Ask a publisher how long they keep subscriber records and the honest answer is often "forever, probably". Nobody wants to be the person who deleted something the auditor or the accountant later asked for. So everything stays.
That feels safe, but it isn't. Data protection law says you shouldn't keep personal data longer than you need it. Your auditor and HMRC each say how long you do need it. The job is to write those periods down, stick to them, and clear out what's left over.
Here's how the pieces fit together.
Data protection doesn't give you a number
The UK GDPR principle is storage limitation: personal data should be kept no longer than you need it for the purpose you collected it for. The ICO's storage limitation guidance is clear that the law sets no maximum periods. Instead, you have to be able to justify the period you've chosen.
In practice that means a retention policy with standard periods for each type of record, and a regular review where you erase or anonymise what you no longer need. The ICO also says you shouldn't keep data "just in case" it comes in useful later. A lapsed reader from 2014 who hasn't heard from you since is hard to justify.
The good news is that other rules supply most of the numbers for you. Where a law or an audit body requires you to keep something, that's your justification.
What your auditor needs
If you have an ABC certificate, the Business Magazines Reporting Standards set two things that matter here.
First, the evidence behind every controlled circulation copy must be less than five years old on the date you send the copy. That five-year limit dates from 2018 (it was three years before). So the request or qualification evidence for anyone still on your controlled file has to be kept, with its date and source.
Second, ABC says records must be kept until it has completed the audit for the next corresponding reporting period. Business magazine certificates have been annual, January to December, since 2025. So the records behind your January to December 2025 claim have to be kept until the January to December 2026 audit is finished. You also need to keep the recipient list for each Audit Issue, and be able to recreate the mailing list for any issue in the period.
Put those together and request evidence can need to live a long time. A form signed in early 2022 can support copies right up to early 2027, and then has to be kept until the audit of that later period is done.
If you're audited by AAM (formerly BPA), the clock is different: non-paid requests must be renewed at least every 36 months. Check AAM's own rules for how long it expects supporting records to be kept.
What finance needs
Subscription orders, invoices and payments are accounting records. GOV.UK says a limited company must keep company and accounting records for six years from the end of the last financial year they relate to, and longer in some cases, such as a transaction covering more than one accounting period. HMRC's VAT record keeping notice says VAT records should generally be kept for at least six years.
That doesn't mean you need the whole subscriber profile for six years. You need the transaction: who was billed, for what, when, and what they paid. Job function, marketing preferences and the rest of the profile can go on their own schedule.
The records you keep after someone leaves
Two kinds of record should outlive the subscription.
Suppressions. If a reader has objected to marketing, deleting them completely is a mistake. They'll come back in on the next bought list or event import, and you'll market to them again. The ICO's guidance on respecting people's preferences says suppressing is usually better than erasing. Keep just enough to recognise them, and mark it as an objection.
Evidence of notices. From 1 January 2027, auto-renewing consumer subscriptions come under new rules on reminders and cancelling. If a reader disputes a renewal, you'll want to show which notices went out and when. Our guide to the new subscription rules covers what has to be sent. Decide how long you'll keep that evidence and put it in the schedule.
A simple retention schedule
You don't need a fifty-page policy. A one-page table that your team actually follows beats a long one nobody reads. Something like this:
| Record | Why you keep it | Starting point |
|---|---|---|
| Orders, invoices, payments | Company and VAT records | Six years from end of the financial year, longer if HMRC's exceptions apply |
| Controlled circulation request and qualification evidence | ABC or AAM audit | While it supports copies, plus until the next period's audit is complete |
| Audit Issue recipient lists | ABC audit | Until the following period's audit is complete |
| Marketing suppressions | Honouring objections | As long as you market to anyone |
| Lapsed subscriber profiles | Win-back and service | A fixed period you can explain, then delete or anonymise |
| Renewal notices and cancellations | Showing what was sent | A fixed period you've chosen and written down |
The last two rows are your call, and that's fine. The ICO doesn't expect one right answer. It expects you to have thought about it, written it down and done what you said.
Delete or anonymise
When a record's time is up, you can delete it or anonymise it. Anonymising keeps your history useful: you can still report on renewal rates by year or on how a campaign did, without anyone being identifiable. It has to be done properly, though. A record with the name removed but the job title, company and postcode still there may not be anonymous at all.
Do the clear-out on a timetable, say once a quarter or once a year after the audit closes, rather than when someone remembers. And keep a note of what you removed and when. If the ICO or a reader ever asks, that note is your evidence that the policy is real.
Where we fit in
Most of this is policy rather than software, but a system that records dates and history makes it much easier. In Adeptis, our all-in-one platform for smaller publishers, consent is recorded by channel and media group, and circulation requests are captured on each contact. The Circulation Age report shows how old those requests are, so you can see which still fall within five years. And if you'd rather hand the audit side over, our bureau team does ABC and AAM audit preparation.
If you'd like to talk through your own records, get in touch.
Rob Sherwood is Managing Director of Adept Data Services. He has spent his career in subscriptions and circulation, at WDIS, Optima and CDS Global before founding Adept.