Keep your business records, such as contracts, invoices and proof of payment, for at least seven years. Keep the client's raw material, such as footage, exports and credentials, for 30 to 90 days after final payment, then delete it. Tax law covers the first group and privacy law covers the second.
Most small businesses resolve the tension by keeping everything forever. That obeys the first rule, breaks the second, and builds a pile that can only hurt you. The two rules govern different things, so once you split the pile, the policy takes about ten minutes to write.
The floor: what tax authorities make you keep
Start with the rule that has numbers in it. Retention periods are set by how long the tax authority can still question your return.
6 years applies if you do not report income that you should report and it is more than 25% of the gross income on your return.
7 years applies if you file a claim for a loss from worthless securities or a bad debt deduction.
4 years applies to employment tax records, counted from the later of the due date or the payment date.
There is no limit if you do not file a return or file a fraudulent one.
The six-year rule is not a choice you make. It is triggered by a mistake you may not know you made, so you cannot tell at filing time which bucket you are in. The honest default is closer to six years than three.
The UK is straighter and longer. HMRC says you must keep records for at least 5 years after the 31 January submission deadline of the tax year. Its own example: a 2022 to 2023 return filed by 31 January 2024 means keeping records until at least the end of January 2029, per HMRC's guidance.
In the UAE, the Federal Tax Authority says in a 2025 notice that taxable persons and exempt persons must retain relevant records for at least seven years following the end of the tax period. Exempt persons too, which catches people who assume having no tax to pay means having no records to keep.
Written by
The Delivvo team
Delivvo runs the client cycle for service businesses: inquiry, quote, contract, deposit and delivery. Payments go straight to your own account.
If you are self-employed and use part of your home only for work, you can deduct it on your US return. This post covers who qualifies, the simplified and regular methods with a worked example, the mistakes that cause trouble, and the records to keep.
For 2026 the IRS kept seven brackets from 10% to 37% and raised the standard deduction to $16,100 for single filers. This post gives the thresholds, explains self-employment tax and the permanent 20% QBI deduction, and shows how to set tax money aside from each payment.
The handoff is the last thing a client feels before deciding whether you were worth the money. This post gives a repeatable way to present finished work, show it with a short walkthrough, make approval one click, and turn a good delivery into the next job.
7 min read
Your inquiry link is free.
Free plan. No card needed.
Blog
Guides for service businesses, from the first inquiry to the final payment. Written by the team behind Delivvo.
Notice what none of these authorities asked for. Not one wants the client's forty gigabytes of raw footage. They want books, invoices, contracts, receipts and bank records, the documents that prove a number on a return. Check the exact period for your situation with your accountant.
The ceiling: what privacy law makes you delete
The other rule has no number, which is why people ignore it. The GDPR's storage limitation principle says personal data must be kept in a form that identifies people for no longer than is necessary for the purposes it is processed for, as set out in Article 5 of the UK GDPR. The test is relative. "Necessary" is measured against the reason you collected the data. When the job is done, the clock has run out, whatever your hard drive has room for.
The same article adds that the controller must be able to demonstrate compliance. A retention period you never decided is not a defence, and "I just kept it" is not a reason you can show anyone.
Other people can also force the question. Article 17 gives a person the right to have their data erased without undue delay once it is no longer necessary for the purposes it was collected for.
The exception is narrow, and it is the hinge of this post. Erasure does not apply where processing is necessary to comply with a legal obligation. Your tax record-keeping duty is exactly that. So the law does not make you choose between the tax office and privacy rules. It tells you which parts of the pile are protected by the first and leaves the rest exposed to the second.
One nuance decides who is responsible for what. On your own books, such as invoices, contracts and your client list, you are usually the controller and the retention decision is yours. On material the client handed you to work on, such as a customer export, a user database or a subscriber list, you are usually a processor acting on their instructions, and the answer should be in the contract. If it is not, you are improvising with someone else's liability. This is general information, not legal advice, so check your own position with a lawyer.
The record and the raw material
Here is the split that dissolves the problem.
The record is the contract, the invoice, the proof of payment and the moment the client accepted the work. It is small, mostly names, dates and amounts. It is required for years, and it is what every tax authority above is asking about.
The raw material is everything else. The footage, the customer export you were given to build a dashboard, layered design files, a staging database dump, credentials, a folder of headshots. It is large, often full of other people's personal data, and no tax authority has ever asked for a byte of it.
Keep the first. Delete the second.
Almost nobody does, and not out of laziness. In a normal setup the two live in the same place. One folder per client, holding the signed PDF and the client's whole customer list side by side. One folder gets one policy, and the safest-looking policy for a folder you cannot see inside is "forever".
Forever is a poor answer for the raw material. It maximises the damage on every bad day: a breach, a stolen laptop, a subpoena, an erasure request you cannot honour, an ex-client asking what you still hold two years after the invoice cleared. None of that risk earns you anything, because the job is finished.
A pile of old paper files in worn folders, the undifferentiated heap most businesses actually keep
Regulators are looking at exactly this
In 2025, European data protection authorities ran a coordinated review of how organisations handle erasure requests. The EDPB reports that 32 data protection authorities took part and 764 controllers responded. These were not corner shops. They ranged from small firms to multinationals, many with compliance teams and budgets.
Controllers reported difficulty with setting retention periods and with deleting personal data held in backups. Some relied on weak anonymisation as an alternative to deletion. If organisations with staff and lawyers struggle with these two things, a solo business that has never decided a period or looked at its backups is in familiar company.
The backup problem
You deleted the folder. Did you?
Time Machine has it. A cloud backup has it. The drive trash holds it for thirty days, and version history holds an older copy longer. An external drive in a desk drawer from 2023 has it. You emailed yourself a zip once. The client's file transfer link may still resolve.
Backups exist to defeat deletion, which is their whole purpose, so a system built so that nothing is ever really gone will be bad at making things really gone. You do not need a bank's process. You need to know where copies land and have a sweep that reaches them. If your answer to "where are the copies?" is a shrug, you have a hope, not a policy.
A retention policy that fits on one page
Decide two numbers, not one. Records: seven years, which covers the IRS six-year exposure, HMRC's five years after January and the FTA's seven. Raw material: 30 to 90 days after final payment, unless the contract says otherwise.
Put it in the contract. "The contractor keeps project files for 90 days after final payment and deletes them after that" protects both sides.
Warn before you delete. One email at day sixty reads as professional, and it fits naturally into an offboarding checklist.
Keep the record small enough that keeping it costs nothing. A signed contract PDF and an invoice snapshot are kilobytes.
Know where the copies are. Write the list once: backup software, cloud trash, email, external drives and transfer links.
Never hold credentials past handover. Rotate them at offboarding.
How you send files matters too. If large files travel by public link, a proper delivery setup gives you one place to remove them later.
Hands sorting documents into a cardboard file box, separating the record from the raw material
How Delivvo helps you keep the record and clear the rest
Delivvo keeps the paperwork that tax rules care about attached to each client, separate from the files you deliver, so you can decide on two retention periods instead of one.
Here is the setup:
Every contract is signed in Delivvo with a typed or drawn signature, and the signing record stores a SHA-256 hash, the IP address, the device and an archived PDF.
Every invoice gets a sequential number in your own format, and invoices can be voided or corrected with credit notes, so the history stays readable.
Every invoice, receipt, contract and quote carries a verification code. Anyone with the code can see the issuer, kind, number, dates, amount and status.
Project files live in the client portal, which opens with a one-time code, so you can see exactly what you hold for each client rather than guessing.
When a job is finished, you review the project's files against your retention period and remove them on schedule, while the contract and invoices stay in the client record.
The detail that helps most is the separation itself. Contracts and invoices sit in one place and project files in another, so clearing a finished job's working files does not mean touching the record. Clients pay you directly through your own gateway, and Delivvo takes 0%, so payment records come from your gateway as normal.
See how the client portal stores files, and read about data security. Delivvo issues records and templates, not tax or legal advice, so confirm your periods with your accountant or lawyer.
FAQ
How long should I keep client files after a project ends?
Keep business records, such as contracts, invoices and payment proof, for at least seven years in most places. Keep raw client material for 30 to 90 days after final payment, unless your contract says otherwise.
How long does the IRS say to keep business records?
Three years is the default. It rises to six years if you left out income of more than 25% of the gross income on your return, and to seven for bad debt or worthless securities claims. Check your own case with your accountant.
Does GDPR let me keep client data for tax reasons?
Yes, where a legal obligation requires it. Erasure rights do not apply to data you must keep for a legal duty such as tax record-keeping. They do apply to data you no longer need.
What do I do about backups?
List where copies live, including backup software, cloud trash, email and external drives. Then include those places when you delete a finished job's files.
Delivvo runs the whole client cycle for service businesses, from the first inquiry to the quote, contract, deposit, invoice and delivery, so the contracts and invoices you must keep stay organised per client while you clear the rest. Clients pay you directly through your own gateway, and Delivvo takes 0%. Start free
