How long must a Northern Ireland business keep emails and records?

A Northern Ireland limited company must keep its company and accounting records for six years from the end of the financial year they relate to, and VAT records for at least six years; a sole trader or partner keeps tax records for at least five years after the 31 January filing deadline ^{1Source 1Running a limited company: company and accounting records — GOV.UK.www.gov.uk/running-a-limited-company/company-and-accounting-recordsAccessed 3 November 2026See in Sources2Source 2Business records if you're self-employed: how long to keep your records — GOV.UK.www.gov.uk/self-employed-records/how-long-to-keep-your-recordsAccessed 3 November 2026See in Sources3Source 3Charge, reclaim and record VAT: keeping VAT records — GOV.UK.www.gov.uk/charge-reclaim-record-vat/keeping-vat-recordsAccessed 3 November 2026See in Sources}. Payroll records must be kept for three years from the end of the tax year, and minimum wage records for six ^{4Source 4PAYE and payroll for employers: keeping records — GOV.UK.www.gov.uk/paye-for-employers/keeping-recordsAccessed 3 November 2026See in Sources5Source 5National Minimum Wage Manual NMWM12040: records to be kept — HM Revenue & Customs, updated 28 September 2026.www.gov.uk/hmrc-internal-manuals/national-minimum-wage-manual/nmwm12040Accessed 3 November 2026See in Sources}. Northern Ireland's own employment law adds its periods: working-time records for two years and fair employment monitoring records for three years from the application ^{6Source 6The Working Time Regulations (Northern Ireland) 2016, regulation 11 — legislation.gov.uk.www.legislation.gov.uk/nisr/2016/49/regulation/11Accessed 3 November 2026See in Sources7Source 7The Fair Employment (Monitoring) Regulations (Northern Ireland) 1999, regulation 18 — legislation.gov.uk.www.legislation.gov.uk/nisr/1999/148/regulation/18Accessed 3 November 2026See in Sources}. Emails are records like any other, so an email that evidences a contract, an invoice or an employment decision is subject to the same periods. UK GDPR then sets the ceiling: personal data must not be kept longer than necessary, and you need a written retention schedule to show why you keep what you keep ^{8Source 8A guide to the data protection principles: storage limitation — Information Commissioner's Office.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/Accessed 3 November 2026See in Sources}.

The short version

• Six years is the working rule for anything financial or contractual: it matches HMRC's requirement for companies and the six-year limit for contract claims in Northern Ireland ^{1Source 1Running a limited company: company and accounting records — GOV.UK.www.gov.uk/running-a-limited-company/company-and-accounting-recordsAccessed 3 November 2026See in Sources9Source 9The Limitation (Northern Ireland) Order 1989, article 4 — legislation.gov.uk.www.legislation.gov.uk/nisi/1989/1339/article/4Accessed 3 November 2026See in Sources}.
• Employment records have their own periods, several set by Northern Ireland law rather than Great Britain's ^{6Source 6The Working Time Regulations (Northern Ireland) 2016, regulation 11 — legislation.gov.uk.www.legislation.gov.uk/nisr/2016/49/regulation/11Accessed 3 November 2026See in Sources7Source 7The Fair Employment (Monitoring) Regulations (Northern Ireland) 1999, regulation 18 — legislation.gov.uk.www.legislation.gov.uk/nisr/1999/148/regulation/18Accessed 3 November 2026See in Sources}.
• UK GDPR doesn't set periods; it requires you to decide, document and apply them ^{8Source 8A guide to the data protection principles: storage limitation — Information Commissioner's Office.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/Accessed 3 November 2026See in Sources}.
• Microsoft 365 is not a records system by default: deleted email is gone after 14 to 30 days and a leaver's mailbox after 30, unless retention policies or a backup keep it ^{10Source 10Recoverable Items folder in Exchange Online — Microsoft Learn, 25 September 2026.learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folderAccessed 3 November 2026See in Sources11Source 11Delete a user from your organization — Microsoft Learn, updated 30 October 2026.learn.microsoft.com/en-us/microsoft-365/admin/add-users/delete-a-userAccessed 3 November 2026See in Sources}.

How long must a business keep its records?

The penalties are real. HMRC can fine a company up to £3,000 for failing to keep adequate records, and directors can be disqualified; incomplete PAYE records carry a penalty of up to £3,000 too ^{1Source 1Running a limited company: company and accounting records — GOV.UK.www.gov.uk/running-a-limited-company/company-and-accounting-recordsAccessed 3 November 2026See in Sources4Source 4PAYE and payroll for employers: keeping records — GOV.UK.www.gov.uk/paye-for-employers/keeping-recordsAccessed 3 November 2026See in Sources}. Some periods run longer than this table: health surveillance records under COSHH and asbestos rules, for example, are kept for decades, and pension records for the life of the scheme. Check the sector rules that apply to you.

Are emails business records?

Yes, when they carry the information the law requires you to keep. An email that confirms an order, approves an invoice, agrees a variation to a contract, records a disciplinary decision or reports an accident is the record of that event, and the retention period follows the content, not the format. The practical consequence is that "we keep email for a year" is not a policy a business can defend if its contracts run for six. The reverse is also true: a mailbox that keeps everything for ever holds personal data far beyond what UK GDPR allows, because the storage limitation principle requires personal data to be kept in a form that identifies people "for no longer than is necessary" ^{8Source 8A guide to the data protection principles: storage limitation — Information Commissioner's Office.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/Accessed 3 November 2026See in Sources}.

What does UK GDPR require you to decide?

The ICO is clear that the UK GDPR does not set specific time limits for different types of data; instead, organisations need to establish and document standard retention periods for different categories of information, and be able to justify them ^{8Source 8A guide to the data protection principles: storage limitation — Information Commissioner's Office.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/Accessed 3 November 2026See in Sources}. A retention schedule does that in one page: each record type, how long you keep it, why (the statutory period or the limitation period), and what happens at the end (deletion or anonymisation). The ICO notes its guidance is under review following the Data (Use and Access) Act, so keep an eye on updates, but the principle hasn't changed ^{8Source 8A guide to the data protection principles: storage limitation — Information Commissioner's Office.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/Accessed 3 November 2026See in Sources}.

Why do most businesses choose six years?

Because two rules point to it. HMRC requires companies to keep records for six years ^{1Source 1Running a limited company: company and accounting records — GOV.UK.www.gov.uk/running-a-limited-company/company-and-accounting-recordsAccessed 3 November 2026See in Sources}, and in Northern Ireland a claim founded on simple contract may not be brought after six years from the date the cause of action accrued ^{9Source 9The Limitation (Northern Ireland) Order 1989, article 4 — legislation.gov.uk.www.legislation.gov.uk/nisi/1989/1339/article/4Accessed 3 November 2026See in Sources}. Keeping the contract, the invoices and the emails that evidence them for six years after the relationship ends means the records exist for as long as anyone could sue on them. Keeping them for twenty is a cost and a data-protection liability.

What does "deleted" mean in Microsoft 365?

Retention policies are the tool that turns Microsoft 365 into something that meets the table above: they keep content for a set period even if a user deletes it, and can delete it automatically at the end. Licensing matters here. Microsoft's service description lists Microsoft 365 Business Premium, and the Enterprise E3 and E5 plans, as the licences that provide organisation-wide retention policies for Exchange, SharePoint and OneDrive; Business Basic and Business Standard are listed only for Teams chat and channel retention ^{15Source 15Microsoft Purview service description: licensing for retention policies — Microsoft Learn, 29 October 2026.learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-descriptionAccessed 3 November 2026See in Sources}. A business on Basic or Standard that needs a six-year email retention rule will need to upgrade, add Exchange Online Archiving, or rely on a separate backup.

Retention and backup solve different problems. Retention keeps a copy inside your tenant for compliance; a backup keeps a copy outside it that a compromised administrator can't delete. Our guide to backing up Microsoft 365 explains why you need both, and our guide to Microsoft 365 Business Premium covers what the licence includes.

What should a small business actually do?

1. 1.Write a one-page retention schedule from the table above, adding any sector rules, and have a director sign it off.
2. 2.Apply it in Microsoft 365: a retention policy on mailboxes and SharePoint for the longest period you need, and a shorter one for personal data you have no reason to keep.
3. 3.Decide what happens to a leaver's mailbox before they leave: convert it to a shared mailbox or export it, because the account is gone 30 days after deletion ^{11Source 11Delete a user from your organization — Microsoft Learn, updated 30 October 2026.learn.microsoft.com/en-us/microsoft-365/admin/add-users/delete-a-userAccessed 3 November 2026See in Sources}.
4. 4.Keep a backup outside the tenant for the same periods, and test that you can restore a mailbox from three years ago.
5. 5.Review the schedule once a year, and when the ICO updates its guidance.

How does BTNI help?

This is not legal advice; your accountant and solicitor confirm the periods that apply to you. What BTNI does is make the schedule real: retention policies configured in Microsoft 365, leavers handled to a checklist, and Backup & Disaster Recovery that keeps a restorable copy for as long as the schedule says. A free Business Technology Review checks what your tenant currently keeps, which is usually less than people assume.