Skip to main content

UK landlord compliance

How long must landlords keep rental records?

HMRC requires 5 years and 10 months. Tenancy agreements and compliance certificates have their own retention rules. UK GDPR adds a delete-when-no-longer-needed obligation on top.

Last updated:

The short answer

HMRC tax records: keep for 5 years and 10 months after the end of the tax year. For 2025/26 records, that means until 31 January 2032.

Tenancy agreements + deposit protection: at least 6 years after the tenancy ends, to cover the contract claim limitation period.

Compliance certificates: keep CP12s for at least 2 years after issue, EICRs for the 5-year validity plus 2 years, EPCs as long as you own the property (and they remain on the public register indefinitely).

UK GDPRrequires you to delete personal data when you no longer have a lawful purpose for keeping it. Set this up once in a written retention schedule and your privacy notice; don’t hoard ex-tenant data forever.

HMRC’s rule

5 years and 10 months, explained

HMRC’s record retention requirement for Self Assessment (and from April 2026, MTD ITSA) is 5 years and 10 months from the end of the tax year. The slightly odd number comes from: 5 years to cover the discovery assessment window, plus 10 months from 5 April year-end to the 31 January filing deadline.

Worked example. The 2025/26 tax year ends 5 April 2026. Records must be kept until:

5 April 2026 + 5 years + 10 months
= 31 January 2032

If you’re investigated, the retention obligation extends until the enquiry is closed. Carry-forward losses also extend it — you need to keep the records that justified the original loss for as long as the loss is being used to reduce a later year’s tax bill.

The full table

Retention by document type

HMRC tax records (rental income + expenses + supporting receipts)

5 years 10 months after end of tax year

From April 2026 onwards, MTD ITSA records fall under the same retention rule. Digital is fine.

Tenancy agreement (signed AST)

At least 6 years after tenancy ends

Limitation Act 1980 contract claim window. Larger portfolios often keep 7–10 years.

Deposit protection certificate + prescribed information

6 years after tenancy ends (matches AST)

Section 21 challenges can reach back this far; the deposit paper trail is your defence.

Gas Safety Record (CP12)

2 years minimum after issue

Best practice: keep all CP12s for as long as you own the property.

EICR

5 years (the validity) plus 2 years after

If C1/C2 issues were fixed, retain the remedial confirmation alongside.

EPC

On the public register indefinitely

Keep your own copy too. EPC is publicly searchable on GOV.UK Find an Energy Certificate.

HMO licence

Full validity plus 6 years after

Local authority Rent Repayment Orders can reach 12 months back from claim; documentation matters.

Right to Rent check evidence

1 year after tenancy ends

Civil penalties up to £20,000 per illegal occupier (raised 2024); strong defence requires evidence.

Maintenance records, invoices, contractor receipts

6 years (capital items longer)

Capital improvements increase the property's tax base for CGT — keep those forever.

The GDPR layer

You also have a duty to delete

UK GDPR requires you to delete personal data when you no longer have a lawful purpose for keeping it. For landlords, the most common categories that trigger deletion timers:

  • Ex-tenant contact details and bank detailsDelete or anonymise once the limitation period for any tenancy claim has passed (typically 6 years) unless still needed for an HMRC purpose.
  • Right to Rent check evidenceRetain only for the duration the GOV.UK guidance requires (currently 1 year after tenancy end) and then delete.
  • Applicant data from people you didn’t let toDelete relatively quickly — typically 6 months after the application unless there’s a complaint or live dispute.

The practical implementation is a written retention schedule in your tenancy admin process. LandlordFlow tags every document with the tenancy it relates to, so when a retention threshold is hit you can review and purge cleanly — not by “forgetting” the document exists in a shared Drive folder.

Common questions

Questions, answered

How long must I keep HMRC rental tax records?+
5 years and 10 months after the end of the tax year. For 2025/26 records (tax year ending 5 April 2026), you must keep them until 31 January 2032. The rule applies to all the income, expenses, and supporting documents that feed your Self Assessment (and from April 2026 onwards, your MTD ITSA submissions).
What if HMRC opens an enquiry?+
If HMRC opens an enquiry into a return, you must keep the relevant records until the enquiry is closed — even if the standard 5y10m has passed. Practically, if you receive an enquiry letter, freeze any retention-driven deletions until the matter is fully resolved.
Do tenancy agreements have a different retention rule?+
Yes. Tenancy agreements should be kept for at least 6 years after the tenancy endsto cover the limitation period for contract claims. Some landlord bodies recommend longer for HMO licensing audit purposes — 7 to 10 years is common practice in larger portfolios.
Compliance certificates — do they expire when the property is sold?+
Keep them as long as you owned and let the property, plus the standard retention period afterwards. Specifically: Gas Safety Records for 2 years after issue minimum (longer is best practice), EICR for the full 5-year validity plus 2 years, and EPC indefinitely while it’s on the register. If you sell, hand the documents to the new owner if they’re still in date.
Does GDPR force me to delete tenant data sooner?+
UK GDPR requires you to delete personal data when you no longer have a lawful purpose. For ex-tenant data, that means deleting most personal information after the retention periods above expire — with named exceptions for HMRC requirements (6 years), Right to Rent records (1 year past tenancy end), and any live disputes. Your privacy notice to tenants should set out which categories you retain for how long.

Keep what you need. Delete the rest.

See how LandlordFlow stores per-property records with retention-aware tags — so HMRC’s 5y10m and UK GDPR’s delete-when-done coexist cleanly.