How long should you keep employee records for? 

How long is too long when it comes to storing leaver records? This is one of the most common questions we get from clients who are eager to stay on the right side of legislation, their workforce, and their data storage capacity. While you don’t want employee records gathering virtual cobwebs in dusty, long-forgotten, but always fee-charging corners of your cloud storage (… hmmm, now you know why those bills were getting so high), you also don’t want to scrub them from the archives while a leaver’s chair is still warm – you at least want to know where to send that heartfelt ‘We’ll miss you’ card, don’t you? 

While the Data Protection Act 2018 does give some vague guidelines—in fact, the exact words are “personal data must be kept for no longer than is necessary for the purpose for which it is processed”—you’re probably looking for something a little more informative if you’re reading this. 

Well, you’ve come to the right place my fellow data knight! 

Past applicants 

How long: No longer than 6 months after last action unless explicit permission has been sought from the candidate, with the purpose of sharing future opportunities.  

Action: Destroy 

Ok, they’re not exactly leavers—more, never-starters. But you may want to keep records such as CV’s, application forms, interview notes, and so on, to refer to, should a similar role come up again, and to notify any suitable past applicants. To do that, you’d need to let the applicant know that you want to keep their information on file, why, how long for, and give them the option to refuse their permission. On a legal note, unsuccessful applicants have 3 months, with an option to extend to 6 months in certain circumstances, to bring a discrimination case against you, so it’s advisable to keep all applicant records for at least that period.  

The ICO specify in their Retention and Disposal Policy that they keep the data of both successful and unsuccessful candidates (including third-party referee details) for 6 months after the last action of the application process, according to the Limitation Act 1980 and as recommended by The National Archives Retention Scheduling: Employee Personnel Records and CIPD.  

Employee files and personal development records 

How long: No longer than 6 years after the end of employment 

Action: Destroy 

Employee files and PDRs can include their employment contract and job details, personal details, performance appraisals, disciplinary and grievance records, examination and testing records, accident incident reports, ill health records, industrial relations and action records, training material and payroll data. You can, and in most cases should, keep this data for 6 years after the end of employment, in case you need to defend against a county court or high court claim, or are subject to tax assessments.  

PAYE and leave records 

How long: No less than 3 years after the end of the fiscal year to which they relate 

Action: Destroy 

It’s a legal requirement that PAYE and leave records are available for inspection by a government appointed officer for at least 3 years and in accordance with The Income Tax (Employments) Regulations 1993 (SI 1993/744) as amended, the Statutory Sick Pay (General), Regulations 1982, the Statutory Maternity Pay (General) Regulations 1986 (SI 1986/1960) as amended, the Maternity & Parental Leave Regulations 1999, and the Statutory Paternity and Statutory Adoption Pay (Administration) Regulations 2002. 

Third-party personal data 

How long: Immediately after the end of employment 

Action: Destroy  

Always use common sense as well as the relevant regulations. Ask yourself, “Can I think of any scenario in which I will need this information?” If the answer is “no”, then don’t keep it. For example, there is very rarely any business need to keep third-party emergency contact details provided by the leaver… unless you’re working for the secret services or the military, where ‘leaver’ never really means ‘leaver’. 
 
And if you don’t like the idea of using common sense because of the possibility of human error, we’ve got you covered. SenseHR software can automate the permanent deletion of data that has served its purpose in line with regulations and your unique business requirements. 

One last thing… 

Before you start stoking the computer-generated bonfire, be aware that lots of organisations keep records for much longer than the established, recommended time limits. However, any non-standard retention of records should be officially and legally accounted for and kept in accordance with the Data Protection Act 2018.  

Also, because different data types are subject to varying regulations, all data should be stored and dealt with systematically. SenseHR can help you manage your employee data according to HR best practices and government regulations.  

And just before you go, please keep in mind that while all the information in this article is published in good faith, it’s for information purposes only and shouldn’t be relied upon as a single source. Every organisation is wonderfully unique, with their own data retention considerations and requirements. Likewise, legal and government guidelines are subject to change and this article might not be kept up to date, in line with the latest legislation or recommendations. So, the only solid advice that we will offer is this: consult with a lawyer and the official government regulations that are referenced and linked in this article.