The Retention Ledger: What a UK Small Firm Should Keep、Scan or Shred in 2026

Most small UK firms do not set out to hoard paper. Files accumulate because each one might be needed, because nobody is sure when the clock starts, or because shredding feels riskier than keeping. The result is a storage room of uncertain records, slower searches and a growing data protection question. The remedy is not a consultant-led purge. It is a one-page matrix, a short annual review and the discipline to stop treating every document as permanent.

Storage limitation is a business control

UK GDPR requires personal data to be kept no longer than necessary. That principle is often discussed in relation to marketing lists and customer databases, but it applies just as much to client files, payroll records and HR paperwork. A firm that cannot say why a record is still held will struggle to answer a subject access request, explain a breach or defend a deletion decision. Retention is also an operational matter. A clear matrix tells staff what to do without asking a partner every time a filing cabinet fills up.

The aim is not to destroy everything early. It is to make retention deliberate. Some records must be kept for legal, tax or regulatory reasons. Others should be destroyed once the purpose has passed. The matrix exists to separate those decisions and to make them repeatable.

Four decisions, not a filing system

Every record group should fall into one of four actions: keep the original, scan and then destroy the original, keep digital only, or destroy now. The matrix should record the trigger event rather than a fixed calendar date. A client file does not expire on 31 December; it expires after closure plus the relevant period, subject to any legal hold. A payroll record does not expire when the drawer is full; it expires after the end of the tax year plus the required period.

This distinction matters because small firms often use the financial year-end as a universal shredding date. That is convenient but imprecise. A better matrix has columns for the record group, the default action, the retention trigger, the minimum period and any exception. It should fit on one page and be written in language that a new administrator can follow.

A one-page matrix for common records

The following default positions are a starting point, not legal advice. A firm should confirm its own periods with its professional body, insurer or legal adviser, particularly where client matters involve minors, deeds, personal injury or long-tail liabilities.

Record group	Default action	Retention trigger	Practical note
Client matter files	Review, then scan or retain original	Closure of the matter plus the period set by the regulator and limitation rules	Do not apply one period to every matter
Invoices and VAT records	Keep original or scan if acceptable	End of the accounting period plus six years	Digital copies must be complete and readable
Payroll and RTI records	Keep digital	End of the tax year plus three years	Check HMRC guidance for exceptions
Contracts	Keep signed original where enforceable	Expiry or termination plus six years; twelve years for deeds	Diarise the review date at signature
HR files	Restricted access	Usually six years after employment ends; shorter for unsuccessful applicants	Separate sickness and disciplinary records
Health and safety records	Keep	Sector-specific; some records need at least three years	Exposure records may need longer

The table is deliberately short. If a firm cannot explain a retention period, it should not invent one. It should ask for advice and record the answer. The matrix is a control document, so it should carry a version date and the name of the person responsible for it.

Scanning before shredding

Scanning is not a neutral act. A poor scan can lose the evidential value of a document while appearing to preserve it. Set a minimum standard: 300 dpi for text, colour where colour carries meaning, OCR so the text is searchable, and a file name that matches the matter or payroll reference. Keep the master file in a controlled folder rather than a desktop or personal email account.

For documents with wet signatures, deeds, certificates or original instruments, check before destroying the paper. A scanned copy may be acceptable for day-to-day work but not for every legal purpose. Where an original must be kept, mark the file clearly and store it separately from routine copy paper.

Destruction should be as controlled as retention. Use cross-cut shredding to a recognised standard, or an accredited confidential waste contractor. Obtain a certificate of destruction for sensitive batches and file it with the review record. That certificate is useful evidence that the firm acted deliberately rather than losing a box during an office move.

The 20-minute annual review

Put a recurring appointment in the diary for the first week after the financial year-end. The review does not need to become a legal audit. It needs to confirm that the matrix is still accurate and that records due for destruction have been dealt with.

1. Open the matrix and check that the version is current.
2. List the record groups that have passed a retention trigger since the last review.
3. Sample ten files from those groups and confirm that the action matches the matrix.
4. Scan what is to be kept digitally, using the agreed naming and quality standard.
5. Shred what is due and obtain a certificate for confidential waste.
6. Update the retention register with what was destroyed, what was kept and any exceptions.
7. Set the next review date and note any legal holds.

Twenty minutes is enough if the matrix is already written. It is not enough to conduct a legal review, and it is not meant to be. The review is a check on routine discipline, not a substitute for advice on a complex matter.

When to pause the shredder

A legal hold overrides the matrix. If a complaint, employment tribunal claim, HMRC compliance check, ICO inquiry, litigation or subject access request is live or reasonably anticipated, mark the affected records and suspend destruction. Do not rely on a member of staff remembering. Put a note on the file, tell the person who runs the review and record the date the hold began. Release the hold only when the matter is closed and advice confirms that destruction can resume.

Keep the matrix visible

A retention policy hidden in a folder is a policy in name only. Put the one-page matrix on the office intranet, include it in induction and give one person responsibility for the annual review. Fast Documents UK sees the practical benefit in scanning and destruction workflows: less paper, clearer file names and a document trail that can be explained. The firm still owns the judgement, but the routine should be simple enough to repeat.

A small firm does not need a records warehouse or a complicated taxonomy. It needs a short set of decisions, a date in the diary and the confidence to shred what no longer has a purpose.