How Long Should Employers Keep Ex-Employee Records in the UK?

Meta description: Find out how long UK employers should keep ex-employee records, including payroll, pension, recruitment, health, and right-to-work documents.

There is no single UK retention period for every ex-employee record. Employers need to keep some documents for a set time to meet legal duties, while other information should be deleted when it is no longer needed. The right period depends on the record’s purpose, the rules that apply, and whether a claim or investigation is ongoing. A clear retention schedule helps employers meet their obligations without keeping personal data indefinitely.

The Short Answer: Keep Records Only as Long as Needed

UK data protection law does not set one universal deadline for deleting former employees’ files. Under the UK General Data Protection Regulation (UK GDPR), personal data should be kept in an identifiable form for no longer than necessary for the purpose it was collected. The Data Protection Act 2018 also applies.

In practice, an employer should identify a lawful reason to retain each category of information, set a review or deletion date, and keep only what is relevant. A record may need to be retained longer if a law requires it, a legal claim is reasonably anticipated, or it is needed for a defined business purpose such as responding to a reference request. The reason should be documented and reassessed periodically.

Important: A commonly quoted period, such as six years, is not a blanket rule for all ex-employee records. It may be relevant to certain claims or records, but it does not automatically justify retaining an entire personnel file for six years.

Common Retention Periods for Ex-Employee Records

Different records have different legal and practical requirements. The periods below are useful starting points, not a substitute for checking the rules that apply to a particular employer or record.

These periods do not mean every document in an employee’s file should be kept for the longest period shown. A payroll record, medical document, interview note, and pension record have different purposes and may have different deletion dates.

Payroll, Tax, and Pay Records

HM Revenue & Customs requires employers to keep PAYE records for at least three years from the end of the tax year to which they relate. Records may include pay, deductions, taxable expenses, benefits, and information used to operate payroll. HMRC may request evidence during a compliance check, so records should be complete, accessible, and protected against unauthorized access.

National Minimum Wage records have a longer minimum retention requirement: employers must generally keep relevant records for six years. These can include hours worked and pay information needed to show that workers received at least the applicable minimum wage. Employers should not confuse this specific duty with a requirement to keep all personnel records for six years.

Some payroll documents may also be relevant to tax inquiries, disputes, or an employee’s request to check past pay. If an employer keeps records beyond a legal minimum, it should identify the reason and avoid retaining unnecessary sensitive details.

Working Time and Health and Safety Records

Under working-time rules, employers must keep certain records for two years. The precise records needed depend on the requirement involved, such as limits on working hours or night work. Employers should check whether their timekeeping system captures the evidence necessary to demonstrate compliance rather than assuming that a general attendance record is sufficient.

For reportable workplace incidents, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR) require employers to keep records for at least three years from the date the record was made. Other health and safety documents can have different retention needs. An occupational health report, for example, contains sensitive health information and should not be kept indefinitely just because an incident record must be retained.

Pensions and Benefits

Workplace pension duties create separate record-keeping obligations. The Pensions Regulator’s guidance generally distinguishes between automatic-enrolment records, which employers commonly need to retain for six years, and opt-out notices, which are generally retained for four years. Employers should verify the applicable category and current guidance, particularly when records are held by a pension provider or payroll service.

Benefits records may also contain personal or financial information. Employers should retain only the documents needed for tax, pension, audit, or contractual purposes, and should set a separate review date for supporting information that no longer serves a continuing purpose.

Right-to-Work Checks

Employers should retain evidence of a right-to-work check for the duration of the person’s employment and for two years after employment ends. After that period, the evidence should generally be securely destroyed unless another lawful reason requires it to be kept.

The Home Office’s right-to-work guidance explains acceptable checks and evidence. Employers should follow the rules in force when a check is carried out, keep a clear record of the check date and method, and restrict access to identity documents. Keeping passports or immigration documents for longer than required can create unnecessary privacy and security risks.

Recruitment and Unsuccessful Applicant Records

Recruitment records for someone who was not hired should not automatically be added to an employee-retention timetable. Employers may need to retain application forms, interview notes, and selection records for a limited period to explain a hiring decision or respond to a complaint. The appropriate period depends on the employer’s documented purpose and any relevant claims or sector rules.

Once that purpose has ended, the records should be deleted or anonymized. If an applicant agrees to be considered for future vacancies, the employer should explain how long the details will be kept and obtain any consent or other lawful basis needed for that use.

Employment Claims and Legal Holds

Limitation periods can affect how long it is prudent to retain evidence, but they do not create a universal data-retention deadline. Many employment tribunal claims must usually be brought within three months less one day of the relevant event, subject to statutory procedures and possible extensions. The time limit varies by claim type, and early conciliation can affect the calculation.

Some contractual claims may be brought in the civil courts. In England and Wales, a simple contract claim commonly has a six-year limitation period. Scotland has different prescription rules, and Northern Ireland has its own legal framework. Employers should obtain jurisdiction-specific advice rather than applying an England-and-Wales period throughout the UK.

If a complaint, tribunal claim, regulatory inquiry, or investigation is underway or reasonably anticipated, the employer may need to preserve relevant evidence beyond its ordinary deletion date. A legal hold should identify the records involved, pause routine deletion where appropriate, and be reviewed when the matter ends. It should not become an indefinite reason to retain unrelated material.

Special-Care Records: Health, Equality, and Safeguarding

Health information and other special-category data require particular care under UK GDPR. Employers should keep such information only when they have an applicable lawful basis and condition for processing, and only for as long as the purpose requires. Access should be limited to people who need the information, and deletion should be secure.

Records relating to discrimination, reasonable adjustments, grievances, or safeguarding may be important if a dispute arises. That does not mean every note should be kept forever. Employers should set a justified retention period, preserve relevant evidence when a specific issue is anticipated, and distinguish confidential medical details from general employment records wherever possible.

How to Create a Practical Retention Schedule

A well-designed schedule sets a clear period for each record category and explains when the retention clock starts. For example, the trigger might be the end of employment, the end of a tax year, the date of an incident, or the conclusion of a claim. This avoids applying a single end-of-employment date to records governed by different rules.

1. Inventory the records: Identify paper files, email, HR systems, payroll platforms, shared drives, and records held by service providers.
2. Document the purpose: State why each category is kept and identify the legal or operational requirement.
3. Set a period and trigger: Record the retention duration, the event that starts it, and any review date.
4. Limit access: Apply role-based permissions, especially for health, disciplinary, and identity information.
5. Delete or anonymize: Remove records securely when their retention period expires, including copies held in routine systems where feasible.
6. Pause deletion when needed: Apply a documented legal hold for relevant disputes or investigations, then review it when the matter closes.

Employers should also explain retention practices in their employee privacy information. If records are held by a payroll, HR, or cloud provider, the employer should confirm that the provider’s contract and deletion processes match the employer’s schedule.

Common Mistakes to Avoid

• Keeping everything for six years: A long period may be justified for certain records, but it is not a universal rule.
• Deleting records as soon as someone leaves: This can breach minimum record-keeping duties or leave the employer unable to respond to a legitimate claim.
• Using vague reasons: “For legal purposes” is not a sufficient retention policy unless the specific need and period are assessed.
• Ignoring backups and third parties: Retention controls should address HR platforms, email archives, contractors, and routine backup cycles.
• Keeping sensitive information without review: Health and identity data require stronger safeguards and a clear need to retain them.

Reliable Sources for Checking Current Rules

Employers can verify requirements through the Information Commissioner’s Office (ICO) UK GDPR guidance, HMRC guidance on keeping employee records, Home Office right-to-work guidance, and The Pensions Regulator’s employer guidance. The Health and Safety Executive also provides information on RIDDOR reporting and records.

Because retention duties can vary by record, claim, and UK jurisdiction, a schedule should be checked against current official guidance and reviewed when laws, systems, or business practices change. The practical standard is consistent: keep what is needed, protect it appropriately, and delete it when the reason for keeping it has ended.