Most businesses do not set out to keep every email, customer record and old system export forever. It happens gradually: a mailbox is never cleared, a backup is kept “just in case”, a former system is switched off but its data is copied somewhere else.
The result is data that costs money to store, takes time to search and may carry privacy and security risks, without having a clear business purpose.
A retention and archiving plan is not simply a tidy-up exercise. It is an IT and governance decision: what must you keep, what should you keep, where should it live, who can access it, and when can it be securely deleted?
The cost of keeping everything
Cloud storage can feel inexpensive when viewed one file or mailbox at a time. The wider cost is less obvious. Data growth can increase storage and backup capacity, complicate migrations, and make it harder to identify which copies are authoritative.
It can also affect recovery. Large, unmanaged backup sets can take longer to search, validate and restore. If a business needs to recover a specific file or system quickly, a jumble of historic copies is not a recovery strategy.
There is a further cost in attention. Staff may spend time checking old folders, duplicated exports and former systems to find a record they can trust. More data also means more material to protect and, where relevant, search for a subject access request.
The first step is not buying more storage. It is deciding what the organisation needs the data for.
The legal position: retain for a reason, not by habit
There is no single retention period that applies to every record in every UK business. Requirements depend on the type of record, the organisation and the circumstances.
For example, GOV.UK guidance on company and accounting records says limited companies must generally keep accounting records for six years from the end of the last company financial year they relate to. Some records need to be kept longer, for example, where a transaction spans accounting periods, an asset is expected to last more than six years, a tax return is late or HMRC has opened a compliance check.
For VAT, HMRC says businesses must keep VAT records for at least six years, with a longer period for certain VAT schemes. Self-employed record-keeping has different timings: GOV.UK’s guidance explains how long to retain records after the relevant tax return deadline.
These are useful starting points, not a universal deletion calendar. Check the rules that apply to your business and record type, including any sector-specific obligations, legal claims or active enquiries. Where there is a genuine legal hold, pause routine deletion for the relevant records.
At the same time, UK GDPR’s storage limitation principle says personal data should not be kept in identifiable form for longer than necessary for its purpose. The Information Commissioner’s Office (ICO) advises organisations to justify how long personal data is kept, set standard retention periods where possible, and review and erase or anonymise data that is no longer needed.
That means “we might need it one day” is not a retention policy. A defensible policy records why data is retained, the rule or business need behind the period, and what happens when that period ends.
Backups are not archives
Backups and archives serve different purposes.
A backup is primarily there to help restore systems or data after loss, damage or disruption. It usually follows a defined cycle, with older copies replaced according to a schedule.
An archive holds selected records for a continuing business, legal or operational reason. It should be organised, access-controlled and retrievable for as long as that reason applies.
Treating backups as an archive creates problems. A backup may be difficult to search, may contain whole-system snapshots rather than carefully selected records, and may not provide a practical way to retrieve one document years later. Conversely, keeping every backup indefinitely because it might contain something useful turns recovery copies into an uncontrolled long-term data store.
The ICO notes that archived and backed-up personal data can still be in scope for access requests. It recommends having procedures to find and retrieve that information, and defined retention periods for archives and backups. See the ICO’s guidance on finding and retrieving information for a subject access request.
A subject access request normally requires a reasonable and proportionate search. If records are scattered across live systems, old mailboxes and unlabelled backups, responding becomes harder. Good information management helps you find relevant data without searching blindly.
Where should archived data live?
An archive should be separate enough from everyday work to reduce accidental use, but accessible enough to meet legitimate retrieval needs. The right design depends on the sensitivity and volume of data, how often it must be retrieved, and how long it must be retained.
For cloud-based records, check how storage, access, export and deletion work across the full lifecycle. A move to Cloud Solutions may support a wider strategy, but it does not automatically create a retention policy. Likewise, a new platform does not make old data compliant by default.
Legacy platforms need particular care. If your business relies on IBM i or systems historically known as AS/400, decide how essential records will remain readable and retrievable if the original application or hardware is retired. Preserve necessary context, not just a raw data file, including field definitions, dates, relationships and the method used to export or interpret the records. A specialist review can help distinguish data that needs to remain available from data that can be securely disposed of.
This is where consultancy should come before procurement. A Fractal IT Director approach starts with the business requirements, legal and operational risks, and cost of retention. Technical delivery then follows the plan. Managed IT Services, Network Solutions and Helpdesk Support can be bolt-on execution services that support that wider strategy, not substitutes for it.
A practical route to a retention schedule
A useful schedule does not need to be complicated. Start with these steps:
- Make an inventory. List the main record types and where they live: finance systems, email, shared drives, cloud platforms, laptops, paper files, backups and legacy applications.
- Name the purpose. For each record type, note why it exists and who owns it. “Kept in case” is a prompt to investigate, not a sufficient business reason.
- Check the rules. Confirm statutory, contractual, regulatory and operational requirements. Record the source and any conditions that extend the period.
- Set review and disposal points. Specify when records are reviewed, whether they are deleted, anonymised or transferred to an archive, and who approves exceptions.
- Define legal holds. Document how routine deletion is paused when litigation, an investigation, a tax enquiry or another valid hold applies, and who can release the hold.
- Test the process. Check that staff can retrieve an archived record, respond to a request, and confirm that routine deletion works as intended.
Defensible deletion means being able to show that the organisation followed an established, authorised process, not deleting material indiscriminately. A request, dispute or investigation may require a hold. The appropriate teams should assess those circumstances before scheduled deletion proceeds.
Make retention part of the IT strategy
A retention schedule is most effective when it influences technology decisions. Before approving new storage, backups or migrations, ask what information is being carried forward, what must remain searchable and what can be removed.
Technology Expense Management can help expose storage and licence costs that have grown without a clear owner or purpose. But the goal is not deletion at any price: it is retaining the right records for the right length of time, in a format that can be protected and retrieved.
That strategic work should lead. Cloud Solutions, Disaster Recovery and other operational services can then be designed around the actual retention requirements. If the business is reviewing its wider systems, a Dynamics 365 Jump Start can be considered as part of a broader systems conversation, not as a replacement for sound information governance.
For an overview of the wider Evestaff group of services, visit evestaff.co.uk.
SEO keywords
Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity, data retention policy UK SME, data archiving, UK GDPR storage limitation, defensible deletion, cloud storage costs, email retention
Join The Discussion