The general seven-year rule
Inland Revenue generally expects businesses to keep records that support their tax returns for seven years. That covers things like invoices issued and received, receipts, bank statements, wage and payroll records, GST records, and the working papers behind your accounts. The period is usually counted from the end of the tax year the records relate to, so records for an older year may need to be kept slightly longer than seven calendar years from the date they were created.
This guide is a practical overview, not legal or tax advice. Rules can change and some situations, such as an ongoing dispute or audit, mean records must be kept longer. Your accountant can confirm what applies to your business and is the right person to check with before deleting anything.
Other records with their own rules
Employment records, such as wage and time records and holiday and leave records, have their own retention expectations under employment law. Companies also have obligations about keeping certain company records. Industries such as health, finance, law and building often have extra rules from regulators or professional bodies about what to keep and for how long, sometimes much longer than seven years.
Contracts with clients can add requirements too. A government contract, a large corporate client or a construction project may specify how long project files must be kept, where they may be stored and how they must be destroyed afterwards. Keep a note of any such clauses with your record-keeping plan. If a clause conflicts with your general approach, the stricter requirement usually wins for that client, so tag those files clearly so they are not swept up in routine clean-outs.
Electronic records are acceptable, if kept properly
Most businesses now keep records electronically, which is generally acceptable as long as the records are complete, accurate, readable and can be produced when asked. Scanned paper receipts and cloud accounting records count, but you need to be able to find and open them for the full retention period, even if you change software along the way.
That last point is easy to overlook. If you move from one accounting platform to another, or cancel a subscription, check whether you can still access old records. Many cloud services restrict access after cancellation. Export reports, ledgers and supporting documents in standard formats before switching or closing an account.
Privacy pulls in the other direction
The Privacy Act 2020 says organisations should not keep personal information for longer than is required for the purposes it may lawfully be used. That does not override legal obligations to keep records, but it does mean keeping everything forever just in case is not automatically safe. Old CVs from unsuccessful applicants, customer details from years ago and personal documents in former staff mailboxes may all fall into this category.
The practical answer is a written retention schedule: a short table listing types of records, how long each is kept, why, and who is responsible for disposing of them. It shows you have thought about both the duty to keep and the duty not to over-keep. It need not be complicated; a single page covering financial, employment, client and general records is enough for most small offices.
Where backups fit in
Backups are for recovery, not record-keeping. Restoring a five-year-old backup to find one invoice is slow and unreliable, and backups often follow their own retention rules that may delete old copies automatically. Keep records in your accounting system, document management or a structured archive, and make sure that archive is itself backed up.
Align backup retention sensibly with your record-keeping. Many small businesses keep daily and monthly backups for a year or so for recovery, and rely on the accounting system and archive for the seven-year obligation. If you choose to keep a yearly backup for seven years as an extra safety net, document that decision.
Disposing of records safely
When records reach the end of their retention period, dispose of them securely. Shred paper records containing personal or financial information, and delete electronic records in a way that also covers copies in archives, shared folders and email attachments. For old computers and drives, use proper data destruction rather than simply deleting files.
Review the retention schedule once a year, ideally around year-end when you are already thinking about records. Note what was disposed of and when. A tidy, documented process is much easier to defend than a server full of everything ever created. It also keeps storage and backup costs under control, since less retained data means less to store and protect.
In short
- Keep business and tax records for at least seven years as a general rule.
- Some industries, contracts and employment records have their own requirements.
- Personal information should not be kept longer than needed.
- Use accounting systems and archives for records; backups are for recovery.