Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
UK GDPR Article 5(1)(e) says personal data must be kept “no longer than is necessary” for the purpose it was collected, and Article 5(2) makes the business responsible for being able to prove it. In practice that means a documented retention schedule, a clear owner, and a process that actually deletes or anonymises data when the clock runs out. Breaching the core principles in Article 5 can attract fines of up to £17.5 million or 4% of annual worldwide turnover, whichever is higher, under the Data Protection Act 2018. The ICO regularly finds that organisations keep old customer lists, CVs, CCTV footage and former-employee files “just in case” — which is exactly the pattern that turns a small breach into a large one, because old data is still data you have to protect and disclose in a subject access request. Deleting too early is a risk as well. HMRC expects business records to be kept for at least six years under the Taxes Management Act 1970 and VAT Act 1994, private companies must keep accounting records for at least three years under the Companies Act 2006, and employers must hold payroll, statutory pay, working-time and right-to-work records for set periods. Claims for breach of contract can be brought up to six years later under the Limitation Act 1980. The Data (Use and Access) Act 2025 has updated parts of UK data protection law but has not removed the storage limitation principle. A sensible retention policy balances both sides: keep what the law and your legitimate needs require, and securely dispose of everything else.
