MTD for Income Tax: Retention, Backups & Disaster Recovery for Records

Why retention, backups and disaster recovery matter for MTD (2026–2028)

Making Tax Digital for Income Tax (MTD ITSA) changes how you keep and submit records. From April 2026 HMRC begins a staged rollout based on income thresholds (April 2026: income > £50,000; April 2027: income > £30,000; April 2028: income > £20,000). That means more sole traders and landlords will be required to keep digital records and submit quarterly updates. Keeping digital data is only part of the job: you must also retain, protect and be able to restore those records. A practical policy that covers retention, backup and disaster recovery keeps you compliant and reduces stress when things go wrong.

What HMRC expects in plain English

HMRC’s core expectations are straightforward: records must be accurate, complete, readable and available for the required retention period, in a digital format where MTD applies. They should include a clear audit trail showing when transactions were created or changed. HMRC will accept scanned copies of documents provided the scan is legible and the original data is preserved.

Retention periods you need to know

• Self-employed and landlords (Self Assessment): keep records for at least 5 years after the 31 January submission deadline for the relevant tax year. Practically, keep year X records until 31 January five years after the submission deadline for year X.
• VAT-registered traders: usually 6 years for business records (some exceptions apply).
• Payroll (PAYE) records: usually 3 years from the end of the tax year to which they relate, but keep payslips and RTI records as required by your circumstance.
• CIS records: generally 3 years from the end of the tax year in which the payment was made.

Note: if you are ever involved in an enquiry or litigation, HMRC may require you to keep particular documents for longer. When in doubt, keep longer rather than shorter.

Build a simple, practical retention schedule

A retention schedule is a short document that tells you what to keep, where to keep it and for how long. For MTD compliance include:

• categories of records (sales, purchases, bank statements, invoices, receipts, payroll, contracts);
• minimum retention periods in years (link to the guidance above for the specifics relevant to you);
• format requirements (original digital, scanned copy, CSV export from accounting software);
• location (primary system, archive storage, backup location);
• owner / responsible person and access rights;
• review and disposal procedure at end of retention period (secure deletion or archive to read-only medium).

Backing up digital MTD records: strategy and frequency

Not every business needs complex IT operations. But every MTD-registered taxpayer should have a dependable backup strategy. Consider four simple elements: frequency, redundancy, security and test restores.

• Frequency (how often): transactional systems: daily backups. Reconciled monthly ledgers: weekly may suffice. Critical files (bank feeds, journals) should not be older than 24 hours.
• Redundancy (where): 3-2-1 rule is good practice — three copies, on two different media, one offsite. For small businesses that often means primary cloud accounting system, a second cloud backup and a local encrypted copy.
• Security: encrypt backups at rest and in transit, use strong passwords and two-factor authentication (2FA) for software accounts, and control who can create or delete backups.
• Test restores: a backup is only as good as your ability to restore it. Schedule restore tests at least twice a year to ensure data integrity and that staff know the process.

Types of backups that suit small businesses and landlords

• Managed cloud backups: many MTD-compatible accounting packages hold data in the vendor’s cloud and offer export and built-in backups. Ensure export options include CSV, XML or the supplier’s backup format.
• Third-party cloud backup services: independent backups of your accounting system exports stored in services like Box, OneDrive or a specialist backup provider add resilience.
• Local encrypted copies: periodic encrypted exports stored on a secure external hard drive retained offsite (for example, in a safe at a business owner’s home) provide an additional layer.
• Immutable archives: read-only monthly or yearly archives retained to meet statutory retention periods. These are particularly useful if you need an untampered record for a dispute or HMRC enquiry.

Disaster recovery planning — what it must cover

A disaster recovery plan (DRP) describes how you will restore access to tax records following an incident (cyber incident, hardware failure, fire, flood, theft). For small businesses a short, clear plan is enough. Include:

• Recovery Time Objective (RTO): how quickly you need to restore systems — for many sole traders 24–72 hours is reasonable; for landlords who collect rent, aim for shorter times for rent accounting.
• Recovery Point Objective (RPO): the maximum acceptable age of data on restore — daily backups mean an RPO of 24 hours.
• Roles and responsibilities: assign an owner for recovery actions, a deputy and contact details for your software supplier and IT support.
• Step-by-step restore procedure: where backups live, how to authenticate, how to import data back into accounting software and verify the restore.
• Communications plan: who to tell (clients, landlords, tenants, suppliers) and what to say in the event of prolonged disruption.
• Testing schedule: how and when you test your DRP.

Practical checklist: preparing your MTD-ready backup and DR plan

• Confirm your accounting software exports data in an open format (CSV, XML) and that you can download these exports regularly.
• Set automated daily backups where possible; keep at least 30 days of rolling backups and monthly archives for at least the statutory retention period.
• Store one copy offsite in a secure cloud location, and one copy encrypted and kept physically separate.
• Document the restore process and keep it with the backups (so you can follow it even if your systems are down).
• Enable 2FA and strong passwords for all tax and accounting services and limit user access to those who need it.
• Run restore tests twice yearly and note the outcomes and any fixes you applied.

Dealing with paper documents and scanned copies

Many sole traders and landlords keep some paper documents (receipts, tenancy agreements). Under MTD you may keep scanned copies if they are legible and stored securely. Best practice:

• scan receipts and invoices promptly and attach them to the relevant transaction in your accounting software;
• use a consistent naming convention and folder structure so files are easy to find and linked to entries;
• retain original paper documents if they contain unique legal information (signed contracts), or keep a certified copy if disposing of paper; where you dispose, do so securely (shred or incinerate) and record the disposal.

Record integrity and audit trail expectations

HMRC expects a record trail that shows when entries were created or altered and by whom. Practical steps:

• use accounting software that records user activity and changes (audit log);
• keep exports of your ledgers at regular intervals (quarterly and year-end) as immutable archives;
• date-stamp scanned documents and include the original invoice or receipt date in the filename or metadata;
• if you correct an error, keep a note explaining the reason and the date of the correction rather than deleting history.

What to do if data is lost or corrupted

• act quickly: switch to your recovery plan and start the restore from the most recent reliable backup;
• document the incident: what happened, when, and how you restored the data;
• if the incident affects submissions, contact HMRC if you cannot meet a return deadline and explain the situation—being proactive reduces risk of penalties;
• learn and harden: identify how the failure happened and plug the gap (additional backups, access controls, staff training).

Choosing software with backups and compliance in mind

When you select MTD-compatible accounting software, check these points:

• can you export data in open formats and how easily?;
• does the vendor provide built-in backups and for how long are they retained?;
• is there an audit trail and are logs easily exported?;
• do they offer or allow third-party backup integrations?;
• how fast can they support a restore and what are their SLAs?;
• are data centres UK/EU based and compliant with data protection law?

Special note for landlords and self-employed people

For landlords, important documents include tenancy agreements, rent statements and deposit paperwork. For tradespeople or freelancers, timesheets, mileage logs and supplier receipts matter. Keep these digitised and linked to your accounts. If you use spreadsheets for specialist records (e.g. property income schedules), ensure they are included in your backup routine and that any manual totals are verifiable with supporting source documents.

Testing, training and continuous improvement

Make testing and staff training part of your routine. A short simulated restore once or twice a year gives confidence. Train anyone who has access to tax systems on how to export records, how to attach documents and what to do if they suspect a breach.

Sample short policy (one page)

• Purpose: ensure MTD records are retained and recoverable for statutory periods.
• Retention: accounting records kept minimum 5 years after 31 January submission deadline.
• Backups: daily automated cloud backups; 30 day rolling backups; monthly immutable archives for 7 years.
• Security: backups encrypted; 2FA enabled for accounting systems; access limited to named staff.
• DRP: RTO 48 hours, RPO 24 hours; restore procedure documented and tested twice yearly.
• Owner: named person responsible for backups and tests (include contact details).

Final practical steps to take this week

• download a full export of your accounting system and store it in an encrypted folder offsite;
• check your software supplier’s backup retention policy and export options;
• write a one-page retention and backup policy and give it to the person who handles your bookkeeping;
• schedule a restore test for a quiet period and note any issues.

Where Tax Digital can help

We support sole traders and landlords with MTD-ready record keeping, backup strategies and disaster recovery planning. We can review your current backup arrangements, help you set up automated exports and produce a simple, practical DR plan tailored to your business and the MTD timelines (April 2026–2028).

Keeping clear, accessible digital records and having a tested recovery plan will remove worry and keep you compliant. If you’d like a short checklist or a template retention schedule, contact us and we’ll send a straightforward starter pack.