How long should a company keep emails in the UK?

The short answer

Email is not a category of record in UK law; it is just the way many records arrive. The law and regulators set periods for particular records, and an email that is one of those records takes that period. An email that is not, such as a meeting invitation, should be kept only as long as it is useful.

So the honest answer to "how long should we keep emails?" is: work out which kinds of record your email contains, find the period that applies to each, and keep everything else for a short, sensible business period. UK GDPR then sets the outer limit for anything containing personal data: no longer than necessary.

This page gives the sourced reference points most UK organisations start from. It is not legal advice, and your own sector, contracts and circumstances may set longer or shorter periods.

UK reference points for business email

These are the periods most often relevant to email, taken from the legislation or the government's own guidance.

Notice that the accounting rules differ: HMRC's period, as set out on gov.uk, is longer than the Companies Act minimum for a private company, so most companies work to the longer one. gov.uk also lists cases where you must keep records for longer, such as a transaction covering more than one accounting period or a late Company Tax Return.

Two details make these rules directly relevant to email. gov.uk's list of company records includes contracts, invoices and "correspondence", so an email that evidences a sale or a purchase is part of the record. And the PAYE guidance notes that there are different rules for records proving you paid the correct minimum wage, provided the correct statutory leave and paid the correct holiday pay, so HR email needs its own look rather than the payroll period by default.

Contracts and the six-year rule

Many organisations settle on six years for business correspondence because of the Limitation Act 1980. Section 5 says an action founded on simple contract cannot be brought after six years from the date the cause of action accrued. Section 8 sets twelve years for an action on a specialty, such as a deed. Both sections apply in England and Wales; Scotland and Northern Ireland have their own rules, so check which apply if you trade there.

Two points matter when you turn that into an email rule:

• The six years run from when the cause of action accrued, which is not necessarily when the email was sent. A contract that runs for several years, or a problem that surfaces late, can push the relevant date later.
• Other limitation periods exist for other kinds of claim and document. Agree with your legal adviser which apply to you before you set a longer or shorter period for contract correspondence.

In practice, many businesses keep contract-related email for six years from the end of the contract, which is why category-based retention, rather than one period for everything, is worth the effort.

Money laundering records

If your business is a "relevant person" under the Money Laundering Regulations 2017 (accountants, solicitors, estate agents, financial firms and others in scope), regulation 40 sets the record-keeping rule. You must keep copies of customer due diligence documents and information, and sufficient records of transactions, for five years from when you know or have reasonable grounds to believe the transaction is complete or the business relationship has ended.

Regulation 40(4) adds that records of transactions within a business relationship need not be kept for more than 10 years. And regulation 40(5) is the part people miss: once the period has expired, you must delete personal data obtained for the purposes of the regulations, unless an exception applies, such as another law requiring it, court proceedings, or the person's consent.

That deletion duty is a good example of why "keep everything forever" is not a safe default.

Email that is not a business record

Much of any mailbox is not a record of anything: meeting invitations, delivery notifications, newsletters, internal "thanks" replies and quick questions that were answered the same day. No law asks you to keep these, and UK GDPR gives you a reason not to keep them for long when they contain personal data.

The difficulty is that this mail sits in the same mailboxes as the records that do matter, and nobody wants to sort it by hand. Two approaches work in practice:

• Set a modest default period for everyone, then give longer periods to the departments or accounts whose mail is mostly records, such as finance, HR or regulated advisers.
• Keep the default long enough to cover the everyday disputes and queries your business actually sees, and write that reason into your policy.

Either way, the decision is yours to make and document; the archive simply applies it.

FCA-regulated firms

For firms in scope of SYSC 10A in the FCA Handbook, relevant electronic communications about activities in financial instruments must be kept, and the records must be kept for five years and, where the FCA requests, up to seven (SYSC 10A.1.14R). They must be held in a durable medium that does not allow the original to be altered or deleted (SYSC 10A.1.16R). Scope depends on the firm and its activities, and other SYSC rules cover other records.

Our page on FCA email retention sets out the rules in more detail and how an immutable journaling archive maps to them.

Balancing retention against UK GDPR

Every period above has a counterweight. UK GDPR Article 5(1)(e), the storage limitation principle, says personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed. Almost every business email contains personal data: names, email addresses, and often much more.

So keeping all email for ten years "just in case" is not automatically the safe option. It means holding personal data you may not be able to justify, and every subject access request, dispute and search gets bigger. The defensible approach is the one this page describes: a reason for each period, deletion when the period ends, and a hold when a dispute is anticipated. See email retention and UK GDPR for the detail.

Turning periods into archive settings

Knowing the periods is half the job; applying them consistently is the other half. In NinjaOne Archiver you set a standard retention policy for the whole organisation, then custom policies by department or individual email account, with retention from 30 days to over a decade or unlimited. For example:

• A standard policy for everyday mail, set to a business period you have agreed.
• A longer policy for the finance department, matching your accounting records period.
• A policy for client-facing advisers in a regulated firm, matching your FCA record-keeping period.
• A legal hold when a dispute is anticipated, which freezes retention for the held data until it is removed.

Because mail is captured by journaling and stored immutably, a message stays in the archive for its retention period even if the user deletes their own copy. Leavers' mail can stay searchable after their accounts are removed; how deactivated mailboxes count towards your seats is covered on deactivated mailboxes. Our email retention policy guide shows how to write the schedule that sits behind these settings, and we can set the policies up with you. Contact us to talk it through.

*This page summarises public sources as at November 2026 and is not legal advice. Confirm the periods that apply to you with your legal or compliance adviser.*