How long can a restaurant keep guest and booking data? A UK GDPR retention schedule

A regular emails to say she has moved away and would like you to delete everything you hold on her, and you realise nobody has ever decided how long the restaurant keeps booking data.

UK GDPR does not set a retention period for restaurant guest data. It says personal data must be kept "for no longer than is necessary" for the purpose you collected it, so you set a period for each type of data, write it down, and delete or anonymise on schedule. Tax law sets the floor for money records: HMRC expects a limited company to keep business records for 6 years from the end of the financial year, and VAT records for at least 6 years. A "24-month" setting in booking software is a vendor default, not a legal limit. The schedule below is a starting point you can adapt.

Last checked: 5 November 2026.

How long can a restaurant keep guest data under UK GDPR?

As long as you can justify, and no longer. The storage limitation principle in Article 5(1)(e) of the UK GDPR is the rule. The ICO's storage limitation guidance explains how it works in practice:

• "The UK GDPR does not set specific time limits for different types of data." You set them.
• You should "establish and document standard retention periods for different categories of information you hold wherever possible".
• You "should not keep data indefinitely 'just in case'".
• At the end of the period, erase the data or anonymise it so nobody can be identified.
• Keeping records because another law requires it, such as "information needed for income tax and audit purposes", is not keeping them too long.

The ICO notes that this guidance is under review after the Data (Use and Access) Act 2025. The principle itself has not changed.

The decision rule. For each type of data, ask three questions:

1. Why do we hold it? One purpose per row: taking the booking, running a deposit, marketing, safety.
2. When does that purpose end? The visit, the end of a claim period, the day consent is withdrawn.
3. Does another law make us keep part of it longer? Usually tax. Keep the part the law needs and strip the rest.

A retention schedule for restaurant guest data

This is TablePort's suggested schedule for a UK restaurant, café or pub, not a legal standard. Where a law sets the period, the anchor column names it; every other period is a judgement you can change, as long as you write down why.

Suggested periods are TablePort's view, not legal requirements, unless the anchor column names a law. Scotland and Northern Ireland have different claim time limits.

Why the money rows are the longest. gov.uk's company records guidance says a limited company must keep records "for 6 years from the end of the last company financial year they relate to", longer in some cases. A sole trader keeps records "for at least 5 years after the 31 January submission deadline of the relevant tax year" (gov.uk). VAT Notice 700/21 says to keep VAT records "for at least 6 years". Tax law needs the sale, the date and the amount. It does not need the guest's phone number, so the contact details can usually go sooner than the transaction.

CCTV. The ICO says "it is the purpose of your processing that should determine your retention period", and that footage "shouldn't be kept for six months merely because the manufacturer's settings" allow it. We found no 31-day rule in the ICO's guidance, despite claims online.

Are allergy notes health data?

Yes, treat them as health data, which is special category data under UK GDPR. The ICO's own example is a hairdresser recording a patch test, which it describes as "processing health data about the client's allergies" (ICO, conditions for processing). An allergy on a restaurant booking is the same kind of information.

In practice:

• On the booking, the note serves one visit. Delete it with the booking record, or sooner.
• On a guest profile, it lasts across visits. Ask first, in plain words: "Shall we keep your nut allergy on file for next time?" Record the answer, and remove the note if the guest says no or later changes their mind.
• Keep incident records separately. If something went wrong, the record of what happened belongs in your incident log, kept for the claim period, not in the guest profile.

Allergen labelling and staff training are a separate subject; see our Natasha's Law guide.

Worked example: one guest, one year

A guest books for four in December 2025, pays a £40 deposit, notes a nut allergy and ticks "send me offers". She unsubscribes in March 2026 and emails in October 2026 asking you to delete her data.

You have one month to respond, extendable by two months for complex requests, and a request made by phone or in person counts, according to the ICO's right to erasure guidance. If you shared the data with another organisation, you must tell them about the erasure unless that is impossible or takes disproportionate effort.

Reply you can send:

Hi [name],

Thank you for letting us know. We have deleted your booking details,
guest profile and the notes on your account, and removed you from
our marketing.

Two things we must keep, and why:
- the record of your payment of £[amount] on [date], which tax law
  requires us to keep for six years; and
- your email address on our "do not contact" list, so that you are
  never sent marketing by mistake.

If you have any questions, reply to this email.

[Name], [Restaurant]

What should your privacy notice say about retention?

Say how long you keep each type of data, or how you decide. A short block like this works for most restaurants:

HOW LONG WE KEEP YOUR INFORMATION

Bookings: we keep your booking details for 2 years after your visit.
Guest profile: if you visit us regularly, we keep a record of your
visits and preferences until 2 years after your last visit.
Allergies and dietary needs: we use these for your booking. We only
keep them for future visits if you ask us to.
Marketing: if you agree to hear from us, we keep a record of that
agreement. If you unsubscribe, we keep your email address on a
"do not contact" list so we never email you by mistake.
Payments: we keep records of payments for 6 years because tax law
requires it. We do not store your card number.
CCTV: footage is overwritten after [X] days unless we need it to
deal with an incident.

You can ask us to delete your information at any time by emailing
[address]. Some records, such as payments, we must keep by law.

Change the periods to match the schedule you choose. Whatever you write, your systems must actually do it. Link the notice from your website's footer and booking page; our restaurant website guide covers what else the site should hold.

Can TablePort handle this for you?

TablePort holds most of the records in the schedule above in one place:

1. Guest profiles from bookings and orders. Visits, spend and last visit are built from your own bookings and orders, so there is one record per guest to review, not several spreadsheets.
2. Notes and allergies on the guest. Tags, preferences and allergies sit on the guest and show on their booking and tab.
3. No card numbers to keep. Card details are handled by Stripe.
4. Marketing only with agreement. Marketing Suite sends only to guests who have agreed to hear from you.
5. Erasure and export requests. TablePort can erase a guest's personal data, and export it, on request, so a request like the one above is handled in one place.

The limit: TablePort does not write your retention schedule or privacy notice. The periods are your decision. See guest profiles in TablePort.