How Long to Keep Self Storage Customer Records (UK)

As at 18 October 2026 we found no source in the UK legislation and guidance we read that sets one period for keeping a self storage customer’s records. The UK GDPR asks that personal data be kept in an identifying form “for no longer than is necessary for the purposes for which the personal data are processed”. The ICO, the data protection regulator’s office, says the period is for the organisation to justify.

It is general information, not legal advice, and not tax advice. It covers the United Kingdom for data protection, tax records and company records, and England and Wales, Scotland and Northern Ireland separately for the time limits on claims. Each period for keeping a record named below comes with its record, the person it binds, its source and the date that source was read. The finding rests on the Acts, regulations and pages we read, not on trade-body guidance.

The regulator has been the Information Commission since 30 September 2026, but the ICO’s own pages still use the older names, so this guide calls the published pages the ICO’s guidance. On 18 October 2026, our count was that 17 of the 38 ICO pages we read (hub, plans and statistics pages included, search pages left out) carried the under-review banner “this guidance is under review and may be subject to change”.

How long must a self storage operator keep a customer’s records?

The sources read on 18 October 2026 leave the period for a customer’s file to the operator to justify, and the periods they do state belong to named records.

On 18 October 2026 we found no sentence that sets a number of days, months or years for keeping personal data in general, or a customer’s records as a whole, in the ICO’s storage limitation, data minimisation, privacy information, documentation and small-organisation storage pages, or in Articles 5, 13, 17, 25 and 30 of the UK GDPR.

That is a search of those pages and of the Articles as legislation.gov.uk prints them, not a statement that no such period exists elsewhere.

Four clocks sit under the question, and the sources keep them apart:

• A stated minimum belongs to a named record and the person it binds, such as VAT records or a company’s accounting records.
• A limitation period is the time allowed to bring a claim, which is a different question from how long to keep a record.
• A customer’s request starts a reply clock of one month, which can be extended.
• A personal data breach starts a notification clock of 72 hours, where feasible, unless the breach is unlikely to result in a risk to people’s rights and freedoms.

Customer records here means the personal data in an operator’s file on a customer. The ICO’s advice for small organisations (read 18 October 2026; under-review banner) says a controller is the organisation that decides why and how people’s personal information is handled. A software provider handling the records for the operator may be a processor, a word Article 33(2) of the UK GDPR uses.

A customer’s signed agreement is a licence to occupy, as the glossary entry on the storage licence agreement explains. On 18 October 2026 we found no sentence in the Acts and GOV.UK pages we read for tax and company records that says how long to keep a customer’s signed agreement as such.

In the ICO’s own site search on 18 October 2026 we found no result for the quoted phrases “self storage” and “storage unit”, and the first 25 results of each of three unquoted searches were loose word matches. That is one day’s search of the ICO’s site search, not of every ICO page, and no quoted-phrase search that returned a result list was captured as a control.

The rules for messages, including consent, are in the guide to customer messages and PECR, which covers the Privacy and Electronic Communications (EC Directive) Regulations 2003. The ICO’s data protection fee is in the licences and registrations guide. This page repeats neither.

What does UK GDPR say about keeping personal data?

The UK GDPR sets a principle and no period: Article 5(1)(e) asks that personal data be kept in an identifying form for no longer than is necessary for its purposes, and as read on 18 October 2026 the Article names no number of days, months or years.

Four other places in the Regulation touch on how long data is held, each read as legislation.gov.uk printed it on 18 October 2026:

• Article 5(1)(c) asks for personal data that is “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”, and Article 5(2) makes the controller responsible for being able to show that the principles are met.
• Article 25(2), on data protection by default, applies to “the period of their storage” as well as to the amount of data collected.
• Article 13(2)(a) puts “the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period” in the privacy information given at collection, and Article 15(1)(d) gives a person making an access request the same, “where possible”.
• Article 30(1)(f) puts “the envisaged time limits for erasure of the different categories of data” in the record of processing, “where possible”. Article 30(5) lifts the duty to keep that record for an organisation of fewer than 250 persons unless its processing is likely to risk people’s rights and freedoms, is not occasional, or includes special category or criminal offence data.

The ICO’s storage limitation guidance (read 18 October 2026; under-review banner) says “You must not keep personal data for longer than you need it”. It also says the UK GDPR “does not dictate how long you should keep personal data” and “It is up to you to justify this”.

The same page says an organisation needs “a policy setting standard retention periods wherever possible”, and that a small organisation doing occasional low-risk processing “may not need a documented retention policy” but “must still regularly review the data you hold”.

Under “How should we set retention periods?” the page lists five things to consider, each opening “You should consider”: the stated purposes, a record of the relationship once it ends, possible future legal claims, legal or regulatory requirements, and industry guidelines. As read on 18 October 2026 none gives a number of years; the only one the page states is another industry’s example, for credit reference agencies. The figure below sets out the ICO’s questions in order.

The ICO’s data minimisation page (read 18 October 2026; under-review banner) asks an organisation to “periodically review” what it holds. Its advice for small organisations (read 18 October 2026; under-review banner) says “There aren’t any set time limits in data protection law because it depends on your situation”. It adds “Where possible, you’ll also need a policy which sets out how long you keep data for and why”.

That advice says a closing business “continues to be the controller” of its customers’ personal data and advises a plan for the data held, including “how long you need to keep the data”. It adds, for an organisation that loses a contract or whose work goes to a different service provider, that data may need to pass to another company “for them to assume controller responsibilities”, and that people should be told as soon as possible.

The same advice says information sometimes “needs to be retained for legal reasons or in accordance with industry guidelines”, which “could be the case even if a business is no longer trading”.

The ICO’s right of access guidance (updated 8 December 2025; no banner) says “You should have defined retention periods for how long you keep archived or backed-up information”. Its page on preparing for requests (updated 8 December 2025; no banner) says “You should have documented retention and deletion policies for the personal information you use”.

On 18 October 2026 we found no sentence in the ICO’s storage limitation and small-organisation storage pages, or in GOV.UK’s VAT records guidance, that names a retention period for the records held in a previous system after a switch. The guide to switching self storage software covers the steps of a move, and the retention period it mentions is the operator’s own to set and, on the ICO’s approach above, to justify.

Which records carry a minimum period in tax or company law?

Tax and company law state periods for named records and the people they bind, and on 18 October 2026 we found none that covers a whole customer file. Every provision in this section applies in all four nations of the United Kingdom. The periods are not added together, and none is offered as a recommended period.

Paragraph 6 of Schedule 11 to the Value Added Tax Act 1994 (read 18 October 2026) makes every taxable person keep the records HMRC requires by regulations. It lets HMRC require them to be preserved “for such period not exceeding 6 years” as it specifies in writing.

GOV.UK’s page on keeping VAT records (read 18 October 2026; no date shown) says VAT-registered businesses “must keep VAT records for at least 6 years”, with a longer period for those using the VAT One Stop Shop scheme, a condition and not a general period. VAT Notice 700/21 (last updated 18 March 2024) says “Generally, you must keep all your business records for VAT purposes for at least 6 years”.

The Act’s “not exceeding” is a ceiling on what HMRC may require in writing and the guidance’s “at least” is a floor, which is our reading, an inference from the two wordings. On 18 October 2026 the sources we read did not reconcile them, so this guide quotes each and writes no unqualified “six years”.

The same GOV.UK page lists “copies of all invoices you issue” among the VAT records, and the Notice says a business “must still retain your VAT records for the required period” after deregistering. GOV.UK says a separate account for a bad debt written off is kept “for 4 years after the claim is made”.

Section 12B of the Taxes Management Act 1970 (read 18 October 2026) sets the day to which tax return records are preserved. For “a person carrying on a trade, profession or business alone or in partnership or a company”, it is “the fifth anniversary of the 31st January next following the year of assessment or (as the case may be) the sixth anniversary of the end of the period”, or a later day linked to an enquiry.

The Act also lets HMRC specify an earlier day in writing.

Paragraph 21 of Schedule 18 to the Finance Act 1998 gives a company “the sixth anniversary of the end of the period for which the company may be required to deliver a company tax return”, or an earlier day HMRC specifies in writing.

GOV.UK’s self-employed records page (read 18 October 2026; its metadata, not its visible text, shows an update in 2015) says “You must keep your records for at least 5 years after the 31 January submission deadline of the relevant tax year”.

Both Acts let HMRC provide by regulations that the records include “supporting documents”, which each Act says “includes accounts, books, deeds, contracts, vouchers and receipts”. The regulations that would specify them were not read, so the sources read on 18 October 2026 do not say that a customer’s signed agreement must itself be kept as a tax record.

Section 386 of the Companies Act 2006 (read 18 October 2026) requires every company to “keep adequate accounting records”. Section 388(4) says they “must be preserved” “in the case of a private company, for three years from the date on which they are made” and “in the case of a public company, for six years from the date on which they are made”, subject to insolvency rules.

GOV.UK’s limited company page (read 18 October 2026; no date shown) gives “6 years from the end of the last company financial year they relate to”, or longer in four listed cases. It lists “invoices, contracts, sales books and till rolls” among examples of records of money received. On 18 October 2026 we found no sentence on that page saying whether a customer’s signed agreement is among the contracts.

Regulation 8 of the Money Laundering Regulations 2017 (read 18 October 2026) applies Parts 1 to 6, 7A and 8 to 11, which cover record-keeping, to “relevant persons”. Regulation 40 says a relevant person “must keep the records specified in paragraph (2) for at least” five years from the end of the business relationship or the completion of the transaction, and then delete the personal data obtained for the purposes of the Regulations, with listed exceptions.

On 18 October 2026 we found no mention of storage, self storage, warehousing or safe deposit in GOV.UK’s page on who must register for money laundering supervision or in regulation 8 of the Money Laundering Regulations 2017. Neither source, read on 18 October 2026, says whether a storage operator is a relevant person.

The figure below also shows one period stated for a bank and not an operator, the paying bank’s 24 months for a Direct Debit Instruction, which the next section explains.

Is there a retention period for ID checks, consents, mandates and footage?

Mostly not: apart from the money laundering records above and the paying bank’s 24 months below, the sources read on 18 October 2026 give no period for a copy of an ID document, a consent record, a Direct Debit Instruction (the mandate) or camera footage, and each has only the pointers below.

On 18 October 2026 we found no ICO page that sets a number of days, months or years for keeping a copy of a person’s identity document. The nearest text is in the ICO’s page on responding to an access request (updated 8 December 2025; no banner), which concerns checking the identity of a person who makes a request, not identity checks at move-in.

It says it is not necessary to keep copies of ID documents for that purpose and that an organisation “could keep a note of” which documents were provided, when they were verified and by whom. The ICO’s erasure page (read 18 October 2026; under-review banner) says an organisation may ask only for information “necessary to confirm who they are”.

On 18 October 2026 we found no number of days, months or years for keeping the evidence of a person’s consent, or a suppression record, in the ICO’s consent page or its right to object page. The consent page (read 18 October 2026; under-review banner) says “You should keep this evidence for as long as you are still processing based on the consent”.

Under “You must keep good records that demonstrate the following”, the consent page lists who consented, when, what they were told, how, and whether consent has been withdrawn. Its one period, “we recommend you consider refreshing consent every two years”, is a suggested review interval and not a retention period.

For a customer who objects to direct marketing, the ICO’s right to object page (read 18 October 2026; under-review banner) says “in most cases it will be preferable to suppress their details”. Suppression involves “retaining just enough information about them to ensure that their preference not to receive direct marketing is respected in future”. The PECR guide linked above covers the consent rules for messages.

Bacs’s public FAQs (no date shown on the page; read 18 October 2026) call how long to keep a signed Direct Debit Instruction “a business decision for your organisation”, and warn that an organisation unable to produce an Instruction when a bank asks “may be requested to refund money under the terms of the indemnity”. They say a copy is to be provided “within seven working days from the date of the request”.

For an Instruction set up through the electronic service, the FAQs say the operator, not the paying bank, retains the signed Instruction. They say the paying bank holds details of Instructions on file “for a minimum of 24 months from receipt or last payment”, a statement about the bank, not the operator. Bacs’s page on maintaining payment records is about keeping records accurate and up to date, and on 18 October 2026 it named no retention period.

On 18 October 2026 we found no number of days, months or years for an operator to keep a signed Direct Debit Instruction in Bacs’s public FAQs and payment records page; the scheme rules are behind a log-in. The scheme rules and Bacs’s indemnity-claims pages were not read, so what they say about keeping Instructions is not known. The guide to taking payments for self storage covers the Direct Debit indemnity and the mandate rules.

For camera footage, the ICO’s video surveillance guidance (read 18 October 2026; under-review banner) says the UK GDPR and the Data Protection Act 2018 “do not prescribe any specific minimum or maximum retention periods which apply to surveillance systems”. The sibling guide on security and CCTV covers the detail.

How long can a claim be brought, and is that a record rule?

A limitation period is how long a claim can be brought, and the Scottish Act speaks instead of an obligation being extinguished; either is a different question from how long to keep a record.

On 18 October 2026 we found no mention of a storage agreement, a licence to occupy, or of keeping a record, in the sections of the Limitation Act 1980, the Limitation (Northern Ireland) Order 1989 and the Prescription and Limitation (Scotland) Act 1973 that we read; none says a document must be kept.

The ICO links claims and records by asking an organisation to consider keeping information “to defend possible future legal claims” and to delete it when such a claim “could no longer arise” (storage limitation guidance, read 18 October 2026; under-review banner). Its employer example says that, without a clear business reason, an employer “should not keep recruitment records for unsuccessful applicants beyond the statutory period in which a claim arising from the recruitment process may be brought”.

On our reading, an inference, a six-year period marks when a contract or tort claim could no longer arise.

On 18 October 2026 the ICO’s page named no Act or number of years for that test, and later starting dates can lengthen the time. The six-year period applies in England and Wales and in Northern Ireland; in Scotland the Act speaks of five years of prescription, below.

England and Wales

The Limitation Act 1980 (read 18 October 2026) applies in England and Wales: every section we read extends to both, so Wales is on the same Act as England. It gives six years from when the cause of action accrued for simple contract (section 5) and tort (section 2), twelve years for a specialty (section 8) and three years for personal injury (section 11). Section 8 does not define “specialty” in the Act as read on 18 October 2026.

As read on 18 October 2026, section 5 does not say when a cause of action accrues on a storage agreement. Disability (section 28), acknowledgment or part payment of a debt (section 29) and deliberate concealment or mistake (section 32) can move the start.

Section 3 covers goods wrongly kept or sold: six years from the first conversion, after which, if the owner has not recovered possession, “the title of that person to the chattel shall be extinguished”.

Northern Ireland

The 1989 Order (read 18 October 2026) gives six years for simple contract (Article 4) and tort (Article 6) and three years for personal injury (Article 7). Article 15 gives twelve years for an action upon a deed or an instrument under seal, not six. Articles 11 and 12 give late-discovered negligence damage six years or three from knowledge, with a fifteen-year bar, and Article 17 sets the conversion rule and the end of title.

Scotland

The 1973 Act (read 18 October 2026) speaks of prescription. Under section 6, an obligation that has subsisted for “a continuous period of five years” without a relevant claim or relevant acknowledgment “shall be extinguished”, and section 7 sets a long-stop, an overriding time limit, of 20 years after an obligation became enforceable, with listed exceptions.

Schedule 1 lists the obligations, among them one arising from a breach of “a contract or promise”, one “to pay damages” and, in paragraph 1(a)(vi), “a periodical payment in respect of the occupancy or use of land”. As read on 18 October 2026 it does not name a storage agreement or a licence to occupy, and the Act does not say whether a storage account falls under the continuing-account rule in Schedule 2.

A relevant claim is made “in appropriate proceedings” or by another step section 9 lists, and an obligation is relevantly acknowledged only by performance that clearly shows it still subsists or by “an unequivocal written admission” (section 10).

Section 6(4) leaves out periods when the debtor’s fraud, or error induced by the debtor’s words or conduct, made the creditor fail to make a relevant claim, and periods of the original creditor’s legal disability. For damages, section 11 counts from the date of the loss or, where the creditor could not with reasonable diligence have been aware of the loss, its cause and who caused it, from the date the creditor first became or could have become aware.

Scottish personal injury is different in kind: section 17, subject to subsection (3) and section 19A, says “no action to which this section applies shall be brought unless it is commenced within a period of 3 years”, a bar on the action and not an extinction of the obligation.

Selling uncollected goods

The Torts (Interference with Goods) Act 1977 (read 18 October 2026) lets a bailee, the person holding another’s goods, sell them after a written notice “sent by post in a registered letter, or by the recorded delivery service”. Where an amount was due before the notice, the period before sale “shall be not less than three months”, and the bailee is liable to account for the proceeds.

On 18 October 2026 we found no period for keeping a record, a notice or proof of posting in section 1, section 12 or Schedule 1 of the Torts (Interference with Goods) Act 1977. The sale provisions extend to England and Wales and to Northern Ireland, not to Scotland.

The guide to late fees sets out the time limits and the steps before suing, the guide to abandoned units and the Torts Act covers the notice procedure, and the sibling guide to county court recovery covers the court route.

What changed with the Data (Use and Access) Act 2025?

Several changes took effect on different dates, so the date a request or complaint was received decides which rule applies, and the table below gives each change with its date.

Section 76 of the Act inserted Article 12A into the UK GDPR and replaced “within one month of receipt of the request” with “before the end of the applicable time period”, in force from 5 February 2026. Article 12A applies to requests received from that date, and regulation 4 of S.I. 2026/82 says the amendments “do not apply in relation to” a request received earlier, which stays under the earlier wording.

The duty to acknowledge a complaint within 30 days applies only to “a complaint that is received by the controller on or after the 19th June 2026”. Section 78 treats the reasonable and proportionate search for an access request as in force from 1 January 2024, and Article 4A, on how periods are counted, has applied since 20 August 2025.

The Information Commission has been the regulator since 30 September 2026 (S.I. 2026/1015), and legislation.gov.uk’s text of Article 33 already refers to the Commission. On 18 October 2026 the two commencement regulations, held as made, did not state their own extent, so this guide gives none for them.

The ICO’s guidance has not caught up. On 18 October 2026 its plans page for general data protection (no banner) listed, each marked “Stage: Drafting”, an update to the personal data breaches guidance, the right to object and access guidance for small organisations, all for Autumn 2026. It also listed exemptions guidance for Winter 2026 and the right to be informed guidance for Spring 2027.

On 18 October 2026 we found no entry for storage limitation, erasure, data minimisation, documentation, retention or consent in the ICO’s two plans pages, although the storage limitation, erasure, documentation and consent pages carry the banner. Every ICO sentence in this guide is dated, and the ICO’s own page shows what it says now.

What can a customer ask for, and how long does an operator have to reply?

For a request received from 5 February 2026, Article 12A gives “the period of one month beginning with the relevant time”, and the relevant time is the latest of the request arriving, the identity information asked for arriving and any fee being paid.

The period can be extended by “two further months” if the request is complex or there are a number of requests, but only if the customer is told, with reasons, before the first month ends. For an access request, the days between asking for clarification the operator reasonably requires and receiving it “does not count”. Articles 4A and 12A apply in all four nations of the United Kingdom.

The rights sit in separate Articles of the UK GDPR: access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), notice to recipients (Article 19), portability (Article 20) and objection (Article 21). The ICO’s page on recognising a request (amended 7 April 2026; no banner) says “There are no formal requirements for a valid request”.

Article 12(6) lets an operator with reasonable doubts about identity “delay dealing with the request until the identity is confirmed”, and Article 15(1A) limits an access request to what can be provided “based on a reasonable and proportionate search”.

Article 17(3) says erasure does not apply “to the extent that processing is necessary” for “compliance with a legal obligation which requires processing” under domestic law or “for the establishment, exercise or defence of legal claims”. On 18 October 2026 the sources we read gave no example of either exception for a storage operator.

The ICO’s page on responding to a request (updated 8 December 2025; no banner) says to count “forward to the end of the same date in the following month”, and that a deadline on a weekend or public holiday moves to the next working day. Its list of triggers adds information confirming a third party’s authority, which Article 12A(2)(b), as read on 18 October 2026, does not name.

Our calculation: a request received on Thursday 3 September 2026 ends its month on Saturday 3 October, so the end moves to Monday 5 October 2026. With the two-month extension, a request received on Friday 7 August 2026 ends on Saturday 7 November, so on Monday 9 November 2026. The ICO prints the Saturday dates in these examples without a year, and no bank-holiday list was captured, so these dates roll only weekends.

A month lasts 28 to 31 days before any weekend or holiday roll (our calculation over start dates from 1 January 2026 to 31 December 2030), and the ICO’s page on responding to a request (updated 8 December 2025) suggests a 28-day period for operational use.

The ICO’s page on finding and retrieving information (updated 8 December 2025; no banner) says it is “not acceptable to amend or delete the information if you would not otherwise have done so” after a request arrives. Section 173 of the Data Protection Act 2018 makes it an offence to alter or erase information “with the intention of preventing disclosure”, with a defence if the step “would have occurred in the absence of a request”.

On information already deleted, the same page (updated 8 December 2025; no banner) says the ICO does not require “time and effort reconstituting information that you have deleted as part of your general records management”. The ICO adds that expensive technical expertise able to recreate electronically deleted information does not mean an organisation has to go to such efforts to answer an access request.

On a valid erasure request with no exemption, the ICO’s erasure page (read 18 October 2026; under-review banner) says erasure has to reach back-up systems too, though data may stay there until overwritten if put “beyond use”, meaning not used for any other purpose.

The ICO’s right to object page (read 18 October 2026; under-review banner) calls objection to direct marketing “an absolute right”. On 18 October 2026 we found no use of the word “absolute” in Article 21 as legislation.gov.uk prints it. Article 21(3) says that after an objection to direct marketing “the personal data shall no longer be processed for such purposes”.

The ICO’s storage limitation and erasure pages (read 18 October 2026; under-review banner) word the right to erasure differently: one speaks of “the absolute right to erasure”, the other says “The right is not absolute and only applies in certain circumstances”.

A customer can also complain to the operator. For complaints received from 19 June 2026, section 164A of the 2018 Act requires the controller to “acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received”, and the ICO’s complaints guidance (updated 8 May 2026; no banner) gives the same 30 days. A customer can instead complain to the Commission under section 165.

The guide to automated self storage covers the one-month clock for camera footage.

What must happen after a personal data breach?

Article 33(1) of the UK GDPR requires the controller to notify a personal data breach to the Commission “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach “is unlikely to result in a risk to the rights and freedoms of natural persons”. A notification not made within 72 hours “shall be accompanied by reasons for the delay”.

Article 33(4) allows the information to be given “in phases without undue further delay”. The ICO words the 72 hours more than one way. Its personal data breaches guide (updated 20 August 2025; no banner) says “not later than 72 hours after becoming aware of it”, and its reporting page (updated 28 May 2025; under-review banner) says both “where feasible within 72 hours” and “you’re legally required to meet this timeframe”, so this guide quotes the Article.

The ICO’s page for small organisations on responding to a breach (read 18 October 2026; under-review banner) says “The clock starts from when you discovered the breach, not when it actually happened”.

Our reading, an inference from Article 4A and Article 3 of Regulation 1182/71: 72 hours is a period in hours, Article 3 says periods “include public holidays, Sundays and Saturdays”, and its move to the next working day applies to a period expressed “otherwise than in hours”. So a weekend inside the 72 hours counts towards them and does not extend them. The ICO pages we read gave no hour-level example on 18 October 2026.

If a breach “is likely to result in a high risk to the rights and freedoms of natural persons”, Article 34(1) requires the controller to tell the person “without undue delay”, and Article 34(3) lifts that duty in three cases, including where the data was protected, for example by encryption.

Article 33(2) requires a processor, such as a software provider acting for the operator, to “notify the controller without undue delay after becoming aware of a personal data breach”. The ICO’s breaches guide (updated 20 August 2025; no banner) says the requirements “should be detailed in the contract between you and your processor”.

Article 33(5) requires the controller to “document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken”. The ICO’s breaches guide (updated 20 August 2025; no banner) says to keep a record of any breaches “regardless of whether you are required to notify”, and its small-organisation page (read 18 October 2026; under-review banner) says to “start a log anyway”.

On 18 October 2026 we found no period for keeping the record of personal data breaches in Article 33 of the UK GDPR or in the ICO’s breach pages.

Article 83 of the UK GDPR sets two fine ceilings, which are ceilings and not typical fines. For infringements of Articles 25 to 39, which include Articles 30, 33 and 34, the ceiling is £8.7 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher; section 157 of the 2018 Act sets the same standard maximum for an infringement of section 164A.

For Articles 5 and 12 to 21 the ceiling is £17.5 million or, for an undertaking, 4%, whichever is higher. The ICO’s fining guidance (read 18 October 2026; no banner) gives the same figures. The ICO’s penalties page and registration FAQs were not read; the licences and registrations guide records that they gave different maximum fines on 16 October 2026.

Those two pages concern the penalty for not paying the data protection fee, which is separate from the Article 83 ceilings above.

What this guide does not cover

This guide does not cover these topics, which sit in other guides or outside the sources read:

• The ICO’s data protection fee, the consent rules for messages, camera footage, the court route for unpaid fees and the steps to switch software, each covered by the guides linked above.
• Drafting a licence agreement and liens, and the Scottish rules on conversion of goods and on deeds.
• Fire-safety, health-and-safety, employment and consumer-contract records, copies of the messages sent to customers, payment providers’ own terms, lawful bases and privacy-notice wording.
• Schedule 2, Part 1 to the Data Protection Act 2018, which on our reading, an inference from paragraphs 2 and 5(3), speaks of when some rights and notices do not apply and not of how long to keep a record.
• The separate breach-reporting duty under PECR, which the ICO’s breaches guide (updated 20 August 2025) says the 2025 Act changed from 24 hours to 72 hours after becoming aware; whom it binds was not read.
• ICO guidance nation by nation, the ICO’s incident statistics and enforcement, and Wales-specific rules beyond the extent of the Limitation Act 1980.
• Retention guidance from self storage trade associations, none of which was among the sources read on 18 October 2026.
• The regulations made under paragraph 6(1) of Schedule 11 to the Value Added Tax Act 1994, which were not among the sources read on 18 October 2026.

Questions to put to the ICO and an adviser

• The ICO or a data protection adviser: which retention periods can this operator justify for each kind of customer record, and where are they written down?
• The ICO or a data protection adviser: does a given record fall within an erasure exception, such as a legal obligation or the establishment, exercise or defence of legal claims?
• The ICO or a data protection adviser: who is the controller and who the processor for the records in a software system, and what does the contract say about telling the operator of a breach?
• An accountant: which of the operator’s records carry the tax and company minimums, for how long, and which supporting documents does HMRC specify?
• A solicitor: what is the limitation position for a particular claim in the nation where the unit is, and does any claim make it sensible to keep a particular file?
• HMRC or a money laundering adviser: is a storage operator a relevant person under the money laundering rules?
• The operator’s bank or payment provider: how long does it expect signed Direct Debit Instructions to be kept?
• A self storage trade association: does it publish retention guidance for operators, and what does it say?

Sources

All read on 18 October 2026. Legislation is legislation.gov.uk’s “Latest available (Revised)” text unless marked as made, and a page without a visible date is marked as showing no date.

• UK GDPR, Articles 4A, 5, 12, 12A, 13, 15, 16, 17, 18, 19, 20, 21, 25, 30, 33, 34 and 83; and Article 3 of Regulation 1182/71, read through Article 4A.
• Data Protection Act 2018, sections 157, 164A, 165 and 173, and Schedule 2, Part 1.
• Data (Use and Access) Act 2025, sections 76, 78, 103 and 104, while the notes to section 104 and to Article 4A name S.I. 2025/904; the commencement regulations S.I. 2026/82 and S.I. 2026/1015, both as made.
• Tax and company records: Value Added Tax Act 1994, Schedule 11, paragraph 6; Taxes Management Act 1970, section 12B; Finance Act 1998, Schedule 18, paragraph 21; Companies Act 2006, sections 386 and 388; Money Laundering Regulations 2017, regulations 8 and 40.
• Limitation Act 1980, sections 2, 3, 5, 8, 11, 14A, 14B, 28, 29, 30 and 32.
• Limitation (Northern Ireland) Order 1989, Articles 4, 6, 7, 11, 12, 15, 17, 57 and 71.
• Prescription and Limitation (Scotland) Act 1973, sections 6, 7, 9, 10, 11 and 17, and Schedule 1 and Schedule 2.
• Torts (Interference with Goods) Act 1977, section 1, section 12, section 16 and Schedule 1.
• GOV.UK: Keeping VAT records (no date shown); VAT Notice 700/21, last updated 18 March 2024; self-employed records (no date shown); limited company records (no date shown); who needs to register for money laundering supervision, last updated 23 August 2023.
• Bacs: the FAQs and the maintaining payment records page (no date shown on either), and the guide and rules page, whose rules sit behind a log-in and were not read.
• ICO, principles: storage limitation and data minimisation, both with the under-review banner and no date shown.
• ICO, accountability and information: who needs to document their processing, what to document under Article 30 and the right to be informed, all with the banner and no date shown.
• ICO, rights and consent: consent, erasure and objection, all with the banner and no date shown.
• ICO, right of access, updated 8 December 2025 and without the banner: preparing, responding and finding information; recognising a request, amended 7 April 2026.
• ICO, advice for small organisations, all with the banner and no date shown: data storage, subject access requests and 72 hours.
• ICO, breaches and complaints: the personal data breaches guide, updated 20 August 2025; the reporting page, updated 28 May 2025, with the banner; the complaints guidance, updated 8 May 2026.
• ICO, other: the video surveillance page (banner, no date shown); the fining guidance on the maximum fine and the plans page for general data protection (neither with the banner, no date shown).