Customer details can end up in an inbox, WhatsApp thread, quoting app, spreadsheet and photo folder. The longer they remain in each place, the harder it becomes to know what you still need.

The ICO's storage-limitation principle says personal data should not be kept longer than necessary. It does not give every business one universal number of days. You need to consider why you hold each category of information, decide how long that purpose lasts and be able to explain the decision.

Separate the records by purpose

A customer who never accepted a quote is not the same record as a completed job with invoices, guarantees or an unresolved complaint. Write down the separate purposes rather than applying one broad “keep everything” rule.

For each record type, ask:

  • What decision or service still depends on this information?
  • Is there a contract, dispute, tax or other legal requirement?
  • Which fields are actually necessary?
  • Who can access it?
  • When will someone review whether it is still needed?

Some records may need to be kept under other legal or contractual obligations. Set those periods with an accountant or adviser; do not assume the data-protection principle overrides them.

Make a workable review routine

Choose a review cycle that matches the volume of work. A small sole trader might review old unaccepted enquiries quarterly, while a business with many leads may automate reminders. The important part is that the process is documented and followed.

When an enquiry is no longer needed, remove copies from the systems you control or anonymise details where you still need aggregated business information. Check backups, exports and shared folders too. If a customer asks for deletion, assess the request under current data-protection rules rather than promising automatic deletion of every record.

Keep the retention explanation consistent with your privacy notice and your actual workflow. Do not publish a period that staff or software do not follow.

Read the ICO's storage-limitation guidance and our guide to privacy information on trade quote forms. This is general information, not legal advice.