Why Retention Schedules Matter: Keeping Personnel Records for the Right Length of Time
Every business stores vast amounts of personal information. From recruitment records and contracts of employment to sickness records, payroll data and disciplinary documentation, all of which is gained throughout the employment lifecycle.
However, one of the most common compliance risks facing employers is keeping records for too long.
Retention schedules help organisations strike the right balance between meeting legal obligations and complying with data protection requirements. It ensures that records are retained for legitimate business purposes, while reducing the risk associated with excessive data storage.
What is a Retention Schedule?
A retention schedule is a documented framework that sets out:
• What records an organisation holds
• Why they are retained
• How long they should be kept
• When they should be securely destroyed
This provides consistency, helps demonstrate compliance and reduces the likelihood of retaining personal data indefinitely.
UK GDPR And The Data Protection Act 2018
Under UK GDPR, you must only keep personal data for as long as you need it for the original purpose you collected it. This is the “storage limitation” principle. You should set out your approach in your privacy documentation and a retention schedule and ensure secure deletion when the period ends. If you’re collecting employee data, having an up-to-date Privacy Policy and retention processes is essential.
Why Personnel Records Should Not Be Kept Indefinitely
Many organisations adopt a “just in case” approach to record retention. While understandable, this creates several risks:
Data Protection Risks
The more personal data retained, the greater the potential impact of a data breach.
Retaining unnecessary information increases organisational risk without providing any real benefit.
Subject Access Requests Become More Burdensome
Employees and former employees have the right to request copies of their personal data.
Holding excessive historical information means businesses may have significantly more data to review, redact and disclose during a Subject Access Request (SAR).
Regulatory Scrutiny
The ICO expects organisations to have clear retention policies and to be able to explain their retention decisions. An inability to justify why records are still held years after they ceased being required could be difficult to defend during an investigation.
Understanding Different Retention Requirements
One of the challenges for businesses is that there is no single retention period for all personnel records.
Different laws require records to be kept for different lengths of time.
In practice, many employers choose to retain core personnel and disciplinary records for up to six years after employment ends to cover potential contractual claims.
Employment And Civil Limitation Periods
• Employment tribunal time limits are short (often three months less one day – remember this will change in October 2026 to six months under ERA 2025) but claims such as discrimination can be brought up to six months, and delays can be extended by ACAS early conciliation.
• Civil claims (for example, breach of contract) are generally six years under the Limitation Act 1980.
• Personal injury claims are generally three years from the date of injury or date of knowledge.
HMRC and Payroll And Pension Rules
• HMRC requires you to keep PAYE records for three years after the end of the tax year they relate to (many businesses keep them for six years to mirror general tax record practices).
• Statutory Sick Pay (SSP), Statutory Maternity/Paternity/Adoption Pay records should generally be kept for at least three years after the end of the relevant tax year.
• Auto-enrolment pension records must be kept for prescribed periods – commonly six years for most records, and four years for opt-out notices (per The Pensions Regulator’s guidance).
Working Time and National Minimum Wage Records
• Working Time Regulations records (e.g. hours worked, night work assessments, opt-outs, working time monitoring reports) must be kept for two years from the date they were created.
• National Minimum Wage records must typically be kept for three years after the end of the pay reference period.
Health & Safety, Medical and Insurance Records
• Accident book entries should be kept for at least three years (longer if there’s a risk of litigation).
• Where employees are exposed to hazardous substances, some medical surveillance and exposure records must be kept much longer – often 40 years (e.g. under COSHH and asbestos regulations).
• Employers’ liability insurance certificates are often retained for up to 40 years as a matter of best practice to evidence cover for long-tail injury claims.
The above depends on industry and risks, so seek further advice for hazardous work environments.
Breakdown of documents and retention guidance.
1) Recruitment And Right To Work
• CVs/Applications (unsuccessful): 6–12 months after decision. Time to defend discrimination claims but avoids keeping data unnecessarily.
• Interview Notes (unsuccessful): 6–12 months after decision.
• Right To Work Checks (successful hires): Throughout employment and two years after it ends (Home Office guidance).
• DBS checks: you shouldn’t keep a copy of the actual certificate; however, you are able to keep a record of certain non-sensitive information such as the certificate number and date. Keep as long as necessary but not usually more than 6 months. There is further guidance Handling of DBS certificate information – GOV.UK
2) Core Personnel Files
• Employment Contracts and Variations: Up to six years after employment ends (to cover breach of contract claims). If you’re updating terms during employment, ensure your Employment Contract clearly explains what you’ll retain and why.
• Contact Details, Next Of Kin: Delete when no longer necessary after employment ends, unless needed for a short period in case of outstanding matters.
• Performance Reviews, Appraisals: Typically, six years after employment ends.
• Disciplinary/Grievance Records: Generally, six years after employment ends. Follow any stated “spent” periods for warnings, but keep a minimal record of outcomes.
At the point you review the destruction of documents, check there are no outstanding safeguarding concerns, discrimination concerns, grievance or disciplinary. Check for anything which could mean that you would need to present documentation for legal purposes.
3) Pay, Leave and Benefits
• Payroll/PAYE: At least three years after the end of the tax year (many employers standardise on six years).
• SSP, SMP, SPP, SAP Records: Three years after the end of the tax year to which they relate.
• Holiday/Working Time Records: Two years under the Working Time Regulations.
• Auto-Enrolment Pension Records: Six years (and four years for opt-out notices).
• Expense Claims: Six years (to align with tax/audit needs).
4) Health, Safety and Medical
• Accident Reports/RIDDOR: At least three years (consider longer if there are outstanding matters)
• Occupational Health Reports: Retain only as long as necessary for the employment purpose and potential claims, then delete securely. If exposure-related, follow the longer regulatory period.
5) Training, Licences and Compliance
• Training Records (e.g. H&S, safeguarding, driving): Six years after employment ends (or longer if specific regulation requires).
• Professional Licences/Certificates: Throughout employment and for a short period after departure if needed for handover or audit trails.
6) IT, Security and Access
• System Access Logs: Short, defined period (e.g. 3–12 months) unless needed for incident investigation. Reduce scope via minimisation.
• ID Badges, Access Tokens: Revoke immediately on exit; destroy any personal copies promptly.
7) References and Exit Documents
• Resignation/Exit Interview Notes: Six years to align with general contractual claims.
• Settlement Agreements: Six years from the date of the agreement (or longer if terms require).
• References Given: Keep a copy for up to two years to evidence what was said.
