I always went with the 6 year rule. Below may be of some use, (I believe it to be from the Audit Commission) but I don’t think there are any hard and fast rules other than common sense.
“The six-year retention period and risk assessment:
As stated above the majority of potential legal claims are statute barred on the expiry of 6 years. For this reason many organisations consider it prudent to retain files/records for a period of 6 years form the date when the subject matter was completed.
It is important, though, to keep in mind that in the course of the Council’s everyday business large masses of document action are generated that serve no purpose after relatively short periods of time. Many documents will relate to completed matters where, realistically, the risk of subsequent litigation or other dispute is minimal, if not non-existent. Long-term retention of such documents is counter productive. Head of Services should be prepared to carry out a risk analysis, with a view to disposal of such documents within a shorter period of than the 6 years time frame.