UK employers must keep different employee records for different lengths of time — payslips for 3 years, right-to-work records for the duration of employment plus 2 years, pension records for 6 years, and accident records for up to 40 years in certain cases. Keeping records longer than necessary is itself a UK GDPR violation.
Why employee data retention matters
Under the UK GDPR, the storage limitation principle requires that personal data is kept no longer than necessary for the purpose it was collected. For employment records, this means you need a clear retention schedule — knowing both the minimum you must keep (to satisfy legal obligations) and the maximum you should keep (to avoid unnecessary data retention).
Getting this wrong in either direction creates risk:
- Too short: deleting records early can leave you unable to defend an employment tribunal claim, HMRC inspection or Home Office visit
- Too long: retaining data beyond its necessary period is a UK GDPR breach, potentially reportable to the ICO
Retention periods by record type
Payslips and pay records
| Record | Minimum retention | Legal basis | |---|---|---| | Payslips | 3 years from the end of the tax year | National Minimum Wage Act 1998 | | PAYE records (P45, P60, P11D) | 3 years from end of tax year | HMRC | | National Insurance records | 3 years from end of tax year | HMRC | | Statutory pay records (SSP, SMP, SPP) | 3 years from end of the tax year | HMRC |
Best practice: Many employers retain payroll records for 6 years to match the HMRC inspection window. This is legally defensible under the "legitimate interests" basis.
Employment contracts and HR records
| Record | Minimum retention | Legal basis | |---|---|---| | Employment contract | Duration of employment + 6 years | Limitation Act 1980 (contract claims) | | Job application forms (unsuccessful applicants) | 6 months | Equality Act 2010 (discrimination claims) | | Job application forms (successful applicants) | Duration of employment + 6 years | Limitation Act 1980 | | Disciplinary and grievance records | Duration of employment + 6 years | Employment tribunal time limits | | Performance appraisals | Duration of employment + 1 year | Best practice |
Right-to-work records
| Record | Minimum retention | |---|---| | Right-to-work check evidence (all workers) | Duration of employment + 2 years | | Share code screenshots | Duration of employment + 2 years | | Document copies (passport, BRP etc.) | Duration of employment + 2 years |
This is a fixed legal requirement under the Immigration, Asylum and Nationality Act 2006. There is no minimum employment length — if someone works one day, the record must be kept for 2 years after they leave.
Health and safety records
| Record | Minimum retention | |---|---| | Accident book entries | 3 years from date of entry | | RIDDOR reports | 3 years from date of incident | | Health surveillance records | 40 years (if exposure to hazardous substances) | | Risk assessments | Duration of relevance | | Training records (health & safety) | Duration of employment + 3 years |
Pension records
| Record | Minimum retention | |---|---| | Auto-enrolment records | 6 years | | Opt-out notices | 4 years | | Contribution records | 6 years |
Records you can delete sooner
Not all employment records need to be kept for years. Some should be deleted promptly:
- CCTV footage: typically 30 days, unless related to an incident under investigation
- Application forms from unsuccessful candidates: 6 months maximum (many employers delete after 3 months)
- Sickness absence self-certification forms: 3 months after the absence (the fact of the absence is retained, not the form)
- Interview notes: 6 months after the decision
UK GDPR obligations when retaining records
Employment records are personal data. While most retention periods are driven by legal obligations, you still have UK GDPR duties:
Minimise what you collect: only collect data you actually need. Do not record health details on a sick leave form beyond what is necessary.
Store securely: employee records must be protected against unauthorised access. Encrypted digital storage is significantly more secure than paper files.
Tell employees what you keep: your employee privacy notice (required under UK GDPR) should explain what data you hold, why, and for how long.
Respond to access requests: if an employee submits a Subject Access Request (SAR), you must respond within 30 calendar days, providing all personal data you hold about them.
Delete on schedule: once the retention period expires, delete the record. "We might need it one day" is not a lawful basis for indefinite retention.
Practical approach: building a retention schedule
A simple retention schedule for a small business might look like this:
| Category | Delete after | |---|---| | Right-to-work checks | 2 years after employment ends | | Payslips and PAYE | 6 years after end of tax year | | Employment contracts | 6 years after employment ends | | Disciplinary records | 6 years after employment ends | | Unsuccessful job applications | 6 months after decision | | CCTV footage | 30 days (unless incident) | | Auto-enrolment records | 6 years |
Review your retention schedule annually and whenever the law changes.
Frequently asked questions
Do I need to keep records for employees who only worked briefly? Yes. The right-to-work retention obligation (2 years post-employment) applies regardless of how long the person worked. A one-day trial must still have its right-to-work check record kept for 2 years.
What happens if I delete records too early? If you are subject to an employment tribunal claim or Home Office inspection and cannot produce required records, you may face adverse inferences, fines, or loss of your statutory excuse.
Can employees ask me to delete their records? Under UK GDPR, employees have a right to erasure — but this right does not override your legal obligation to retain records for compliance purposes. You can decline erasure requests where you have a legal obligation to retain the data.
Does the retention schedule apply to contractor records? The right-to-work duty does not apply to genuine self-employed contractors. However, if you have any uncertainty about employment status, retain records as if the person were an employee.