.
The next erasure request takes minutes, and the firm can explain exactly what it keeps and why.
Customer records: common questions
Can we keep customer details forever for marketing?
No. Marketing is a purpose like any other, and you need to justify how long you keep data for it. If someone has not bought from you or engaged with your marketing for a long time, it is hard to justify keeping them on your list. If they opt out, keep only enough to make sure you do not contact them again.
Do we have to delete invoices if a customer asks?
Usually not, if you need them to meet a legal obligation such as tax record keeping. You should still delete other personal data you no longer need, and explain to the customer what you are keeping and why.
Do these rules apply to paper customer records too?
Yes. UK GDPR covers personal data in structured paper filing systems as well as digital records. Old filing cabinets and archive boxes of customer records need the same review, and paper should be disposed of securely, for example by cross-cut shredding or a confidential waste service.
What if we do not know how long we have held some data?
Start by finding out what you hold and where. Records with no reliable dates can often be dated from related information, such as the last invoice or email. Where you cannot justify keeping something, the safer course is usually to delete it.
The bottom line
There is no single answer to how long to keep customer records, but good data retention follows a clear method. List the types of record you hold, set a period and a trigger for each based on why you need it and any legal minimum, then build deletion and anonymisation into your systems so it happens without anyone having to remember.
If your customer data is spread across systems and you are not sure what you hold, tell us where it lives today or call us on +441482 212499. We can help you map it, clean it up and put retention rules in place that run themselves.
