Document retention: how long to keep what, in the EU, UK and US

Keeping everything forever feels safe. It isn't. Old documents are a cost, a security surface and — under data-protection law — a liability. The goal of a retention policy is simple: keep each thing for as long as you have a reason to, then delete it on a schedule you don't have to think about.

This guide is a practical starting point, not legal advice. Retention periods depend on your industry, your contracts and your regulator, so treat the numbers below as a sensible default to discuss with whoever signs off your policy.

Why retention is a policy, not a habit

Three forces pull in different directions:

• Regulators require you to keep certain records for a minimum period — tax, employment, health and safety.
• Data-protection law (GDPR in the EU and UK, a patchwork of state laws in the US) requires you not to keep personal data longer than you need it.
• Litigation sometimes requires you to stop deleting — a legal hold freezes a schedule mid-flight.

A written policy is how you reconcile them. It names each category of document, the minimum you must keep it, the maximum you may keep it, and who can place a hold.

Common minimums by jurisdiction

These are typical statutory minimums for business records. Longer is often prudent; shorter is rarely safe.

European Union

• Accounting and tax records — commonly 7 to 10 years, set per member state.
• VAT records — typically up to 10 years in several member states.
• Employment and payroll — varies widely; several years after the employment ends is common.

United Kingdom

• Company accounting records — 6 years from the end of the financial year (longer for some transactions).
• Payroll (PAYE) — at least 3 years after the end of the tax year.
• Health and safety records — some, such as certain exposure records, run for 40 years.

United States

• Tax records — the IRS generally recommends 3 to 7 years depending on the situation.
• Employment records — several federal rules set 1 to 4 year minimums; state law may add more.
• OSHA records — certain exposure and medical records must be kept for 30 years.

Building a schedule you can run

A policy only works if it runs itself. In practice:

1. Group documents into a handful of categories, not hundreds. Contracts, finance, HR, operational, marketing. Precision you can't maintain is worse than a rough rule you can.
2. Assign each category a retention period — the longer of its legal minimum and its genuine business need.
3. Record the review date on the document itself so the rule travels with the file, not a spreadsheet.
4. Automate the deletion so nothing lingers past its date by accident.

In Docplume, each document carries metadata fields and tags, so you can stamp a retention category on upload and filter for everything past review. The audit log records every deletion, which is the evidence a regulator will ask for.

Legal holds override everything

When litigation or an investigation is foreseeable, you must suspend deletion for the relevant documents — a legal hold. A hold beats the schedule: a document under hold is kept even if its retention period has lapsed. Name, in the policy, who can place and lift a hold, and keep the audit trail that shows you did.

A sensible default to start from

If you need to move today, start here and refine with counsel:

• Keep finance and tax records for 7 years (EU/UK) or per IRS guidance (US).
• Keep contracts for the life of the agreement plus 6 years.
• Keep HR records for 6 years after the person leaves, minus anything a longer rule (like exposure records) demands.
• Delete everything else on a rolling review once its business purpose ends.

Write it down, automate the dates, and let the system do the forgetting for you.