How long should you keep text message records?

"You must not keep personal data for longer than you need it." That's the first line of the ICO's guide to storage limitation, and the second line hands the problem straight back: "You need to think about, and be able to justify, how long you keep personal data." For a business that texts its customers, the data in question is a list of mobile numbers, the record of how each one agreed to hear from you, every STOP reply, and a log of what was sent, when, and whether it arrived. Nobody publishes a number of months for any of that.

What exists instead is four pieces of law and guidance that each fix one part of the answer. The storage limitation principle says you need a written period and a reason. The ICO's consent guidance says how long the opt-in evidence lasts. Its direct marketing guidance says the opt-out record is the one thing you keep after everything else has gone. And the Limitation Act and HMRC between them supply the six years that most retention schedules are built on. Put together, they give you a table, which is at the bottom of this post.

The rule with no number in it

Article 5(1)(e) of the UK GDPR requires personal data to be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". Article 5(2) adds that the controller "shall be responsible for, and be able to demonstrate compliance with, paragraph 1". So the obligation is two-sided: pick a period, and be able to show why.

The ICO's guide says in terms that "the UK GDPR does not set specific time limits for different types of data". It wants "a policy setting standard retention periods wherever possible", a review "at the end of any standard retention period", and either erasure or anonymisation when the data is no longer needed. The test it sets for erasure is to "put the data beyond use", including removing it from backups where appropriate. Pseudonymised data, it notes, usually still permits identification, so the principle still applies to it.

Two of the ICO's allowances matter here. The first is legal requirements: there are "various legal requirements and professional guidelines about keeping certain kinds of records", its example being "information needed for income tax and audit purposes", and keeping data to meet one of those is not keeping it too long. The second is legal claims: you can keep information you might need to defend a possible future claim, with the condition that you delete it once such a claim "could no longer arise". That second allowance is where the Limitation Act comes in, and it's the reason "six years" turns up so often. A small organisation doing occasional, low-risk processing may not need a documented policy, the guide says, but a business sending texts to a customer list isn't in that category.

Consent records: as long as you rely on them

If you send marketing texts on the strength of consent, the record of that consent is the evidence that the texts are lawful at all. Article 7(1) of the UK GDPR says "the controller shall be able to demonstrate that the data subject has consented to processing", and the ICO's page on recording consent sets out what a demonstrable record contains: who consented (a name, a user name or a session ID), when (a dated document or timestamped record), what they were told (a master copy of the consent wording and privacy information in use at the time, with version numbers and dates), how they consented (the form or the submitted data, linked to the version they saw), and whether consent has since been withdrawn, and when.

On how long, the ICO's wording is "for as long as you are still processing based on the consent", and that's a minimum. The same page suggests considering a refresh of consent every two years, with a longer gap if you can justify it, and says to refresh whenever your purposes change enough that the original consent "may no longer be specific or informed enough". Our post on writing a consent request that stands up covers the wording; the point here is that the record of it has to outlive the list it was collected for, because the last text sent on that consent is the one someone might complain about. Our round-up of ICO fines for text marketing shows what happens when a sender is asked for that evidence and hasn't got it.

Opt-outs: the record you never delete

When a customer replies STOP, the tidy instinct is to delete them. The ICO's direct marketing guidance says the opposite. Suppression lists, or "do not contact lists", are "lists of people who have told you that they don't want to" receive direct marketing, and you "should use one to help you to comply instead of just deleting their details". Its reasoning is practical: without the list you can't check a new marketing list against the people who've already said no. "In most cases it is preferable to suppress their details", it says, keeping "just enough information about someone to ensure you respect their preferences in the future", and no more.

The ICO's storage limitation guide makes the same point from the other side: "It is appropriate for the business to retain enough information about the former customer" to keep them out of future marketing. And because "keeping a suppression list isn't for direct marketing purposes", the guidance says people have "no automatic right" to have their details removed from one. The guidance on consent adds that you "may need to keep a record of the withdrawal, for example to maintain suppression lists for direct marketing", and that you must tell people you'll do that, why, and under what lawful basis.

CAP says the same in its advice on database practice, updated 16 December 2025. Rule 10.10 of the CAP Code: "Marketers must hold limited information, for suppression purposes only, to ensure that no other marketing communications are sent." Its advice adds that "simply deleting the data could lead to future breaches if the same details are reintroduced into your marketing lists", and that opt-outs should be honoured "as soon as possible". The ICO's guidance has one more line worth writing on the wall: "A person's most recent indication of their wishes about your direct marketing is the most important."

For a text list, the suppression record is the number, the date of the STOP and what it covered, with the name and the purchase history left off. On CaptiFi Connect a STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT or OPTOUT reply adds the number to the account's opt-out list automatically, which is the record both regulators describe.

Six years: where the number comes from

Section 5 of the Limitation Act 1980 is one sentence: "An action founded on simple contract shall not be brought after the expiration of six years from the date on which the cause of action accrued." Section 2 gives the same six years for an action founded on tort. The periods either side are different: section 11 allows three years for personal injury (running from the date of knowledge if later), section 4A allows one year for defamation, and section 8 allows twelve for an action on a specialty, which is a contract made by deed.

Match that to the ICO's allowance for legal claims and you have a rule for message records. A text that could be evidence in a contract dispute (a booking confirmation, a quote accepted by reply, a payment reminder, an "on my way" text that fixes the date a job was done) can be kept for up to six years from the event it records, because that's how long a claim on the contract could be brought. Past that, the ICO's words apply: delete it, because a claim "could no longer arise". A marketing campaign log is a different thing. It isn't evidence of a contract with anyone, so the six years doesn't attach to it and the period is whatever you set and write down.

The delivery timeline matters more than the message text here. If a customer says they never got the reminder, the record that settles it is the one showing the text was accepted by the network and delivered to the handset at 09:02 on the day. Keep the delivery report with the message, for the same period.

Tax records: six years, sometimes ten

HMRC's guidance on keeping VAT records is the clearest number in this whole area. "You must keep VAT records for at least 6 years (or 10 years if you are using the VAT One Stop Shop (OSS) scheme)." The records are "everything you buy and sell", which HMRC says includes zero rate, reduced rate and VAT exempt items, plus copies of all sales invoices you issue, "all invoices you receive (original or electronic copies)" and a VAT account recording the VAT charged on sales and paid on purchases. Most of it has to be held digitally under Making Tax Digital unless you're exempt. Bad debt relief claims have their own period: four years after the claim, or ten under the old MOSS scheme.

A limited company has a parallel rule for its accounting records: six years "from the end of the last company financial year they relate to", and longer if a transaction spans more than one accounting period, if the company bought something it expects to last more than six years, if a Company Tax Return was sent late, or if HMRC has opened a compliance check.

Which of your texting records are tax records? Almost none of them. The VAT invoices for the credit packs you buy are, and they need the six years like any other purchase invoice. The message logs, the delivery reports and the consent records are not, and nothing in HMRC's rules asks you to keep a single text. Keeping them "for tax" is one of those reasons that sounds sensible and doesn't survive being written in a retention schedule.

A retention table for text records

The periods below are the ones the sources above support. Where no law sets a period, the entry says so, and the period is yours to set and document.

A few notes on using it. Write the schedule down, because the ICO's "be able to justify" is met by a document, and a policy that lives in someone's head isn't one. Give each row an owner and a review date. When a period ends, export what you need and delete the rest; the ICO's test is "beyond use", so a deleted contact that's still sitting in the backups hasn't been deleted. And keep the suppression list out of the deletion run altogether, because the day it goes is the day the next campaign texts someone who said STOP in 2023.

CaptiFi Connect keeps a delivery timeline on every text and exports to CSV, so a retention run is an export followed by a delete; leave the opt-out list alone when you run it. The row that takes the most arguing over is the marketing log, because no regulator has written a number for it. Six years is too long for a log of who got a Friday offer; the period you pick only has to be one you can explain.