A record retention policy is a short, overarching document that says which records your organisation keeps, how long it keeps them, and how it destroys them when the time is up. It is usually paired with a detailed retention schedule that lists every record type and its period. In the UK, there is no single number: periods depend on the type of record, on tax and sector law, and on data protection rules that stop you keeping personal data longer than you need it. This guide shows you how to build the policy, set the periods, and handle disposal, with examples from regulated online gambling.
TL;DR
- A retention policy sets the rules; a retention schedule lists each record type, its period, its trigger and what happens afterwards.
- UK periods vary: tax records commonly run for 3 to 6 years, and UK-licensed online casinos must hold customer identification records for five years after the relationship ends.
- Keep nothing without a reason. Personal data should be securely destroyed or anonymised once its purpose has ended, unless a law requires you to keep it.
- Write a legal-hold clause, log every deletion, and review the policy whenever your systems or activities change.
- Regulated businesses need records that show who decided what and why, not only the records themselves.
Table of Contents
- What a record retention policy is
- How long records must be kept in the UK
- How to build the policy, step by step
- What the policy should contain
- Storing, reviewing and disposing of records
- A worked example: player communications at an online casino
- Common mistakes to avoid
- Putting retention into your support operation
- FAQ
- Sources
What a record retention policy is
The policy is the rulebook. According to guidance from the Association of Corporate Counsel, it defines the records and non-records it covers, requires records to be kept for the period in the schedule, requires destruction once that period expires, and suspends disposal for records under legal hold. The schedule is the companion document with the detail.
You may see the same thing called a document retention policy, a records management policy or a data retention policy. The names overlap, and what matters is what the document does. A good one is media-agnostic: it applies equally to paper files, emails, chat transcripts, call recordings, databases and backups.
Policy, schedule and procedure
Keep three layers apart, because they change at different speeds.
| Layer | What it answers | How often it changes |
|---|---|---|
| Policy | Why we keep records, who is responsible, what the rules are | Rarely |
| Schedule | Which record type is kept for how long, from which trigger | When law or business needs change |
| Procedure | How deletion, archiving and legal holds are carried out in each system | When systems change |
Putting retention periods inside the policy itself means redrafting and re-approving it every time a period moves. Put them in the schedule.
How long records must be kept in the UK
There is no general UK rule that says “keep everything for seven years”. The seven-year habit is a rule of thumb, and it does not match most statutory periods. Your schedule should rest on the specific law behind each record type.
Some common UK reference points:
- Tax and accounting records. One accountancy guide to HMRC rules says most businesses keep invoices, receipts, bank statements and payroll records for between 3 and 6 years, with VAT-registered businesses typically keeping records for at least 6 years. Longer applies if a return is filed late or HMRC opens an enquiry. Check the current HMRC guidance for your business type before you fix a period.
- Anti-money-laundering records. For remote and non-remote casinos, the Gambling Commission says identification and verification records must be kept for five years after the business relationship ends, for example when the player closes their account. Supporting records follow the same five years from the end of the relationship. After that, personal data must be deleted unless one of the listed exceptions applies, such as the person agreeing to retention.
- Health records. Sector rules can be far longer. NHS guidance says a GP record is held for the lifetime of the patient and ten years after death, with longer periods in some cases.
Other countries differ again. The Netherlands Enterprise Agency says Dutch businesses must generally keep basic business records for at least 7 years. The Australian Taxation Office says most Australian business records are kept for 5 years. The US Internal Revenue Service generally says 3 years for income-tax support records, and longer in specific cases. If you operate across borders, you will have several clocks running at once.
Data protection sets the ceiling
Statutory minimums are only half the picture. UK data protection law expects you not to keep personal data longer than you need it. The ICO says a retention schedule should document how long each category of personal information is kept, why it is kept, and what happens afterwards, such as anonymisation, archiving or deletion.
So each line in your schedule needs a justification. “We might need it one day” is not one.
How to build the policy, step by step
1. Inventory your records
List the record types the organisation creates and receives, and identify related or duplicate sets. The University of Edinburgh’s guidance on retention schedules starts here, and so should you. Count the unglamorous ones: support tickets, chat logs, email threads, call notes, system logs, complaints, and marketing consent records.
Mark which contain personal information. That flag drives most of your later decisions.
2. Find the legal and regulatory requirements
For each record type, identify the law or regulator that sets a minimum or a maximum. Tax law, employment law, sector licensing conditions, anti-money-laundering rules and data protection all apply to different records. Write the source next to each line in the schedule so the next reviewer can see where the number came from.
3. Weigh business value against risk
The International Council on Archives says retention decisions should weigh compliance requirements, stakeholder interests, the risk of not having records and the cost of keeping them, and that the rationale should be documented. Keeping too little exposes you in a dispute or an audit. Keeping too much enlarges the damage from a breach and the work of answering data subject requests.
4. Choose a trigger for each period
A period needs a start point. The California Secretary of State’s records handbook describes retention as a lifecycle decision based on triggers, value and disposition rather than a calendar period attached to a file type. Typical triggers are:
- the end of the financial year
- the closure of an account or the end of a contract
- the end of employment
- the close of a complaint or case
- the date a record became inactive
The account-closure trigger is the one gambling operators know best, since the five-year anti-money-laundering clock starts when the relationship ends, not when the record was created.
5. Consult the record owners and sign off
Schedules written by compliance alone tend to be ignored by operations. Consult the people who use the records, reach agreement, and have a named senior owner approve the result. The ACC guidance stresses business consensus as part of a policy that will actually be followed.
If you operate in several countries, the same guidance recommends one global schedule with local exceptions, consolidating differing requirements into a single period where possible. That is far easier to run than a separate schedule per market.
What the policy should contain
A workable policy usually fits on a few pages. It should include:
- Purpose and scope. Which entities, systems and record types are covered, and which are explicitly non-records (drafts, duplicates, convenience copies).
- Roles and responsibilities. State Records NSW says a policy should assign responsibilities to business owners, business units, staff and contractors, and cover outsourced and cloud environments.
- The retention rule. Records are kept for the period in the schedule, no longer and no shorter.
- Destruction after expiry. Disposal is systematic, approved and documented.
- Legal hold. Disposal is suspended for records relevant to litigation, investigations or regulatory enquiries until the hold is lifted.
- Protection. Records are protected against unauthorised access, loss, deletion or alteration.
- Systems change. The same checklist says to address system migration and decommissioning, so records are not lost or orphaned when a platform is replaced.
- Review. The policy and schedule are reviewed on a set cycle and whenever business activities, law or priorities change.
Storing, reviewing and disposing of records
A schedule that nobody applies is decoration. KPMG’s guidance on retention and deletion recommends cataloguing the repositories where data sits, classifying the data, using access and integrity controls, and keeping legal-hold controls that suspend deletion during litigation or investigations. Securely deleting data under documented procedures and approvals, and keeping evidence of the deletion such as logs, closes the loop.
The ICO is specific about disposal in the UK context:
- When personal data is no longer needed for its original purpose, it should be securely destroyed or anonymised, unless another law requires you to keep it for a set period.
- Electronic records should be disposed of in line with the retention schedule, with management approval logged before deletion where appropriate, and a process for deleting emails according to the schedule.
- Secure disposal methods for devices include wiping, degaussing and hardware shredding, with devices awaiting destruction kept securely and logged.
Do not forget backups, archives and copies held by suppliers. A deletion that leaves the data in a backup for years is not a deletion, so your procedure should state how long backups roll for and who confirms supplier deletion.
A simple review rhythm
- Continuously: automated or scheduled deletion for low-risk records, with logs.
- Quarterly or half-yearly: a manual sweep of records past their period, with sign-off by the record owner.
- Annually: a review of the schedule against changes in law, regulator guidance and business activity.
- On change: a review whenever you adopt a new system, enter a new market or change a supplier.
A worked example: player communications at an online casino
Online gambling shows how retention rules collide. Imagine a UK-facing casino operator with a support team handling email, live chat, SMS and messaging apps. Which records does it hold, and for how long?
| Record type | Why it is held | Trigger | Period source |
|---|---|---|---|
| Identity and verification records | Anti-money-laundering duty | End of the player relationship | Five years, per the Gambling Commission guidance cited above |
| Supporting AML records | Same duty | End of the relationship | Five years, per the same guidance |
| Support conversations | Dispute handling, complaints, quality | Case closure | Set by the operator and justified in the schedule |
| Marketing consent and suppression records | Proof of lawful contact | Withdrawal or account closure | Set by the operator and justified in the schedule |
| Records of responsible gambling interactions | Evidence of safer gambling action | Date of the interaction | Set by the operator after checking licence conditions and regulator guidance |
The two rows with a stated period come from a published source. The others are decisions the operator has to make and defend. Check them against your licence conditions and regulator guidance, and write the reasoning into the schedule.
This is also where the five-year deletion rule bites. Once the period ends, the Gambling Commission guidance says personal data must be deleted unless the person has agreed to retention or another listed ground applies. A support platform that holds transcripts forever works against that.
The records that matter most in a regulated setting are not only the messages but the decisions behind them: who approved a reply, what was escalated, and why a player was or was not contacted. Our guide to the five fields a compliance audit trail must record covers what to capture, and our piece on gambling compliance communication shows how to prove the process works over 90 days. For the knowledge base your agents work from, see regulator-ready casino knowledge bases.
Our perspective on retention in player support
Most retention policies fail at the point where records are created, not where they are deleted. If a support reply is written by one person, edited by another and sent without a trace of who approved it, no schedule can rescue you later.
That is why we built Pitbot around human review. Every AI-generated reply is reviewed by staff before it reaches a player, and every decision is recorded in an audit trail. For a compliance officer, that means the record you are asked to retain already exists, in a consistent shape, rather than being reconstructed from inboxes and chat exports.
We also think responsible gambling signals and marketing suppression belong in the same workspace as support. When a player shows signs of harm, the decision to hold back promotional outreach is itself a record worth keeping and, in due course, worth disposing of on schedule.
Retention is a design question as much as a legal one. Put the review, the escalation and the audit trail in one place and your schedule has something clean to govern.
pitbot
Common mistakes to avoid
Copying a template without checking the law. Templates are a starting point. The periods in a generic document are rarely the ones your regulator expects.
One period for everything. A blanket seven years is simple, but it over-retains personal data and may under-retain records with a longer statutory period. Differentiate by record type.
No legal-hold clause. Without it, routine deletion can destroy records you are obliged to preserve once a dispute or investigation begins.
Forgetting non-obvious repositories. Shared drives, personal mailboxes, chat tools, ticketing systems and supplier platforms all hold records.
Deleting without evidence. The ICO expects approval to be logged where appropriate, and KPMG recommends retaining logs and validation of scope. If you cannot show what was deleted and why, you cannot defend the deletion.
Setting and forgetting. State Records NSW says to review the policy when business activities and priorities change. A new product, channel or market usually changes your records.
Putting retention into your support operation
If you run player support for an online casino or iGaming business, the practical test is simple: can you show, for any player conversation, who handled it, who approved the reply, what was escalated and when the record will be deleted? Our platform is designed to support the first three with human review and an audit trail, and it helps you apply your own schedule by keeping the records in one dashboard.
Pitbot is an AI-powered support platform for online casino operators. It combines multiple AI providers with human review of every reply, works across email, live chat, SMS and Telegram, detects sentiment and escalates sensitive cases, manages VIP queues, and detects responsible gambling signals so outreach can be suppressed. See how AI customer support for online casinos works, or explore the platform features.
For the safer gambling side, read about responsible gambling automation, and for identity checks, see KYC support automation. If you want to see how it would fit your own schedule, book a demo through our main site.
FAQ
How long do records need to be kept in the UK?
It depends on the record. Tax and payroll records commonly run for 3 to 6 years, and UK-licensed casinos must keep customer identification records for five years after the relationship ends. Sector rules, such as health records, can be much longer. Always check the current rule for each record type.
Do you still need to keep records for 7 years?
Not automatically. Seven years is a habit in some places, such as the Netherlands, where basic business records generally go for at least 7 years. UK tax periods are typically shorter, and personal data should not be kept longer than needed. Set periods by record type and cite the rule behind each one.
What does “retention period” mean?
The Society of American Archivists defines it as the length of time records should be kept in a specified location or form for administrative, legal, fiscal, historical or other purposes. In practice it is a period plus a trigger, such as five years from the end of a customer relationship.
What is the difference between a retention policy and a retention schedule?
The policy sets principles and responsibilities: what is covered, who owns it, how destruction and legal holds work. The schedule is the table of record types, periods, triggers and end-of-life actions. Keeping them separate means you can update periods without re-approving the whole policy.
Who should own the policy?
A named senior owner, often in compliance, legal or information governance, should be accountable. Business owners of each record type are responsible for applying it, and contractors and cloud suppliers should be covered by contract.
Sources
- Creating a Data Retention Policy That Meets Privacy Requirements, ACC (2024)
- Gambling Commission: retention period for AML records
- How long do you need to keep business records, 360 Accountants
- Keeping business records, Business.gov.nl
- Overview of record-keeping rules for business, Australian Taxation Office
- How long should I keep records? Internal Revenue Service
- Retention, ICO
- Creating and reviewing retention schedules, University of Edinburgh
- Retention Schedule for Professional Associations, International Council on Archives
- Defining Retention Periods, California Secretary of State
- Records and information management policy checklist, State Records NSW
- Foundations of effective data retention and deletion, KPMG
- Data storage advice, ICO
- Disposal and deletion, ICO
- SAA Dictionary: retention period
