Charity record keeping.

What the legislation actually says

The core obligation is short. The Charities Act 2011 specifies that charities must keep accounting records, and it is a legal requirement rather than best practice: charities must keep proper accounting records for at least six years, and the Act says what they are for rather than what form they take. The records must be sufficient to show and explain all the transactions of the charity, to disclose its financial position with reasonable accuracy at any time, and to enable the trustees to ensure that any accounts they prepare comply with the regulations.

That test is more demanding than it looks. At any time means a charity should be able to say where it stands on a Tuesday in March, not only at the end of the financial year. Keeping accurate records through the year is what makes financial management possible rather than retrospective. And show and explain means the record has to carry the reason for a transaction, not merely its amount, which is why a bank statement alone has never been enough.

A charitable company keeps its accounting records under the Companies Act as well, and a charitable incorporated organisation under the CIO regulations. The requirements overlap rather than conflict, and the practical answer for a charitable company is to work to the charity rule, which is the longer of the two.

The duty sits with the charity trustees collectively. It can be delegated to a finance lead or to senior staff for day-to-day purposes, but it cannot be delegated away: trustees remain responsible for the records existing and for their being kept properly. That is true across the voluntary sector regardless of size, and small charities with no finance staff are the ones for whom it bites hardest.

Which records a charity must keep

Four families, and most charities are strong on the first and weakest on the last.

• Accounting records. Cash books, records of all money received and spent with the reason, invoices, receipts, vouchers, bank statements, records of assets and liabilities, and any stock records. Enough to reconstruct income and expenditure without relying on anyone's memory
• Governance records. The governing document and any amendments, trustee minutes and the papers behind them, the register of trustees, the register of interests, policies and their review history, and records of decisions taken between meetings
• People records. Employment files, payroll, pension, volunteer records including any checks, and training for staff and volunteers alike. Volunteers are frequently overlooked because they are not employees, though the charity holds personal data about them either way
• Fundraising and donor records. Donor details and consents, Gift Aid declarations, grant agreements and the reporting against them, and records of any fundraising carried out by third parties on the charity's behalf

The fourth family carries the most data protection risk and the least attention. Consent records in particular are only useful if you can show what someone was told at the point they gave it, which means keeping the wording as well as the answer. Underneath all four sit the charity's own policies and procedures, including the retention schedule itself, which is worth writing from a sector template rather than from scratch.

How long to keep charity records

The headline rule is that a charity must keep records for at least six years from the end of the financial year in which they were made. That is the statutory minimum for accounting records, and it is the number to build a retention schedule around, because most other charity records either match it or are governed by it in practice. Charity accounts for recent financial years therefore stay live far longer than most people assume, and the sixth year out is the one nobody can find.

The exceptions matter more than the rule.

1. Gift Aid declarations. HMRC expects these to be kept for six years after the end of the accounting period they relate to, and an enduring declaration covers donations until it is withdrawn, so the clock runs from the last donation rather than the signature
2. Governance records. The governing document, trustee minutes and the register of trustees are permanent records. A charity that cannot produce the minute authorising something is missing part of its own constitution, whatever the accounting position
3. Land, property and permanent endowment. Kept indefinitely, or for as long as the charity holds the asset plus a long tail afterwards
4. Employment records. Generally six years after the person leaves, with longer for pension and for anything relating to safeguarding
5. Records relating to a live dispute, investigation or serious incident report. Suspended from disposal entirely until the matter closes

Written as a schedule, that is a short document: the record type, the period (6 years for most of it), the trigger, and who is responsible. Charities with no records management policies at all should start there rather than with software.

Two points about disposal. Six years is a minimum for accounting records and a maximum for most personal data, so a schedule that says keep everything for six years is wrong in both directions, and the charity should dispose of what has passed its period rather than let it accumulate. And when a charity ceases to exist, the records do not cease with it: trustees must make arrangements for them, and the six year obligation survives the charity's dissolution.

The annual report, the accounts and external scrutiny

Every registered charity must produce a trustees' annual report and accounts, and file the reports and accounts with the Charity Commission where income requires it. The obligation to produce an annual report is not a formality: it is the document in which trustees explain what the charity did with its money and whether it delivered its charitable purposes, and it is the first thing a funder, a journalist or a regulator reads. The financial statements sit behind it, and the two are read together.

What goes into the annual report is set by the regulations and, for larger charities, by the Statement of Recommended Practice, which also governs how the financial reports are presented and what disclosure is required. At minimum the report covers the charity's objects and activities, achievements and performance, financial review including reserves, its structure and governance, and the trustees' statement of responsibilities. The SORP exists so that one charity's accounts can be compared with another's, which is why it prescribes the shape as well as the content.

The level of external scrutiny follows income and assets rather than choice:

• Under the reporting threshold, accounts must still be prepared and made available on request
• Above it, accounts and the annual report are filed with the Commission, generally within ten months of the end of the financial year
• Middle income charities require an independent examination, a lighter review by someone with the required ability and practical experience
• Larger charities require a full audit by a registered auditor, and the thresholds turn on gross income and on total assets, so an asset rich charity can require an audit at a lower income than expected

The thresholds move. Check the current figures with the Commission rather than working from a number remembered from a previous year, and if the charity is close to a boundary, decide early: an auditor cannot be appointed retrospectively for a year whose records were kept as though no audit were coming.

Data protection, donors and beneficiaries

UK GDPR and the Data Protection Act 2018 apply to a charity exactly as they apply to a business. The differences are practical rather than legal: charities hold unusually sensitive information about beneficiaries, rely heavily on volunteers who are not employees, and keep donor records for decades because relationships are long.

Three requirements are worth stating plainly. You need a lawful basis for each use of personal data, and for most charity fundraising that is either consent or legitimate interests, decided and documented in advance rather than after a complaint. Beneficiary data is frequently special category data, which needs an additional condition. And the storage limitation principle applies to donor lists: a supporter who has not responded in fifteen years is not a record you are entitled to keep because it might be useful.

Charities are also subject to subject access requests, and a request from a beneficiary or a former volunteer covers everything held about them, including correspondence and messages about them rather than only the file with their name on it.

Fundraising carries its own layer through the Fundraising Regulator's code, and where fundraising is carried out by a third party the charity remains accountable for what is done in its name and needs the records to show what it asked for.

The records that decide a serious incident

Everything above is a record a well-run charity knows it holds, and none of it is controversial. The gap is in the charity's decision-making, and it decides how a difficult moment goes.

A safeguarding concern about a volunteer is first raised in a message to the chair on a Sunday. A grant condition is renegotiated over a phone call, confirmed by text, and never reaches the file. Trustees settle a contentious decision in a group chat between meetings, and the minute records the outcome without the reasoning. A beneficiary complains to the staff member they trust, by message, months before anything formal happens.

Each of those is a record of the charity's decision making, and most charities cannot produce any of them. They sit on personal phones, on both sides, belonging to trustees and staff who may since have moved on. Trustee turnover makes this worse than it is elsewhere: the person who holds the only copy is often gone within three years.

This becomes concrete when the charity has to report a serious incident to the Commission, which asks what happened, when the charity became aware, and what it did. The answer to when did you know is almost always a message, and a charity that cannot produce it is relying on recollection at exactly the point where recollection is questioned.

It is worth asking, at your next trustee meeting, where the first report of a concern in your charity actually lands, and whether you could produce it tomorrow.

Where to read the official guidance

The Charity Commission's charity reporting and accounting guidance is the authoritative collection, and the essentials is the shortest useful summary of thresholds and deadlines. The Charities SORP governs accruals accounts. Charity Finance Group publishes practical records management guidance aimed at small charities, and the ICO covers the data protection side. In Scotland the regulator is OSCR and the accounting rules differ.

This page is a summary rather than advice on your charity's accounts. Thresholds change, and a charity near a boundary should take proper advice before the year end rather than after it.

Related guides

• Charity trustee responsibilities: the six duties
• Data retention policy: how long to keep what

All guides