An employee leaves and somebody labels the whole personnel folder ‘delete in six years’. That looks tidy, but it is not a reliable retention decision. Payroll data, right-to-work evidence, annual-leave records, health information and an old disciplinary warning can have different purposes, legal requirements and risk levels. The practical answer is not to keep everything forever or delete everything together. It is to give each record category a justified period, an owner and a review or deletion action.
There is no universal retention period for an employee file
The UK GDPR storage-limitation principle says personal data must not be kept for longer than necessary for the purpose for which it is processed. The Information Commissioner's Office says organisations should be able to justify their periods, document standard periods where possible, review information regularly and erase or anonymise it when it is no longer needed. The UK GDPR does not set one time limit for every type of employee information.
That means ‘six years after employment ends’ is not a rule for the complete HR file. A period relevant to one statutory record does not automatically justify keeping every application, expired warning, medical attachment and manager's note for the same time.
Start with the purpose. Ask what obligation, employment decision or defensible business need the record supports; when that need ends; whether a law fixes a minimum period; and whether the same purpose can be met with less information. Record the answer in a retention schedule rather than relying on individual managers to remember it.
ICO: storage limitation ↗ · Related guide: employee subject access requests →
Some employment records have specific minimum periods
A retention schedule should identify the legal trigger and calculate the date correctly. PAYE records covering pay, deductions, HMRC reports and payments, leave, sickness, tax codes and taxable benefits must generally be kept for three years from the end of the tax year to which they relate. That is different from the minimum-wage regime: records proving minimum-wage compliance must generally be retained for at least six years, starting from the end of the pay reference period after the one they cover.
Since 6 April 2026, employers in Great Britain must keep adequate annual-leave and holiday-pay compliance records for six years from the date each record was made. Right-to-work check evidence has another trigger: official Home Office material describes retention for the whole period of employment plus two years. Do not convert those separate rules into one blanket date for the complete personnel file.
One document can support several obligations. A timesheet may evidence payroll, minimum-wage and holiday calculations. Apply the longest justified live period, record each reason and review or securely delete the document when those reasons expire.
GOV.UK: PAYE records ↗ · GOV.UK: minimum-wage records ↗ · Employment Rights Act 2025: annual-leave records ↗ · Related guide: holiday-pay records → · Related guide: right-to-work checks →
Do not treat sensitive records like ordinary correspondence
Health information, disability details, occupational-health reports and some equality-monitoring data need tighter access because they may be special-category data. Store only what the employment purpose requires, limit access to people who genuinely need it and avoid leaving detailed medical material in a general manager folder. Often the operational record needs the restriction, adjustment or review date—not a copy of every clinical detail.
Disciplinary, grievance and investigation material also needs judgment. Keep an accurate, proportionate record of the allegation, evidence, decision and outcome. An expired warning should not influence decisions as though it were active. Any longer retention needs a separate, documented reason.
Give recruitment information its own rule. Necessary onboarding records for the successful candidate may transfer into the employment file, but unsuccessful applications, interview notes, equality data and identity evidence should not follow that employee's schedule.
Build a retention schedule managers can actually use
List record categories in plain language: recruitment, contract and changes, time and attendance, pay and deductions, holiday, performance, disciplinary and grievance, health and adjustments, family leave, right-to-work checks, training, termination and references. For each category, name the system of record, purpose, lawful basis, minimum legal period where one applies, business retention period, trigger date, access group and final action.
Use event-based triggers rather than vague labels. ‘Three years from the end of the relevant tax year’, ‘six years from the date made’ and ‘employment plus two years’ produce different deletion dates. A leaver workflow should start the post-employment clock, but statutory dates tied to tax years, pay periods or creation dates must remain intact.
Apply the schedule across email, shared drives, HR software, payroll, paper files and suppliers. Deleting the HR-system entry while retaining exports and inbox attachments does not complete the action. Address backups or put information beyond use, and agree what providers must do when their purpose ends.
Turn scattered files into a usable retention schedule.
HR + SAFETY can help North East SMEs map employee records, distinguish statutory periods from business choices and define practical review and deletion triggers.
Discuss an HR records reviewEmployee record-retention checklist
Legal requirements and official guidance were checked on 7 October 2026. The schedule is a control, not a table copied from another organisation. A North East manufacturer with shift and minimum-wage evidence, for example, will hold a different record set from a small professional practice. Both should be able to explain why each category is still held and what will happen when that reason ends.
- Inventory employee information across HR, payroll, email, shared drives, paper and suppliers.
- Separate record categories rather than assigning one date to the complete personnel file.
- Write the purpose and legal basis for each category.
- Record any statutory minimum and the event that starts the period.
- Set a justified business period where legislation does not supply one.
- Restrict health, equality and investigation material to genuine need-to-know access.
- Remove duplicate, trivial and out-of-date working notes when they are no longer needed.
- Link leaver, warning-expiry and recruitment-close workflows to review dates.
- Cover backups, exports, inboxes and processors—not only the main HR system.
- Log deletion or anonymisation and review the schedule when law, systems or purposes change.
Do not give the whole employee file one deletion date. Map each record to its purpose, statutory minimum, evidence need and risk; calculate the correct trigger; restrict sensitive material; and make review or secure deletion part of ordinary HR workflows.
This guide provides general information for UK employers. It is not legal advice and should not replace advice based on the facts of a specific matter.