How Long to Keep Business Records After Closing (US, UK, Canada)

35 min readAIData.Broker research31 Oct 202671 records, 60 sources

AIData.Broker is a sell-side broker: it values a company's data free and describes it to every buyer that fits at the same time, without the company's name, for a fee only out of a sale.

  • No data upload
  • About two minutes
  • No email needed

Keep the tax, accounting and payroll records for as long as the tax authority can still reopen the company's returns, name the person who holds them, and let most of the rest go once its purpose is over. In the United States the IRS ties keeping to the window in which a return can be reopened, ordinarily 3 years after the return was filed, with payroll tax records kept at least 4 years after the tax is due or paid, and a dissolving corporation can ask the IRS to assess within 18 months instead. In the United Kingdom, HMRC asks a company to keep its records for 6 years from the end of the last financial year they relate to, and the government tells directors who strike a company off to keep its business documents for 7 years after the company is struck off. In Canada the CRA's rule is six years from the end of the last tax year, which becomes two years after the date of its dissolution once a corporation is dissolved, and records may go earlier only with the CRA's written permission.

None of those rules names the company's chat, most of its email, its tickets or its code. For those the law that binds runs the other way: personal data in them may be kept in identifiable form for no longer than is necessary for the purposes it was collected for, and is then destroyed, erased, or made anonymous. Those same records are what AI buyers pay closing companies for, and the software vendors that hold them start deleting once the subscriptions stop. So the order matters: sort out what must be kept, decide what the rest is worth, and act before the vendors' clocks decide for you.

This guide is for the founder, director or officeholder (a liquidator, trustee, receiver or administrator) of a company in the United States, the United Kingdom or Canada that is closing or has closed, and that still holds its accounts, payroll, contracts, email, chat, code, tickets and customer records. It sets out the periods that bind, by country and by kind of record, who must keep the records once the company is gone, which records no law requires anyone to keep, how privacy law limits keeping personal data, and what the records that may be deleted are worth before they are. Every period links to the statute, regulation or tax authority page that sets it, quoted word for word on its record page.

A word on who is writing. AIData.Broker acts as the holder's agent in sales of company records to AI buyers: the holder itself licenses or sells its data to the buyer, and we do not take ownership of it. That gives us an interest in the second half of this guide, which is why the first half rests only on the law and on the tax authorities' own pages.

This guide is research from public sources, not legal or tax advice. The other rules on what a company may do with its data, from customer contracts to privacy law, are gathered under rights.

Contents

  1. The short answer, in one table
  2. United States
  3. United Kingdom
  4. Canada
  5. Who keeps the records once the company is gone
  6. What no law requires you to keep
  7. Personal data has its own clock
  8. What the records are worth before they are deleted
  9. Keeping the original, licensing a de-identified copy
  10. A worked example: a 40-person US software company
  11. Questions people ask
  12. What this means for you

The short answer, in one table

The table gives the periods that bind a company after it stops trading, by country and by kind of record. Each cell links to the text that sets the period. Read each row for the longest period that applies to you, because the rules run side by side: a payroll record is a tax record, an employment record and often a record of personal data at the same time, and it can go only when every rule that covers it has run out.

Two things are worth knowing before the detail. First, most clocks start at the end of a tax year, at the filing of a return or at the last entry in a record, not on the day the company closes, so the records of the final year are the ones kept longest. Second, closing changes the rule in each country in a different way: in the United States a dissolving corporation can shorten the IRS's window, in the United Kingdom the government's guidance counts the directors' period from the strike-off, and in Canada dissolution replaces the six-year rule with a fixed period after the date of dissolution. The rows below are federal or national rules; US states, Canadian provinces and regulated industries add their own.

Kind of recordUnited States (federal)United KingdomCanada (federal)
Tax and accounting records3 years after the return was filed in the ordinary case; 6 years for a large omission, 7 for a bad debt claim, with no end if no return or a fraudulent one was filed; 18 months from a dissolving corporation's request6 years from the end of the last financial year, longer after a late return or during a compliance check; company law's own floor is three years for a private company; VAT at least 6 yearssix years from the end of the last taxation year; once dissolved, two years after the day the corporation is dissolved
Payroll and employment taxat least four years after the due date or payment; payroll records at least 3 years; time cards at least 2 yearsPAYE records 3 years from the end of the tax year; minimum wage records six yearsThe same six-year rule under the Employment Insurance Act and the Canada Pension Plan; two years after dissolution
Personnel filesHiring, pay and dismissal records one year; Form I-9 three years after hire or one year after the job ends, whichever is later; benefit plan records six years after filingWhat references or pension arrangements need, the rest deletedOther federal and provincial laws set their own, which the CRA's permission does not cover
Minutes, share register, general ledgerNo federal period of its own; property and share records until the limitations period closes for the year they are disposed ofKept with the company's other records, shareholder votes and resolutions included; 7 years after a strike-offIndefinitely while the business runs; two years after dissolution
ContractsNo retention rule; in Delaware a claim on a promise within 3 years, or up to 20 if a contract of at least $100,000 says soA claim on a simple contract within six years, on a deed within twelve yearsIn Ontario two years from discovery, never after the 15th anniversary; other provinces set their own
Personal data in email, chat, tickets and CRMWhere the CCPA applies, no longer than reasonably necessary for the disclosed purpose; Illinois biometric data destroyed when its purpose is met or within 3 yearsNo longer than is necessary for the purposes, then erased or anonymisedOnly as long as necessary, then destroyed, erased, or made anonymous; in Quebec destroyed or anonymized
Chat, code, tickets and product data with no tax, pay or legal roleNone of the rules above names themNone of the rules above names themNone of the rules above names them

United States

Tax and accounting records

The duty to keep tax records comes from the Internal Revenue Code: every person liable for tax shall keep such records as the Secretary prescribes. The income tax regulations then set no fixed number of years. Records must be kept available for inspection and retained so long as the contents thereof may become material in the administration of the tax law. In practice that means the window in which the IRS can still assess more tax, and the IRS's own page says so: keep the records that support an item on a return until the period of limitations for that tax return runs out, which in the ordinary case is 3 years after the return was filed.

Three situations stretch that window, and a closing company should check each before it shreds anything. A return that claimed a loss on worthless securities or a bad debt (common in a final year, when receivables are written off) needs its records for 7 years. If income left off a return is in excess of 25 percent of the gross income stated in the return, the IRS has 6 years. And where no return was filed, or a fraudulent one was, the tax can be assessed at any time, so the records never become safe to destroy. Records of property (equipment, software the company bought, shares it held) run on their own clock: until the period of limitations expires for the year in which you dispose of the property. For a closing company that is usually the final year, when its assets are sold, distributed or written off, so property records follow the final return.

A dissolving corporation has one lever no operating company has. The Code lets it file a written request for prompt assessment, after which the IRS must assess within 18 months after written request, and in no case later than its ordinary window. The request works for a corporation that tells the IRS it contemplates dissolution within that period and then completes it, and for one that has already dissolved. It shortens nothing where the return was fraudulent or left out a large amount of income, but for a clean company it brings the end of the federal tax window forward and with it the day most tax records can go.

Federal rules are not the whole answer. The IRS's own closing checklist says check your state responsibilities when closing a business, and states have taxes and windows of their own. The IRS also warns that its periods are a floor for other purposes: your insurance company or creditors may require you to keep them longer than tax law does.

Payroll and employment records

Employment tax records are kept at least 4 years after the date that the tax becomes due or is paid, whichever is later, a rule that comes from the employment tax regulations. Because the last payroll tax falls due after the last pay run, the four years start after the company has stopped paying anyone. When the company files its final payroll return, the IRS asks it to attach a statement showing the name of the person keeping the payroll records and the address where those records will be kept: the federal government's own way of making someone the custodian.

Employment law adds periods that run alongside. The wage and hour rules keep payroll records at least 3 years from the last entry, and time cards and wage rate tables at least 2 years. The equal employment rules keep hiring, pay and termination records for one year from the record or the action, and the file of anyone dismissed for one year from the dismissal; a layoff at closing is that dismissal for everyone. Each employee's Form I-9 is kept until three years after the date of the hire or one year after employment ends, whichever is later. A company that ran a retirement or health plan keeps the plan's filed reports and the records behind them for not less than six years after the filing date. The payroll file can go only when the longest of these has run.

Contracts and corporate records

Outside tax, no federal rule we found sets a period for keeping a closed company's contracts, board minutes or share ledger. What decides how long contracts are worth keeping is how long a claim under them can still be brought, and that is state law. In Delaware, where many startups are incorporated, an action based on a promise must be brought within 3 years from the accruing of the cause of action, but a written contract involving at least $100,000 may set a longer period, up to 20 years. Read each material contract for its own limitation clause and for terms that survive its end, such as confidentiality and indemnities, before deciding it can go.

Minutes and resolutions matter for a different reason. They are the evidence of who decided what: the dissolution, the plan for the money, any sale of the company's assets. Buyers and claimants ask for them, and the guide to who owns a dissolved company's data explains why a sale of the company's records turns on them. Share records also feed the property rule above.

Industry rules on top

A company in a regulated industry has its regulator's periods as well. Two federal examples show the shape: a company covered by HIPAA keeps its security documentation for 6 years from the date of its creation or the date when it last was in effect, and anyone engaging in a transaction subject to the sanctions regulations keeps a record of it for at least 10 years. A health, financial or government-contracting business should list its regulators' rules beside the ones above before it sets an end date for anything.

United Kingdom

Company and tax records

Company law sets a floor. Accounting records must be preserved for three years from the date on which they are made by a private company and six by a public one, and that rule gives way to any provision in the insolvency rules. Tax law asks for longer, so the tax period is the one that binds. Corporation tax records are preserved to the sixth anniversary of the end of the period for which a return may be required, and HMRC's guidance for a limited company says to keep records for 6 years from the end of the last company financial year they relate to, or longer if a return was sent late, a compliance check has started, a transaction spans accounting periods or an asset is expected to last more than that.

What counts as a record is wide. The same guidance lists details of shareholders and the results of any shareholder votes and resolutions, and among the accounting records bank statements and correspondence: an email that carries an invoice or a contract term is a record. Not keeping them can cost a fine of £3,000 or disqualification as a company director. VAT records are kept for at least 6 years.

The UK has a route to shorter periods, and few closing companies use it. The corporation tax rule lets HMRC set such earlier day as may be specified in writing, and the VAT notice says HMRC may be able to allow you to keep some records for a shorter period. A director who wants the tax records gone sooner asks in writing and keeps the answer.

Payroll and employment records

Payroll records under PAYE are kept for 3 years from the end of the tax year they relate to. Records that show workers were paid at least the minimum wage are kept for longer: six years from the end of the following pay reference period. Beyond those, the regulator's guidance on former staff is the working rule: an employer will need to retain enough data to deal with references or pension arrangements and should delete what it is unlikely to need again. The government's strike-off guidance adds one document to keep if the company had staff: copies of its employers' liability insurance policy and schedule.

Contracts

In England and Wales a claim on an ordinary contract must be brought within six years from the date on which the cause of action accrued, and a claim on a deed within twelve years. Those are the periods that decide how long a closing company's contracts are worth keeping, counted from the last date a claim could arise, not from the date the contract was signed.

After strike-off or liquidation

A company closed by strike-off leaves the keeping to its directors. The government's guidance tells them to keep other business documents for 7 years after the company is struck off, such as bank statements, invoices and receipts. The company's filings at Companies House stay on the public register too: the registrar need not show them after the end of the period of 20 years from dissolution. The company's own property is another matter: on dissolution all its property and rights are deemed to be bona vacantia and belong to the Crown, so its former directors keep copies they cannot license, unless the company is restored within six years of dissolution.

In a liquidation the liquidator holds the books. In a winding up by the court, the liquidator, with the official receiver's authorisation, may at any time sell, destroy or otherwise dispose of the company's records; in a voluntary winding up the last liquidator may destroy them after the expiration of a period of one year from the date of dissolution. The word "sell" in that regulation matters: the records are company property, and a liquidator has the power to sell any of the company's property. Selling a company's data in UK administration or liquidation covers that side, UK GDPR included.

Canada

Six years, then two after dissolution

The Income Tax Act requires records to be kept until the expiration of six years from the end of the last taxation year to which they relate, unless the regulations prescribe another period. The CRA applies the same rule under the Excise Tax Act (GST/HST), the Employment Insurance Act and the Canada Pension Plan, so payroll and sales tax records sit on the same clock. While a business runs, records of long-term property, the share registry and other history that would affect a sale or wind-up are kept indefinitely, and records behind an objection or appeal until it is resolved.

Dissolution replaces the six-year rule with a fixed period. The Income Tax Regulations prescribe, for the minutes, the share records, the general ledger and the contracts behind it, and for every other record of a dissolved corporation, the period ending on the day that is two years after the day that the corporation is dissolved. The CRA's page says the same: a dissolved corporation must keep the following records for two years after the date of its dissolution.

Destroying records early needs permission

Canada has a set form for asking to destroy tax records before the period ends. The Act lets a person dispose of them early if written permission for their disposal is given by the Minister, and the CRA's page explains how: ask on Form T137, Request for Destruction of Records, or in writing to the tax services office. Destroying records without that permission may be prosecuted, and the permission covers only the laws the CRA administers, not records you have to keep under other federal, provincial, territorial or municipal laws.

Who answers for the books after dissolution

The Canada Business Corporations Act deals with the records of a dissolved corporation directly. When a court approves a liquidator's final accounts, its order directs the custody or disposal of the documents and records of the corporation. Whoever has been granted custody remains liable to produce those documents and records until the end of the prescribed period, which the regulations set at six years beginning on the day on which the corporation is dissolved. So a federal corporation's tax records can go two years after dissolution, but its custodian must still be able to produce its corporate records for six. Property the corporation had not disposed of at dissolution vests in the Crown, and any interested person may apply to have it revived. Provincial corporations answer to their own province's act.

Contracts

Limitation periods for contract claims are provincial. Ontario's statute is typical in shape: a proceeding cannot be brought after the second anniversary of the day on which the claim was discovered, and in no case after the 15th anniversary of the act behind it. A company elsewhere reads its own province's statute, and every company reads its contracts for the law they choose.

Who keeps the records once the company is gone

A record-keeping duty needs a person, and closing is the moment the obvious person disappears. Each country answers the question differently, and in each the answer depends on how the company closed. The table sets out who holds the records at each stage.

Where the company standsWho keeps the recordsFor how longSource
United States, dissolved (Delaware)The company, acting through its directors while it continuesThe company continues for the term of 3 years to wind up; the tax periods above still run8 Del. C. 278
United States, payroll records after closingThe person named on the final payroll returnAt least 4 years after the tax is due or paidIRS, Closing a business
United States, bankruptcyThe trustee, to whom the company surrenders its books, documents, records, and papersAs the case and the court decide11 U.S.C. 521(a)(4)
United Kingdom, struck offThe former directors7 years after the strike-offGOV.UK strike-off guidance
United Kingdom, compulsory liquidationThe liquidatorMay dispose at any time with the official receiver's authorisationInsolvency Regulations 1994, reg. 16(1)
United Kingdom, voluntary liquidationThe last liquidatorMay destroy one year after dissolutionInsolvency Regulations 1994, reg. 16(2)
Canada (federal), dissolvedWhoever was granted custody, named by the court in a supervised liquidationProduce on demand for six years from dissolution; tax records two years after dissolutionCBCA s. 225(1)

Three practical points follow. In the United States, no rule we found names a custodian for a dissolved company's general records, so the board should name one before its directors scatter: one director, the outside accountant, or a records service, with a written note of what is held, where, and the date each set may go. In Delaware, once the continuation ends or no director is left, a creditor, stockholder or director can apply for a trustee or receiver appointed by the Court of Chancery, which is the route back if a record is needed later and nobody holds it. And in all three countries the person who keeps the records is not thereby their holder in the commercial sense: a former director with the archive on a drive holds a copy, and the right to license it stays with the company (or the Crown, once a UK or Canadian company is dissolved).

What no law requires you to keep

Everything above is about tax, pay, claims and corporate history. A technology company holds much more: its Slack or Teams history, most of its email, its support tickets, its issue tracker, its code repositories with their review history, its design files and its product database. None of the rules quoted in this guide names any of them. A closing company is free to delete them, and in the case of personal data, as the next section shows, often obliged to.

Two kinds of record inside those systems are exceptions, and they need pulling out before anything is deleted. The first is anything that supports a tax item: the IRS's test is whether a record supports an item of income, deduction or credit shown on your tax return, and HMRC counts bank statements and correspondence among a company's records. Invoices, receipts, signed contracts and payment confirmations sitting in email or a shared drive belong in the kept set, exported into it, not left in a system that is about to be cancelled. The second is anything relevant to a claim that is open or could still come: the UK regulator accepts keeping information to defend possible future legal claims but not information that could not possibly be relevant to one, and the CRA's rule keeps records behind an objection or an appeal until it is resolved.

What remains after that sorting is the part of the company's records that no rule requires anyone to keep. For it the question is not how long the company must keep it, but what it does before the records are gone: delete them, let the vendor delete them, or license a de-identified copy first.

Personal data has its own clock

Privacy law adds a second clock that runs in the opposite direction to the tax one. Tax law sets a minimum; privacy law sets a maximum. When a company stops trading, most of the purposes it collected customers', users' and staff's personal data for end with it, and the maximum arrives.

United Kingdom

UK GDPR requires personal data to be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed. The regulator's guidance gives the two lawful endings: data no longer needed is either erased (deleted) or anonymised. For former staff, which at closing means all staff, the employer keeps what references or pension arrangements need and deletes the rest. A UK company's chat, email and ticket history names its staff, its customers and their contacts on every page, so the same rule reaches into those systems too.

Canada

PIPEDA's fifth principle says personal information shall be retained only as long as necessary for the fulfilment of those purposes, that retention policies should have minimum and maximum periods, and that information no longer required should be destroyed, erased, or made anonymous, under procedures the organization writes down. The Privacy Commissioner has said what "made anonymous" takes: there must be no serious possibility that the information retained may be reidentified, and stripping names, phone numbers and email addresses alone was not enough in that case. PIPEDA covers staff data only for a federal work, undertaking or business; for other employers, provincial law decides. In Alberta, British Columbia and Quebec a provincial law governs what happens within the province. Quebec's is explicit about the end of a purpose: the business must destroy the information, or anonymize it to use it for serious and legitimate purposes, subject to any preservation period provided for by an Act.

United States

For US companies two state laws show the shape of the rule. California's privacy act, for a business it covers (one above its revenue threshold, or one that buys, sells or shares the personal information of 100,000 or more consumers or households, among other tests), forbids keeping personal information for longer than is reasonably necessary for that disclosed purpose, and since the employee exemption became inoperative on January 1, 2023 that reaches staff data too. Illinois requires biometric data (voiceprints, face geometry) to be destroyed when the initial purpose has been satisfied or within 3 years of the individual's last interaction, whichever comes first. Other states have their own laws; the guide to privacy law by country and the guide to whether it is legal to sell customer data cover them.

When the two clocks meet

The texts settle the conflict the same way in each country: a period another law requires wins, and privacy law takes over when it ends. PIPEDA notes that an organization may be subject to legislative requirements with respect to retention periods, and Quebec's rule applies subject to any preservation period provided for by an Act. So the personal data inside the payroll file stays for the payroll period, and personal data with no such period (in a support ticket, a sales email, a Slack thread) has nothing holding it once the business that used it has stopped. In all three countries anonymisation is a lawful ending alongside deletion, which matters for the next two sections.

What the records are worth before they are deleted

The records no law requires a closing company to keep are the ones AI buyers pay for: how a company actually did its work, decision by decision, in its chat, email, tickets and code. Buyers now run programmes for exactly these companies. micro1 runs a track for companies that have shut down, asking for 50+ peak employees and substantial MS Teams or Slack data, and it has committed to spend $1B over 12 months acquiring and licensing company operating data. Ooak and Turing also take closed companies' records, and SimpleClosure, a wind-down service, arranges such sales for the startups it closes. The buyer board lists each buyer's rules.

The prices are wide, and the honest way to read them is from the bottom up. Across our price board the median of public sales of one company's records is $72.5K per company, taken over only a handful of sales that state a price, while the median public offer to holders is $280K per company. SimpleClosure, a wind-down service, reportedly paid $10K to $100K per company in its first year, and its own figures put the average deal at about $10,000, part of even the cheapest route to closing. Ooak says its deals range from $20K to several hundred thousand dollars. A small company's records have sold or been priced at $48,000 on average. For context, startups that shut down through SimpleClosure in the first half of 2026 had a median of $13,000 in the bank (non-AI) and $30,000 (AI), so a records sale can be a large share of what a closing company has left. The company records price page and the guide to how much company data is worth show where each figure comes from.

Closing itself lowers the price. Buyers' own estimators value a closed or closing company's records at 0.65 times what they offer the same company while it operates, and one estimator gives the same company $51k to $71k while operating and $33k to $47k once closed. A company that is still winding down, with its admins in place and its systems running, is worth more than the same company months after the last login.

The deletion clock

The clock that decides most closing companies' records is not a law at all. It is the vendors' deletion schedules, which start when the subscriptions stop. Microsoft keeps a cancelled tenant's data for 180 days at most; Jira and Confluence keep a cancelled site for 60 days; Google Workspace states no recovery window once a subscription is cancelled; and a Slack workspace dropped to the free plan loses history older than one year, on a rolling basis. The deletion countdown shows each system's window and its source.

That clock cuts both ways. It destroys records worth selling, and it can destroy records the law requires: an invoice that lives only in a cancelled mailbox is a tax record the vendor deletes on the company's behalf. Export first, before any subscription lapses, then sort. The closures register follows 187 technology companies that are closing, were sold or have gone dark, and the records each one leaves.

Keeping the original, licensing a de-identified copy

Can a company license records it is required to keep? The law and the records support a careful yes, within limits.

What the retention rules require is that the company's own records stay complete and available: kept at all times available for inspection, in the US regulation's words. Nothing in the rules quoted in this guide forbids making a copy. And a licence to an AI buyer is a licence of a copy: Turing says it works from a copy of what you approve, and Mode provides the filtered copy for AI research and training under the agreement's terms. The company keeps its originals where the retention rules want them, for as long as they want them, and a licence neither ends nor extends that duty.

The privacy side is what makes the copy de-identified. Licensing personal data to a buyer for training is a new purpose, which is the hard case under every regime in this guide (the UK, Canada and GDPR guides set out why). A copy with people removed avoids most of it, and the law recognises the split between the original and the copy. The UK regulator says the same information may be personal data in your hands but anonymous in the hands of a recipient with no means to identify anyone. California's act treats deidentified information as not personal information. PIPEDA lists made anonymous as one of the three endings for data whose purpose is over, to the regulator's no serious possibility standard. Quebec allows anonymized information to be used for serious and legitimate purposes, though whether a commercial licence is one has not been tested.

Three limits keep this honest. First, payroll, personnel, health and financial files about people are not what a de-identified lot is made of: our de-identification standard cuts those files out whole, so the records most of the retention rules cover are mostly not the records that sell. Second, the right to license a copy belongs to the company while it exists, not to whoever keeps the records: once a UK company is dissolved its rights belong to the Crown, and a dissolved federal Canadian corporation's undisposed property vests in the Crown, so a licence comes before dissolution or after restoration. Third, a former director's copy is not a licence to anything; who owns a dissolved company's data explains who can sign.

A worked example: a 40-person US software company

An illustrative example, not a real company. A 40-person Delaware software company stops operating in November 2026. Its board and stockholders approve a dissolution, it files its certificate of dissolution in December, and it will file its final federal return in 2027. It holds its books in an accounting system, its payroll with a payroll provider, its contracts in a shared drive, and its working records in Google Workspace, Slack, Jira and GitHub.

What it must keep, and until when. Its tax and accounting records stay until the IRS's window closes for each return: ordinarily 3 years after each return was filed, so the final return's records run into 2030. The board can bring that forward: once the final return is filed, a written request for prompt assessment makes the IRS assess within 18 months, provided the dissolution is completed. If it wrote off customer debts in the final year, those records stay 7 years. The last payroll tax falls due in early 2027, so the payroll tax records stay at least 4 years from then, into 2031; the wage and hour records 3 years from the last entry; the termination files one year from the layoff; each Form I-9 until three years after hire or one year after the job ended, whichever is later, which runs past November 2027 for anyone hired after November 2024. If it ran a retirement plan, the plan's final filing starts six years of its own. Its customer and vendor contracts are kept while a claim can still come: 3 years in Delaware for most, longer where a large contract sets its own period. And the state it operates in adds its own list.

Who keeps them. The board names one director as custodian, attaches the statement the IRS asks for to the final payroll return naming the person keeping the payroll records and their address, and writes down where each set is held and the date it may go. During Delaware's 3-year continuation the directors can still act for the company if a record is demanded.

What it may delete. The Slack history, the Jira project, the GitHub repositories and most of the email have no retention rule of their own, once the invoices, receipts and signed contracts in them have been exported into the kept set. Whether privacy law requires deleting them depends on what they hold and which laws reach the company: if it meets the California act's thresholds, it may not keep its users' and staff's personal information longer than is reasonably necessary for the disclosed purpose, and the purpose ended with the product.

What it does first. The deletion clock starts the day it cancels: Google Workspace states no recovery window after cancellation, and a Slack workspace dropped to the free plan loses everything older than a year. So it exports every system while the subscriptions run, with the admins still in place. Then it values the records before deciding between deletion and a licence. It is below one buyer's line, micro1's 50+ peak employees, but other buyers set other rules, and a closing company's records are valued at 0.65 times an operating one's, so the earlier it asks, the better. If a buyer wants the records, the company licenses a de-identified copy (people removed, personnel and payroll files left out), keeps its originals for the periods above, and deletes the personal data it no longer needs when those periods end.

Questions people ask

How long to keep business records after closing a business? For tax and accounting records, as long as the tax authority can reopen the returns: ordinarily 3 years after filing in the US, 6 years from the end of the last financial year in the UK (with 7 years after a strike-off in the government's guidance), and two years after dissolution for a dissolved Canadian corporation. Payroll and personnel records have their own periods, and records with no tax, pay or legal role have none.

How long to keep business records after closing a company in the UK? HMRC's rule is 6 years from the end of the last company financial year they relate to, longer after a late return or during a compliance check, and the strike-off guidance tells directors to keep business documents for 7 years after the company is struck off. In a voluntary liquidation the last liquidator may destroy the records one year after dissolution. PAYE records need 3 years from the end of the tax year.

How long to keep business records after closing a company in Canada? Generally six years from the end of the last taxation year, but once a corporation is dissolved its records are kept until two years after the day it is dissolved. Destroying them earlier needs the CRA's written permission on Form T137. A federal corporation's custodian must still be able to produce its records for six years from dissolution.

How long to keep business records after closing a business, according to the IRS? Until the period of limitations for each return runs out: 3 years in the ordinary case, 6 or 7 years in named cases, indefinitely with no return or a fraudulent one. Employment tax records stay at least 4 years, and a dissolving corporation can request assessment within 18 months to close the window sooner. The IRS also asks a closing employer to name the person keeping the payroll records.

How long to keep business records after closure if they hold personal data? Only as long as the purpose needs, then delete or anonymise: UK GDPR allows no longer than is necessary, PIPEDA says destroyed, erased, or made anonymous, and California's act forbids keeping it longer than is reasonably necessary for its disclosed purpose. Where a tax or employment rule requires a record, that period comes first.

Who keeps the records when a company is dissolved? In the US, whoever the board names, with the payroll custodian named on the final payroll return; in a bankruptcy, the trustee. In the UK, the former directors after a strike-off and the liquidator in a liquidation. In Canada, whoever has been granted custody, named by the court in a supervised liquidation.

Can we sell records we are required to keep? A licence to an AI buyer is of a copy, and the company keeps its originals for the required period; nothing in the retention rules quoted here forbids a copy. The copy is de-identified because the people in it are protected by privacy law, which recognises data that is anonymous in the hands of a recipient while still personal in the company's. Payroll and personnel files are left out.

What this means for you

If your company is closing, five steps keep it inside the law and keep its options open.

  1. Export before you cancel anything. Every system that holds records starts its own deletion clock when the subscription stops; the deletion countdown shows each window.
  2. Build the kept set and name its keeper. Tax and accounting records, payroll and personnel files, minutes and share records, and contracts, with the invoices and contracts pulled out of email into it. Write down where each set is, who holds it, and the date it may go under the longest rule that applies.
  3. Shorten what the law lets you shorten. In the US, a request for prompt assessment; in the UK, an earlier day specified in writing by HMRC; in Canada, written permission on Form T137.
  4. Decide about the rest before it goes. Chat, email, tickets and code have no retention rule, and their personal data has a deletion clock. Find out what they are worth with a free valuation, check any offer you already have with the offer check, and choose between deletion and a licence of a de-identified copy. The guide to selling company data to AI labs and the page for closed and insolvent companies cover the sale itself.
  5. Delete on schedule, and record it. When each period ends, destroy or anonymise, under the written procedures privacy law expects, and keep a note of what went and when.

AIData.Broker values a closing company's records free and, for a holder based in the United States, the United Kingdom and Canada, describes them without its name to every buyer that fits at the same time, for a fee ( 12% of the first $250,000, 10% up to $1 million, 8% up to $3 million and 6% above $3 million) paid only out of a sale.

The evidence

What this guide rests on

Every number above links to its record, and every record to the page it was read from, with that page's own words. This guide cites 71 records and 10 derived figures, read from 60 sources. How we source and check them.

In this topic

Rights and law

  1. Start hereCan this data legally be sold or licensed for AI training?Privacy law, copyright and fair use, software vendors' terms, de-identification, bankruptcy sales and what a licence agreement holds.
  2. GuideIs It Legal to Sell Customer Data? A US Guide for AI TrainingOften yes, but through layers: your privacy policy, the FTC Act, state and sector laws, and customer contracts. De-identified records are the main lawful path.
  3. GuideFair Use and AI Training: What US Courts Have RuledUS courts are split: training was fair use in Bartz v. Anthropic and Kadrey v. Meta, not in Thomson Reuters v. Ross, and pirated copies lost. Where each stands.
  4. GuideIs It Legal to Scrape Data for AI Training? (US Law, 2026)Scraping public pages is rarely a federal crime after Van Buren and hiQ, but contract, copyright, anti-circumvention and privacy law apply. Resale is hard.
  5. GuideCan a Company License Employee Emails and Slack for AI Training?Usually yes for business records the company controls, but only after it handles monitoring notices, third parties in the messages, privilege and vendor terms.
  6. GuideSelling Customer Data in Bankruptcy: Section 363 ExplainedA bankrupt company can sell customer data only if the sale fits its privacy policy, or a court-appointed privacy ombudsman reports and the judge approves it.
  7. GuideWhat Is a Data Licensing Agreement? The Terms for AI TrainingA data licensing agreement lets a buyer use data for set purposes while the holder keeps ownership. Each clause AI buyers ask for, and where holders stand.
  8. GuideHIPAA De-Identification for AI Training: Safe Harbor vs Expert DeterminationHealth data leaves HIPAA only through Safe Harbor (remove 18 identifiers) or an expert's determination of very small risk. How each works for AI training.
  9. GuideLicensing Company Data for AI Training Under the GDPR (2026)Yes, an EU, UK or Swiss company can license its records for AI training, if it has a lawful basis, tells people, drops sensitive data and uses a transfer tool.
  10. GuideSelling Data for AI Training: Privacy Law by CountryOutside the EU and UK, licensing records for AI training mostly needs consent or anonymisation, and a contract or consent to send them to a US buyer.
  11. GuideExclusive or non-exclusive: how a data licence's scope changes its priceExclusivity can multiply a data licence's price or barely move it, depending on what it covers. What each kind is worth, and how a holder should price it.
  12. GuideHow long should a data licence last? Terms, renewals and what perpetual costsDisclosed AI data licences run two to three years for a living company and forever for a one-off sale. What a term covers, what survives it, and how to price perpetual.
  13. GuideWho Owns a Dissolved Company's Data, and Who Can Sell It?The company does, not its founders or investors. Who can still sign for it after it closes, when investors must agree, and who gets the money from a sale.
  14. GuideSelling a company's data in UK administration or liquidationAn administrator or liquidator can license a UK company's records to AI buyers as company property. What the Insolvency Act allows, what UK GDPR still requires, and what to do before the accounts are deleted.
  15. GuideCan a Canadian company sell its data to AI companies?Yes, its own records, but PIPEDA treats a licence to an AI buyer as a disclosure for a new purpose. What consent, the exceptions, de-identification and Quebec's rules mean for a sale, and which buyers take Canadian companies.
  16. GuideCan a UK company sell its data to AI companies?Yes, its own records, but UK GDPR decides how the people in them are treated. What the Data (Use and Access) Act 2025 changed and did not, the ICO's tests for de-identification, sending records to a US buyer, copyright and database right, tax, and which buyers take UK companies.
  17. GuideHow Long to Keep Business Records After Closing (US, UK, Canada)What a closing company must keep, for how long and who keeps it in the US, UK and Canada, what it may delete, and what its other records are worth first.
  18. RegisterLawsuits and rulingsEvery case, ruling and settlement over training data.
  19. RegisterLicence termsWhat buyers ask for in a licence, and where holders stand.
  20. PageDe-identification standardOur rules for removing people from records, each with its source.
  21. RegisterAI crawler censusA daily census of robots.txt across the most visited sites.

Find out what your data is worth.

  • No data upload
  • About two minutes
  • No email needed
  • Free

The AI data market, weekly

Issues go out on Mondays: the prices, deals, buyers and rulings that moved in the market for AI training data, each with its source.

Optional: so we write about what matters to you

Free. Issues go out on Mondays, and every one has a link to leave. Subscribing means you accept our terms and privacy policy.