# How long must an online shop keep order records and customer data? The tax periods, the claim period, and when to delete

> A sole trader keeps order records for 5 years after the 31 January return deadline, a company for 6 years. The dates for one order, and what to delete sooner.

- Page to cite: https://aeolookup.com/online-shops/how-long-must-online-shop-keep-order-records-customer-data/
- Publisher: AEO Lookup (https://aeolookup.com/)
- Section: Online shops, Running the shop
- Published 1 October 2026
- Key fact: A sole trader must keep business records for at least 5 years after the 31 January return deadline for the tax year, so the record of an order delivered on 14 November 2026 is kept until at least 31 January 2033; a limited company keeps it for 6 years from the end of the financial year, and VAT records are kept for at least 6 years.
- Sources: GOV.UK "Business records if you're self-employed: how long to keep your records", "Running a limited company: company and accounting records" and "Keeping VAT records"; Limitation Act 1980 s 5 and UK GDPR Article 5(1)(e) on legislation.gov.uk; GOV.UK "Accepting returns and giving refunds: the law"; ICO, "Principle (e): Storage limitation"; all read 2026-10-01. The shop and the order in the example are invented.

A sole trader's online shop must keep its order and sales records for at least 5 years after the 31 January tax return deadline for the tax year the sale falls in; a limited company must keep them for 6 years from the end of its financial year. The period starts on the day of the sale and stops on a date fixed by the tax year or the year end, so two orders a day apart can have end dates a year apart.

## The periods, side by side

| What you hold | Keep for | Counted from | Source |
|---|---|---|---|
| Income and expense records, sole trader or partnership | At least 5 years | The 31 January return deadline for that tax year | GOV.UK |
| Accounting records, limited company | 6 years | The end of the financial year they relate to | GOV.UK |
| VAT records and invoices, if registered | At least 6 years, or 10 if you use the VAT One Stop Shop | Not stated on the page | GOV.UK |
| Evidence against a customer's claim | 6 years in England and Wales | The day the claim arose | Limitation Act 1980, section 5 |
| Customer details you have no legal reason to keep | "No longer than is necessary" | Your own stated period | UK GDPR, Article 5(1)(e) |

The records GOV.UK lists for a company include "all goods bought and sold", orders, delivery notes, invoices and correspondence. For a shop that is the order, the invoice, the proof of delivery and the emails about a return. GOV.UK says HMRC can fine a company £3,000, or disqualify its director, for not keeping accounting records.

On claims, GOV.UK's page on returns says customers "have up to 6 years to make a claim for an item they've bought from you (5 years in Scotland)".

## One order, with dates

A sole trader who is not VAT registered delivers a £42 order on Saturday 14 November 2026.

1. The sale falls in the 2026 to 2027 tax year, which ends on 5 April 2027.
2. The online return for that year is due by 31 January 2028.
3. Five years after that deadline is 31 January 2033. The order record is kept until at least then.
4. A contract claim over that order could be brought until 14 November 2032, six years after delivery. That is the earlier date, so the tax date decides.

Now move the order. Delivered on 5 April 2027, the last day of that tax year, it is kept until 31 January 2033, just under 5 years and 10 months. Delivered a day later, on 6 April 2027, it belongs to the next tax year and is kept until 31 January 2034, just under 6 years and 10 months.

**If the shop is a company** with a 31 March year end, the 14 November 2026 order sits in the year ending 31 March 2027 and is kept until 31 March 2033.

**If the shop is VAT registered,** the VAT record is kept for at least 6 years. GOV.UK's page does not say what the 6 years run from. Counted from the end of a VAT quarter that closes on 31 December 2026, that is 31 December 2032, earlier than the sole trader's date. A shop close to registering can check the test in our [VAT threshold guide](https://aeolookup.com/online-shops/vat-threshold-online-sellers-shopify-etsy-ebay/).

One rule covers all of these for a shop with no One Stop Shop sales: keep each order file for seven years from the order date, then delete it. Seven years is our rounding, not a statutory figure; a late return or an HMRC check lengthens the legal period. The sole trader's longest case is two months short of it. A company's, for an order on the first day of its financial year, is one day short.

## What to delete sooner

The UK GDPR keeps no list of periods. The ICO's guidance, which it marks as under review after the Data (Use and Access) Act, says the UK GDPR "does not set specific time limits for different types of data" and that you must be able to justify how long you keep each kind.

- **Tax records are safe to keep.** If you keep personal data to meet a legal requirement such as income tax records, "you will not be considered to have kept the information for longer than necessary".
- **Claims are a reason, with an end.** You may keep what you need to defend a possible legal claim, and it "should be deleted when such a claim could no longer arise".
- **"Just in case" is not a reason.** The ICO says you should not keep data indefinitely on that footing.

So the order file has a legal reason and a date. These do not:

| Data | A period you could set and defend |
|---|---|
| Abandoned baskets and accounts that never ordered | Months, not years |
| Marketing list | Until the person unsubscribes; then keep only the address on a do-not-email list |
| Customer service chats that are not about an order | A year |

The periods in that table are ours, as a starting point. The do-not-email list is the ICO's own example: a business may keep enough about a former customer to stop marketing to them.

## When a customer asks you to delete their data

The ICO says a person has the right to have erased the data "you no longer need". An order record inside its tax period is one you still need, so you can keep it and say why. Delete the rest: the marketing entry, the saved basket, the account login. Reply with what was deleted, what was kept and when it will go.

## Do this once

1. Write the periods down in one short table. The ICO says a small organisation with occasional low-risk processing may not need a documented policy, but it must still review and delete.
2. Each February, delete the order files that passed their date on 31 January.
3. Before closing a shop or a marketplace account, export the orders, invoices and payout reports that are still inside their period.
4. Keep supplier invoices with the order files. A carrier asks for proof of cost price on a claim, as our [lost parcel claims guide](https://aeolookup.com/online-shops/lost-parcel-claims-royal-mail-evri-small-shop/) sets out, and a card dispute needs the delivery proof described in our [chargebacks guide](https://aeolookup.com/online-shops/chargebacks-small-online-shop-how-to-respond/).

This is general information, not legal or tax advice.

## Short answers from this page

**How long does an online shop have to keep its order records?** A sole trader keeps them for at least 5 years after the 31 January return deadline for the tax year, so an order delivered on 14 November 2026 is kept until at least 31 January 2033. A limited company keeps them for 6 years from the end of its financial year, and VAT records are kept for at least 6 years.

---
![](https://aeolookup.com/img/d/owner-line.png)

General information for UK small firms, not legal, tax or financial advice.