How long should we keep minutes and papers?
Two laws pull a charity's filing cabinet in opposite directions. Charity and tax law says keep things — sometimes for years, sometimes forever. UK GDPR says don't keep personal data longer than you need it. The answer to both is the same: a short written retention schedule, adopted by the board, actually followed. Here's one you can adopt today.
The schedule
| Record | Keep for | Why |
|---|---|---|
| Governing document & amendments | Permanently | It's the rulebook — and proof of every version of it |
| Board minutes & written resolutions | Permanently | The charity's institutional memory; may be needed decades later for property, legal or safeguarding history |
| Committee minutes | 10 years | Common policy; permanently costs nothing if storage is digital |
| Annual accounts & trustees' reports | Permanently | Short, useful, and often requested years later |
| Accounting records (invoices, bank statements, ledgers) | 6 years from the end of the financial year | Charities Act 2011 requires at least 6 years; also covers HMRC |
| Gift Aid declarations & claims | 6 years after the last claim they cover | HMRC can audit claims; enduring declarations must be kept while in use plus 6 years |
| Payroll & PAYE records | 6 years | HMRC minimum is 3; 6 aligns with everything else and costs nothing |
| Contracts & leases | 6 years after they end (12 if signed as a deed) | Limitation periods for claims |
| Employment records (contracts, reviews, leavers) | 6 years after employment ends | Limitation periods; references |
| Unsuccessful job applications | 6–12 months | Discrimination claim window; after that, GDPR says delete |
| Insurance policies & employers' liability certificates | Policies permanently; EL certificates 40 years recommended | Injury claims can surface decades later |
| Property deeds & title documents | Permanently | Obviously |
| Safeguarding records | Per your safeguarding policy — take advice; records about children commonly kept at least until the person turns 25, and abuse-related records far longer | Regulator, insurer and inquiry expectations; when in doubt, do not destroy |
| Grant files (funded projects) | Funder's stated term — commonly 6 years after the grant closes | Check each grant agreement; funders can audit |
| Routine correspondence & email | 2 years unless it belongs in a category above | GDPR storage limitation — most email is clutter, not record |
How to adopt this in one board meeting
Put the schedule on the agenda as a consent item. Minute: "The board adopted the attached retention schedule; the secretary will action deletions annually each [month]." That single line does three jobs: it makes the schedule policy, it satisfies the UK GDPR expectation that you can say how long you keep personal data (your privacy notice should point to it), and it gives one named person a yearly prompt to actually delete things — which is the step everyone skips.
Frequently asked questions
Digital or paper — does it matter?
Either is fine for almost everything, as long as records are findable, backed up, and not stored solely in one person's personal account. Scan-and-shred works for routine records; keep original signed deeds, and anything whose original signature might matter, in paper.
Our records live in a former trustee's loft / personal Google Drive. Is that a problem?
Yes — the records belong to the charity, not the person. Politely recover them, move everything into an account the charity controls, and make "records handover" a line in your trustee exit routine.
Do we really have to delete things? Storage is free.
For records without personal data, keep what you like. For personal data, UK GDPR's storage limitation principle applies — "we kept everything forever because it was easy" is precisely the thing the principle forbids. The schedule is your defensible line.
This guide is general information, not legal advice — retention for safeguarding records in particular should follow advice from your insurer, umbrella body or regulator. Sources: Charities Act 2011 (accounting records), HMRC Gift Aid guidance, ICO guidance on the UK GDPR storage limitation principle. Checked July 2026.
The record that matters most is the one nobody wrote
Retention schedules only help if the minutes exist in the first place. The Committee Room turns a meeting recording into proper minutes — decisions numbered, actions logged, reviewed by a person. £19 per meeting.
See how it works