How long to keep employee records

The rule: data protection sets no period, other law sometimes does

Employee records are personal data, so the starting point is the storage limitation principle in Article 5(1)(e) of the UK GDPR: keep personal data no longer than is necessary for the purpose. The ICO's employment guidance on collecting and keeping employment records is direct about what that does and does not mean: "Data protection law does not set specific time limits for how long you can keep your workers' personal information." Instead, employers "should set up a retention policy or schedule that lists: the types of record or information you hold; what you use it for; and how long you intend to keep it", "should consider any legal or regulatory requirements", and "once you no longer need the information, you should erase it or, if possible, anonymise it". Its warning is the one most HR schedules ignore: "Do not take a 'one-size-fits-all' approach to retaining workers' personal information."

So every period in a schedule of HR records comes from one of three places. Some are statutory: tax, minimum wage, working time, immigration, pensions and health and safety law each require particular records to be kept for a minimum time. Some are recommended: no law sets them, but a limitation period or a regulator's guidance makes a particular length defensible. And some are sector exceptions, where safeguarding guidance requires records about staff to be kept far longer than an ordinary employer would.

A statutory retention period is a minimum, not a licence. Where a law requires a record, the lawful basis for keeping it is legal obligation; once the period has passed, that basis falls away and the data protection principles apply as they do to any other record, so keeping it longer than necessary needs a reason of its own. Keeping payroll records for six years rather than the three HMRC requires is justifiable if you can say why; keeping everything for ever is not. The Data (Use and Access) Act 2025 has amended the UK GDPR and the Data Protection Act 2018, and the ICO is still updating its guidance to match, so check the date on any ICO page you rely on. The periods below are for England; most also apply in Wales and Scotland, but Northern Ireland has its own legislation for several of them, including working time.

The statutory periods, record by record

These are the employee records for which UK law or official guidance sets a minimum period. Each is stated as the source states it, with its trigger date, because a period without a trigger is not a rule anyone can apply.

• PAYE and payroll records: 3 years from the end of the tax year they relate to. HMRC's guidance on keeping PAYE records covers what you pay employees and the deductions you make, reports and payments to HMRC, "employee leave and sickness absences", tax code notices, taxable expenses or benefits and Payroll Giving documents. If records are incomplete, HMRC "may estimate what you have to pay and charge you a penalty of up to £3,000". Many employers keep payroll for six years; that is a choice, and the reason is the contract limitation period below.
• National Minimum Wage records: at least 6 years. The minimum wage guidance says records "must be kept for at least 6 years if they: were created on or after 1 April 2021". They must show that each worker was paid at least the minimum wage for the hours worked, and it is a criminal offence to "fake payment records".
• Holiday records: at least 6 years from 6 April 2026. Acas's guidance on keeping holiday records says: "From 6 April 2026, employers must keep records of annual leave and holiday pay", covering holiday taken, holiday carried over, holiday pay and payments in lieu, and "must keep records for at least 6 years from the date they were made." This is the newest duty on the list and the one most schedules have not caught up with: leave records that used to be kept for as long as the payroll now have a six-year period of their own.
• Working time records: 2 years. Regulation 9 of the Working Time Regulations 1998 requires records "adequate to show whether the employer has complied" with the limits on weekly hours and night work, retained "for two years from the date on which they were made".
• Right to work checks: the length of employment plus 2 years. For every check on a worker's right to work in the UK, the Home Office's employer's guide to right to work checks says copies of documents "should be kept securely for the duration of the worker's employment and for two years afterwards", and the same applies to online checks. Kept correctly, the copy is the employer's statutory excuse against a civil penalty for illegal working.
• Automatic enrolment pension records: 6 years; opt-outs 4 years. The Pensions Regulator's guidance on keeping records: "Most of these records must be kept for a minimum of six years", "with the exception of those relating to opt-outs, which must be kept for four years".
• Reportable accidents: 3 years. Under regulation 12 of RIDDOR 2013, the record of a reportable incident, disease or over-three-day injury "must be kept for at least three years from the date on which it was made". The accident book commonly follows the same period.
• Occupational health checks: 40 years where COSHH applies. The HSE says records of workers' health checks "must be kept for at least the period specified in the relevant regulations, for example 40 years under the Control of Substances Hazardous to Health Regulations (COSHH)", and where no period is specified, "at least while you employ the worker".
• DBS certificate information: no longer than 6 months. This one is a maximum, not a minimum. Schools that choose to keep a copy of a DBS certificate need "a valid reason" and it "should not be kept for longer than six months" (KCSIE 2026, paragraph 356). The DBS record keeping guide covers the position for other employers and what may be kept instead.

Two things follow from the list. First, statutory periods are short and specific; almost none of them justifies keeping a whole personnel file. Second, several of them turn on records that are often not in the HR system at all: leave and sickness absences, holiday taken, hours worked. Section 06 returns to that.

The recommended periods, where no statute applies

Most of a personnel file has no statutory period. The period an employer chooses has to be justified, and the usual justification is the time within which a claim could be brought that the record would help answer. The main one is section 5 of the Limitation Act 1980: "An action founded on simple contract shall not be brought after the expiration of six years from the date on which the cause of action accrued." That is the source of the six years that runs through most HR schedules in England and Wales.

• Personnel files: 6 years after employment ends is the common period, from the leaving date, justified by the contract limitation period. It covers employment contracts and their variations, pay and pension history, and the core employment history. Most employment tribunal claims have much shorter time limits, but a contract claim in the civil courts does not.
• Unsuccessful applicants: 6 months or more after the decision (the tribunal time limit for most claims is 6 months minus 1 day where it starts on or after 1 October 2026, and early conciliation pauses it), long enough for any claim about the recruitment to be brought, with the period written down and applied. Keep longer only for a named reason, such as consent to be considered for future vacancies.
• Disciplinary and grievance records: the outcome letter and the notes of hearings with the personnel file; the sanction itself treated as expired when the warning lapses. A lapsed warning should not be relied on for a future sanction, but the record of the process can be kept for as long as the file is, because it answers a later claim about how the employee was treated.
• Sickness and occupational health records: the absence dates with payroll; medical detail, which is special category data, kept separately, seen by fewer people, and for no longer than the purpose needs. COSHH health records are the exception above.
• References given: a copy with the personnel file, because the employer may later need to show what it said and why.
• Training and qualification records: for as long as the role depends on them, then with the personnel file. In regulated sectors the inspector will ask for them during employment, not after.
• Records under a hold: anything relevant to a live claim, grievance, subject access request or investigation is kept until that matter ends, whatever the schedule says. Once a subject access request exists, deleting information to prevent its disclosure is an offence under section 173 of the Data Protection Act 2018.

None of these is a rule. Each is a period an employer can defend, and the ICO's test is whether you can say why. A schedule that records the justification beside each period, "6 years from leaving: Limitation Act 1980, section 5", is one you can answer for.

The safeguarding exceptions: schools, care and charities

Organisations that work with children or adults at risk carry records about staff that an ordinary employer does not, and the periods are much longer.

Schools and colleges. Keeping children safe in education 2026 sets three periods that override any general HR schedule. For allegations against staff that met the harm threshold, "All records should be retained at least until the accused has reached normal pension age or for a period of 10 years from the date of the allegation if that is longer" (paragraph 500), and the record kept on the person's file includes a clear summary of the allegation, how it was followed up and resolved, the outcome, and "a declaration on whether the information will be referred to in any future reference" (paragraph 498). Allegations found to be malicious or false "should be removed from personnel records unless the individual gives their consent for retention"; substantiated, unfounded and unsubstantiated allegations are kept. For low-level concerns, "it is recommended that it is retained at least until the individual leaves their employment" (paragraph 523). And copies of documents used to verify a successful candidate's identity, right to work and qualifications "should be kept on their personnel file" (paragraph 355), which is how the single central record is evidenced.

Care providers. Regulation 17(2)(d) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires a registered provider to "maintain securely such other records as are necessary to be kept in relation to" persons employed in the carrying on of the regulated activity, and Regulation 19 requires the recruitment information in Schedule 3 to be available for each person employed. There is no single statutory period for staff files in adult social care; the NHS Records Management Code of Practice publishes a retention schedule that includes staff records, and many providers adopt it. Records of safeguarding concerns about staff, and of any referral to the Disclosure and Barring Service, belong with the safeguarding record and outlast an ordinary personnel file.

Charities. A charity's employees are covered by the same statutory periods as any employer's. A charity that works with children or adults at risk also needs a period for allegations and concerns about staff and volunteers; many adopt the KCSIE period for allegation records because it is the best-established reference point, and should say so in their policy. Volunteers are not employees, but records of their checks, training and any concerns need a period of their own, set on the same principles.

Putting it together: the HR retention schedule and the leaver

The practical output is a schedule with one row per type of employee record and five columns: the record, where it is held, the period with its trigger, the justification, and how it is disposed of. For most small employers it fits on two pages. Four habits make it work.

1. Split the personnel file. A single file kept for a single period is always wrong for part of it. The right to work copy, the payroll history, the lapsed warning, the occupational health letter and, in a school, the allegation record each have a different clock.
2. Start the clock on a named event. "End of the tax year", "leaving date", "date the record was made" and "date of the allegation" are the triggers the sources use. Put the trigger in the schedule and in the system, so that the review date can be calculated rather than remembered.
3. Run a leaver process. On the leaving date, move the file to its leaver retention period, delete what has no reason to outlast employment, and record the review date. The ICO's guidance also covers the rights former workers keep: access to their records, and in some cases erasure.
4. Review, dispose and record the disposal. Once a year, delete or anonymise what has reached its date, unless a hold applies, and keep a note that it was done. The data retention policy guide covers deletion and backups.

The test of the schedule is simple: pick a member of staff who left three years ago and ask what the organisation still holds about them, where, and why. If the answer is "everything, in the personnel file", the schedule exists on paper only. If the answer is "we are not sure", the problem is usually not the file at all.

The employee records that never reach the file

Look again at the statutory list and notice how many of the records it names begin as messages. A care worker texts the shift lead at six in the morning to say she is ill; that is a sickness absence HMRC expects the payroll records to show. A teaching assistant asks in the staff WhatsApp group whether she can take Friday, and the deputy replies "yes, fine"; from April 2026 that is holiday taken, which must be recorded and kept for six years. A manager agrees a change of hours in a direct message. A colleague raises a concern about a member of staff with the designated safeguarding lead by text on a Sunday evening, and it becomes the first line of an allegation record that has to be kept until the person reaches pension age.

The personnel file shows the outcome, if someone typed it in. The message that shows when the request was made, who agreed it and what was said is on two personal phones, held for as long as their owners keep them. When a claim, an HMRC enquiry or a LADO referral asks for the record, the organisation's copy starts at the point somebody transcribed it.

The answer is not to stop staff texting in sick; that is the quickest way to know who is on shift. It is to have the work conversations that become employee records take place somewhere the organisation holds. ComplyChat gives those conversations a channel the organisation owns: messages are recorded on the server as they are sent, everyone added is told the channel is on the record and can object or leave, and a mobile number verified by SMS is enough to join, which matters for bank staff and volunteers without a work account. On paid plans, once the organisation's Microsoft 365 tenant is connected, the lasting record files there under the organisation's own retention rules, so the messages can follow the same schedule as the rest of the file. It is not an HR system, a payroll system or a holiday planner, and it does not calculate a single period for you. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive, and it cannot meet a six-year duty.

A question for the next leadership or trustees' meeting: when a member of staff last asked for leave or reported sick, where was the first record of it made, and would it still exist in six years?

Official guidance and your next step

The primary sources are the ICO's guidance on employment practices and data protection: keeping employment records; HMRC's PAYE record-keeping guidance; the minimum wage guidance for employers; Acas on holiday records; the Home Office right to work guide; The Pensions Regulator; the HSE; and, for schools, KCSIE 2026. Periods are as those sources stated them on 25 September 2026. Employment law is changing quickly, so check each source before relying on a period, and check the date on any ICO page.

This guide is a summary for UK employers, not legal advice. Where a record may be needed for a live or threatened claim, keep it and take advice before deleting anything.

Then do one thing: add a row for holiday records to your retention schedule, six years from the date each record is made, and check where holiday is actually requested and approved in your organisation. If the answer includes messages, the six years has to start there.