Accountio / Templates / UK GDPR / Data retention schedule

Data retention schedule template for accountants

How long your firm keeps each type of record, when the clock starts and how the record is deleted at the end. This data retention schedule template is one Excel sheet with the rows filled in for practice work, from tax working papers to AML checks.

UK practices
$15
In the pack
UK GDPR pack for practices
Files
10, Word and Excel
Buy the pack · $15
Global library · 101 packs

Get this pack and 100 more for $129

UK GDPR for practices · this packAML complianceCharity accountsEstate administrationMTD for Income TaxP11D and payrollingUK SRS readinessCarbon reduction planCIS+ 92 more
$129$1,42191% off

You save $1,292 on buying them one by one

Buy the global library · $129

What the schedule looks like

Data retention schedule template
What the schedule sets outRow or column in the schedule
Client accounts and tax working papers
✓
Client accounts and tax working papersCurrent year plus six years, from the end of the accounting period or tax year
Anti-money laundering identity checks
✓
Customer due diligence records (identity checks)Five years from the end of the client relationship
One-off transactions for non-clients
✓
Records of occasional transactionsFive years from the date the transaction completed
Companies House identity verification
✓
Companies House identity verification records (ACSP)Seven years from the date of verification
Payroll you run for clients
✓
Payroll records for clientsCurrent year plus six years, from the end of the tax year
Suspicion reports and MLRO decisions
✓
Internal suspicion reports and MLRO decisionsKept separately from client files
Your own staff and job applicants
✓
Staff records, Unsuccessful job applicationsSeparate periods for current and former staff and for applicants you turned down
Engagement letters and client correspondence
✓
Engagement letters and terms, Client correspondenceEach with the date its period runs from
Marketing lists and client originals
✓
Marketing list entries, Documents of title and original documentsKept until someone unsubscribes, or returned to the client
When each period begins
✓
Starting fromEnd of the relationship, end of the tax year, date of the decision and so on
How each record is destroyed
✓
How we delete itA list: secure deletion, shredding, anonymise or return to client
Records you must hold for longer
✓
Exceptions and notesFor a complaint, claim or investigation

Why you need one

The UK GDPR says personal information must not be kept in a form that identifies people for longer than you need it, and your firm must be able to show it follows that rule. A written schedule is how you show it.

  • Your record of processing needs a retention period for each type of data
  • Your privacy notices must tell clients and staff how long you keep their information
  • The Money Laundering Regulations require you to delete AML personal data once the five-year period ends, unless another law, legal proceedings or the person's consent means you keep it
  • You are clearing old files, moving to new software or closing a practice
  • Your professional body or insurer asks how long you keep working papers

How to use the data retention schedule template

  1. Check each row against your firm. Change the periods where your professional indemnity insurer asks for longer, and delete rows that don't apply.
  2. Add your own record types. Use the empty rows for anything else you hold, such as audit files, CCTV or a client portal.
  3. Name who does the deletion. Fill in a person or role for each row so nothing is left to chance.
  4. Pick a deletion method. Choose from the list in the How we delete it column.
  5. Note any hold. When a complaint, claim or investigation is open, record it in Exceptions and notes and keep the files.
  6. Run it once a year. Delete or anonymise everything past its period and note the date you did it.

Questions

What is a data retention schedule?

A list of every type of record your firm holds, how long you keep it, when that period starts and what happens to it at the end. It turns the storage limitation rule in the UK GDPR into dates your team can follow.

How long should accountants keep client working papers?

ICAEW's document retention guidance gives current year plus six years for accounts working papers. Tax records generally run to the sixth anniversary of the end of the period they relate to.

How long do you keep anti-money laundering records?

The Money Laundering Regulations 2017 require customer due diligence records to be kept for five years from the end of the business relationship, or five years from completion for an occasional transaction. After that the personal data must be deleted unless another law, legal proceedings or the person's consent means you keep it.

How long should payroll records be kept?

GOV.UK says employers must keep PAYE records for three years from the end of the tax year they relate to. ICAEW's guidance gives current year plus six years as best practice for practices that run payroll.

How long must Companies House identity checks be kept?

Authorised corporate service providers must keep records of the identity checks they carry out for seven years.

Also in the UK GDPR pack for practices

Record of processing activitiesData protection policyAppropriate policy documentData breach procedureData protection logsSubject access request procedureData protection complaints procedureSoftware and supplier checklistStaff privacy notice

See the whole pack →

Who it's for

Accountancy practices that want one sheet setting out how long each record is kept and when it goes.

Last checked

Checked against the Money Laundering Regulations, ICAEW's document retention guidance and GOV.UK in November 2026.