The Disposal Warrant: Evidencing Retention Decisions in UK Professional Firms
Photo: N Chadwick , CC BY-SA 2.0, via Wikimedia Commons
Professional firms rarely set out to keep records for too long. Files accumulate because closure is awkward, because a partner may need them, or because no one has been given the authority to press delete. The result is a growing archive in which the firm cannot easily say why a record exists, who owns it, or when it should be removed. That is a governance gap, not merely a storage cost.
A retention schedule is the cheapest evidence a firm can hold. It demonstrates that records are kept for identified reasons, that disposal is authorised rather than accidental, and that regulatory and data-protection duties have been considered. For Article Directory UK readers, the practical question is not whether to adopt a schedule, but how to build one that remains usable after the consultant has left and the next audit begins.
Begin with obligations, not cabinets
The schedule should be built from record classes, not from the way folders happen to sit on a server. Start with the legal and regulatory minimums that apply to the firm's work. The Limitation Act 1980 provides a useful baseline for civil claims: six years for simple contract, twelve years for deeds, and six years for most tort claims, with a three-year period for personal injury. These periods are a floor for many files, not a complete retention policy. A file may need to be kept longer because a regulator, professional body, insurer or tax authority expects it.
Sector rules will vary. Firms handling client money, regulated financial services, immigration work or company secretarial services will have additional requirements. Anti-money-laundering rules generally require records to be kept for five years after the end of the business relationship or occasional transaction. Company law requires private companies to keep accounting records for three years and public companies for six. VAT records are normally kept for six years, while PAYE records are generally kept for three years after the end of the relevant tax year. Professional indemnity insurers may also impose policy conditions that exceed the statutory minimum.
UK GDPR adds a different kind of duty. Article 5(1)(e) requires personal data to be kept in a form that permits identification for no longer than is necessary for the purposes for which it is processed. That does not mean every file must be destroyed at the earliest possible moment. It does mean the firm must be able to explain why a retention period has been chosen and why a particular record has not yet been disposed of.
Build the one-page schedule
A retention schedule that runs to forty pages will not be used. A one-page schedule, supported by a short appendix for exceptions, is more likely to survive changes in personnel. The main page should set out, for each record class, the minimum retention period, the event that starts the clock, the source of the obligation, the disposal method and the owner.
| Record class | Clock starts | Typical minimum |
|---|---|---|
| Client matter file — advisory | Matter closure | 6 years |
| Client matter file — deed or specialty | Matter closure | 12 years |
| AML identification and transaction records | End of relationship | 5 years |
| Accounting records — private company | Date made | 3 years |
| VAT records | End of accounting period | 6 years |
| PAYE records | End of tax year | 3 years |
| Complaints file | Complaint closure | 6 years |
| Legal-hold material | Hold release | As advised |
The clock trigger matters as much as the period. "Client file — six years" is ambiguous if no one knows whether the clock starts at the last invoice, the last piece of work, the closure memo or the end of the engagement. Define the event. Where a file may be relevant to a future claim, a review date is often safer than an absolute destruction date. The schedule should also identify who may approve an early disposal and who may grant an extension.
Legal hold: the pause that protects the firm
A retention schedule without a legal-hold procedure is a liability. Destruction must stop when litigation is reasonably anticipated, when a regulator opens an inquiry, when a complaint is escalated, when a subject access request is received, or when an insurer asks the firm to preserve material. Insolvency, fee disputes and employment tribunal claims are further triggers.
The hold should be recorded centrally, communicated to records staff and IT, and released only in writing by the person authorised to do so. The hold register should identify the matter, the trigger, the date, the custodian and the scope. It should also confirm that backup and archive systems have been included. A hold that applies only to the live matter folder is not a hold.
The destruction log
The destruction log is the evidence that disposal was deliberate. It need not record every individual email, but it should record batches by record class and matter reference. A useful entry includes the date, record class, reference, volume or format, retention basis, authorising person, disposal method and any certificate or reference from a secure shredding or deletion provider. The log should also record where destruction was deferred and why.
The log itself should be retained. It is the firm's proof that a record was disposed of in the ordinary course of a governed process, rather than lost or deleted to avoid scrutiny.
The November purge
An annual purge gives the schedule an operational rhythm. November is a sensible point in many firms: the financial year-end is close enough to prompt housekeeping, but the holiday period has not yet disrupted staffing. The purge should be a controlled cycle, not a general tidy-up. Extract the list of records due for disposal, check each against the hold register, obtain the required approval, dispose of the records, update the log and report the results to management.
Useful metrics include the number of records due, the number destroyed, the number held, the number deferred and the reasons for deferral. A short management report, minuted once a year, is stronger evidence than an undated policy sitting in a shared drive.
Making the schedule audit-ready
An auditor or regulator is likely to ask four questions: can you show the schedule, can you show that it was approved, can you show how it was applied to a sample of files, and can you show that holds were respected? A one-page schedule, a hold register and a destruction log answer those questions without a reconstruction exercise.
Retention is not a storage problem to be solved by buying more capacity. It is an active governance routine. Firms that can explain why a file is still held, and why another has been destroyed, are better placed to defend their decisions. The discipline lies in the record of the decision, not in the size of the archive.
