The end of the year is a good time to review what you’re keeping, what can be destroyed, and whether your archive is still fit for purpose. Here’s a simple checklist.

Most businesses don’t manage their records. They let them pile up. Boxes go into a storeroom, files get saved to a shared drive, and nobody thinks about any of it until January, when someone opens the cupboard and asks what’s actually in there.

A year-end document review doesn’t have to be a big project. If you do it every year, it’s a few hours of work and the archive stays under control. Skip it for five years and it becomes a much bigger job.

Below is a structure you can work through, step by step.

Why December works for a record review

There’s nothing magic about the date. It’s just convenient. The calendar year ends, and for many businesses the financial year does too, so you get a natural checkpoint. You’re probably already looking back at the year and planning the next one. And the people who handled this year’s paperwork still remember which files matter and which were one-offs. Ask them in eighteen months and they won’t.

There’s also a tax reason. HMRC’s guidance says a limited company must keep its records for 6 years from the end of the last company financial year they relate to. That period runs longer if:

• a transaction covers more than one accounting period
• the company bought something it expects to last more than 6 years, such as equipment or machinery
• the Company Tax Return was sent late
• HMRC has opened a compliance check into the return

Sole traders and partnerships work to a different rule: at least 5 years after the 31 January submission deadline for the relevant tax year. So records for a 2022 to 2023 return sent on time need to be kept until at least the end of January 2029.

One caveat. If your company’s financial year ends in March or June, the 6-year clock runs from that date, not from December. The year-end review is still a sensible moment to check which batches have passed their date. Just make sure you’re counting from the right point.

The year-end archive checklist

Work through these in order. Each step feeds the next.

1. Check what can now be destroyed

Go through your records against your retention schedule. Anything that has passed its minimum retention period should be put forward for destruction, unless there’s a specific reason to hold on to it, such as an open HMRC check or a live dispute.

If you don’t have a retention schedule, this is the year to write one. The ICO’s guidance on UK GDPR says you need to set and document standard retention periods for the personal data you hold wherever possible, and that you shouldn’t keep data indefinitely just in case it turns out to be useful. Small organisations doing occasional, low-risk processing may not need a written policy, but they still have to review what they hold and get rid of what they no longer need. Our document retention guide covers how long common record types should be kept.

2. Book confidential destruction

Once records are signed off for destruction, have them shredded by a confidential destruction service. Don’t put them in general waste or the office recycling bags. Ask for a certificate of destruction, so you have a record of what went and when.

When you’re choosing a provider, ask whether they work to BS EN 15713:2023, the British Standard code of practice for the secure destruction of confidential and sensitive material. It covers collection, storage, transport and the destruction itself. It doesn’t cover wiping digital data, so hard drives and other media need a separate conversation.

And book it now. Approved boxes have a habit of sitting by the door until the next quarter, and then the one after that.

3. Audit the records created this year

Look at what came in or was created over the last 12 months. Has it been filed the same way as everything else? Is it indexed so someone other than the person who filed it could find it? Small inconsistencies, like one team naming folders by client and another by date, are easy to fix now and painful to untangle in five years.

4. Check storage conditions

If you keep records on site, go and look at the storage area. Signs of damp, droppings or chewed boxes, sagging shelves and fading labels are all reasons to act. Check every box is labelled clearly, and that the room is locked and only the right people can get in.

5. Review the retention schedule itself

A schedule written three years ago may not fit the business you run today. Ask whether anything has changed. Have you started trading in a new area, taken on a regulated activity, bought expensive equipment, or lost the person who used to look after the archive? Any of these can change what you keep and for how long. The ICO also recommends reviewing retention at regular intervals, not just at the end of a set period.

6. Make sure paper and digital records match

If you hold both, check the two agree. The common problem is a paper file that’s been shredded while the digital index still lists it as held, or the other way round. Either one leaves you unable to say with confidence what you’ve got. The ICO also points out that if you delete personal data from a live system, it should come out of the backups too.

7. Test whether you can actually find things

Pick a specific record from three years ago and try to retrieve it. Could you have it within a working day? If not, you’ve found a gap, and it’s better to find it now than when a customer, a solicitor or HMRC is waiting. Remember too that a subject access request covers personal data you hold in storage, not just what’s on your systems.

If the review turns up bigger problems

Sometimes the checklist doesn’t take a few hours. You open the storeroom and find years of unlabelled boxes, or records that should have gone a long time ago. That’s not a failure. You now know where you stand, which is more than you did last week.

Don’t try to sort it all at once. Start with the records that carry the most risk, which usually means anything holding personal data: HR files, customer details, payroll. The ICO is clear that personal data kept longer than you need it is unlikely to have a lawful basis. Old files about people are the ones to deal with first.

After that, a proper cataloguing and review project tends to follow the same pattern. Every box gets listed and given a reference. Each one is checked against the retention schedule and marked to keep, review or destroy. The keep pile is indexed so it can be found again, and the destroy pile goes for confidential shredding with a certificate.

This is where an external archive provider can help. If nobody in-house has the time, a provider can catalogue the backlog, move what you need to keep into managed storage, and handle the destruction. You end up with an archive you can search. Once that’s done, next December’s review really is a few hours’ work.