Storing financial records securely — a UK guide

How long to keep UK financial records

HMRC expects a company to keep its accounting records for six years from the end of the accounting period, and a sole trader or partnership to keep Self Assessment records for at least five years after the 31 January filing deadline. Records supporting a longer-lived asset, or a period under enquiry, should be kept until the matter closes. VAT records generally follow the six-year rule.

Keeping records longer than you need is its own risk: under the UK GDPR storage-limitation principle, personal data should not be retained beyond its purpose. A written retention schedule that states each category and its period is the practical answer to both obligations.

Make records retrievable, not just stored

HMRC and an auditor can ask for a specific invoice or statement, so an archive of image-only scans is a liability. Running OCR over scanned records adds an invisible searchable text layer, so a single invoice can be found in years of purchase ledgers in seconds. Saving to PDF/A fixes fonts and layout for long-term readability.

Consistent file naming and folder structure — period, entity, document type — matters as much as the technology, because it is what makes a retention schedule enforceable when someone leaves the business.

Encryption, access control and transfer

Encrypt records at rest and in transit, restrict access to the people whose role requires it, and log who opened what. When financial records have to be emailed, apply a PDF open password with AES-256 encryption and share the password by a separate channel — an encrypted attachment is the control that makes an email transfer defensible.

Before sending anything outside the organisation, strip metadata. Author names, revision history, file paths and comments travel inside PDFs and spreadsheets and frequently disclose more than the visible content.

Redaction and secure disposal

When a record must be shared but parts of it are out of scope — bank details, salaries, third-party names — redact permanently rather than covering text with a black box, which leaves the characters selectable underneath. Permanent redaction deletes the underlying text and image data and flattens the page.

At the end of the retention period, dispose deliberately: delete digital copies including backups and shred paper. Document the disposal, because being able to show what you deleted and when is part of demonstrating compliance.

Frequently asked questions

How long must UK businesses keep financial records?

Companies must keep accounting records for six years from the end of the accounting period; sole traders and partnerships should keep Self Assessment records at least five years after the 31 January filing deadline. Keep records relating to an open enquiry or a long-lived asset until the matter closes.

Can I keep records digitally instead of on paper?

Yes. HMRC accepts digital copies provided they are complete, legible and retrievable on request. Scan at 300 DPI, run OCR so the documents are searchable, and store them encrypted with controlled access.

How should I send financial records by email safely?

Apply an open password to the PDF using AES-256 encryption, send the password by a separate channel such as a phone call, and strip metadata from the file first so author names and revision history are not disclosed.

What is the safest way to hide figures in a document I have to share?

Permanent redaction. It removes the underlying characters and image data and flattens the page, unlike a black box drawn in a PDF editor, which leaves the text selectable beneath it.