Record Retention After Dissolution: How Long and by Whom

At a glance

The specific periods and requirements are as most recently published by the Inland Revenue Department and the Companies Registry.

Why does the duty survive the company?

Because the retention requirement attaches to the records, not to whether the company still exists.

In practice, several situations send people back for these documents:

• The IRD raises an enquiry about past years of a dissolved company
• Somebody applies to restore the company to the register (possible within 20 years of dissolution for a local company) and then goes through the old accounts
• A former customer, supplier or employee raises a dispute
• A director needs to show that they discharged their duties properly at the time

If you cannot produce the documents at that point, the person affected is you personally — not a company that no longer exists.

What specifically has to be kept?

Two broad categories:

Accounting and tax — books of account, source documents (invoices, receipts), bank statements, audit reports, tax returns and notices of assessment, payroll and MPF records. This is the material most likely to be revisited.

Company law — the statutory registers (members, directors, company secretary, the significant controllers register), minutes and resolutions, the certificate of incorporation, the business registration certificate, the articles, and share transfer documents.

On how these are kept while the company still exists, see which statutory registers there are.

Is electronic storage acceptable?

Generally yes, but not in the sense of “snap a photo and you’re done”. In practice it has to be:

• Complete — not a handful of pages; if a batch is kept, the whole batch is kept
• Legible — still openable in ten years’ time (PDF beats one software vendor’s proprietary format)
• Searchable — findable, not one folder holding several thousand IMG_1234.jpg
• Backed up — a single computer or a single cloud account is not enough

The practical method: before dissolution, scan everything, sort it by year and category, store it in two different places (say one cloud copy and one external drive), and write down who holds it and where.

After 7 years, should it be destroyed?

There is a tension here worth understanding: on one hand the law requires you to keep things for a period; on the other, the principle under the Personal Data (Privacy) Ordinance is that personal data should not be kept longer than is necessary.

Employee records and customer personal data are governed by both — kept for the statutory period, and then, if there is no other need for them, properly destroyed rather than held indefinitely.

So the sensible approach is: review once the period expires, and where there is no reason to keep something, destroy it securely (shredding, or reliable electronic deletion) rather than holding it forever.

A few practical arrangements

Write down who holds them. Where there is more than one director, it should be settled before dissolution who keeps the records and how the others obtain them if needed. Leave it unsaid and in a few years you get “I thought you had them”.

Do not leave them only with the company secretary. Once the engagement ends, the provider has no duty to keep them for you indefinitely. Retrieve them formally before dissolution; do not assume they will be held.

Download the bank records yourself. Once the account is closed, the transaction history in online banking is usually gone for good. Before closing it, download and keep every statement and transaction record.

Those three are the most common omissions — and all three are the kind you cannot make good afterwards.

Closing properly is what makes it finished

Closing does not end with the deregistration application; this step comes after it. Get it right and a single enquiry letter years later will not cost you any sleep.

Want someone to arrange the whole thing, from settling what is owed through to closing? Talk to us, or start with what to settle before closing.

The retention periods and requirements described here are as most recently published by the Inland Revenue Department, the Companies Registry and the Office of the Privacy Commissioner for Personal Data, and this does not constitute legal advice.