There is no single legal period for keeping all employee records. Different laws set different minimums: three years for PAYE records, six years for holiday and minimum wage records, two years for working time records, three years for certain accident records and 40 years for certain health surveillance records.
For everything else, UK data protection law requires you to set a justified period and not keep personal data longer than you need. Keeping too much creates data protection risk. Deleting too early can leave you unable to defend a claim or answer an inspection.
Some employee records have specific minimum retention periods. Your HR data retention schedule should record both the period and the event that starts the clock.
| Record | Minimum retention | Starting point |
|---|---|---|
| PAYE and payroll records, including relevant leave and sickness absence records | 3 years | From the end of the tax year they relate to |
| National minimum wage records | 6 years | From the end of the pay reference period following the one they cover |
| Holiday and annual leave records, including holiday pay | 6 years | From the date the record is made, under rules in force from 6 April 2026 |
| Records demonstrating compliance with working time limits and night work requirements | 2 years | From the date the record is made |
| Accident records required under RIDDOR | 3 years | From the date the record is made |
| Right to work check copies | Length of employment plus 2 years | Keep throughout employment and for 2 years after it ends |
| Auto-enrolment pension records | 6 years; 4 years for opt-out notices | From the relevant event or creation of the record, depending on the record type |
| Health surveillance records under COSHH | 40 years | From the date of the last entry |
These are minimums, not automatic deletion dates. If a claim or inspection is likely, you may need to keep relevant records longer, with a documented justification. Where one record serves several purposes, apply the longest applicable period.
Keep right to work evidence securely alongside a record of when the check was completed. See our article on right to work checks for background; check current Home Office guidance before conducting a check.
Since 6 April 2026, employers have had to keep adequate records of annual leave and holiday pay and hold them for six years from the date they are made.
Your records should cover holiday taken, carry-over, holiday pay and payments in lieu. Payroll alone is sufficient only if it captures all required information. We cover the practical implications in our article on six years of holiday pay records.
There is no single statutory retention period for the general personnel file. Contracts, appraisals, disciplinary documents, absence history and training records need category-specific decisions.
The UK GDPR storage limitation principle requires you to keep personal data only for as long as necessary, as explained in the ICO's employment records guidance. You therefore need a reason for retaining each category and a written schedule, rather than keeping the whole file indefinitely.
Six years after employment ends is a common benchmark for the core personnel file because it reflects the usual contractual claim limitation period in England and Wales. It is not a universal UK legal requirement; Scotland has different prescription rules. Bank details, unnecessary medical information and unsuccessful recruitment records may warrant shorter periods.
For most employment tribunal claims arising from events on or after 1 October 2026, the usual limit is six months less one day, and early conciliation can extend it. Scottish breach-of-contract tribunal claims have a separate change date of 9 November 2026.
Keep key evidence for a justified margin beyond the applicable claim window. Our article on extended employment tribunal time limits explains why leaver processes and deletion rules need review.
How long to keep employee medical records depends on their purpose and any specific statutory duty.
Health information is special category data under the UK GDPR. Store it separately or with equivalent access restrictions, limit who can see it and document the lawful basis and special category condition that permit you to hold it.
There is no fixed universal period for unsuccessful applicants' CVs, interview notes and assessments. Set a defined period, justify it and explain it in your recruitment privacy notice.
A period of only a few weeks will not cover the usual discrimination claim window. For relevant events on or after 1 October 2026, that window is six months less one day, subject to early conciliation.
Many employers choose between six and twelve months. Consider conciliation and the time before a claim reaches you when deciding on a suitable margin. Apply the period consistently and delete records when it expires unless there is a justified reason to preserve them.
Keep disciplinary records for the life of the warning, then review whether continued retention is necessary. Do not automatically treat an expired warning as live in later decisions.
You may still need the underlying investigation or grievance file to defend a claim or demonstrate the process followed. Hold it securely, document the reason for keeping it and restrict access to people who need it.
A retention schedule should identify what you hold, how long you need it and who is responsible for deletion.
Neathouse Partners can help you create a schedule that fits your systems and supports consistent deletion decisions.
Get an HR retention schedule through our HR policies and procedures service.
An employee can ask for a copy of the personal data you hold about them. Records kept beyond their justified period may still fall within the scope of a subject access request, subject to applicable exemptions.
Over-retention can increase the work involved in responding and create questions about why the data was kept. A clear schedule supports both disclosure and deletion decisions. Our GDPR and HR article provides background on workplace data protection.
It depends on the record. PAYE records are three years, holiday and minimum wage records six years, working time compliance records two years and RIDDOR records three years. Other HR data should be kept for a justified period, not indefinitely.
Six years is a common benchmark for the core personnel file in England and Wales, reflecting the usual contractual claim limit. It is not a blanket rule. Check the applicable jurisdiction and delete data you no longer need sooner.
Payroll-related sickness records normally need to be kept for at least three years from the end of the relevant tax year. COSHH health surveillance records must be kept for 40 years from the last entry. Other health information should be kept only for as long as necessary and justified.
There is no fixed universal period. Choose and justify a period, commonly six to twelve months, allowing for the applicable claim and conciliation windows. Explain it in your privacy notice and delete on schedule.
Yes, if continued retention is necessary and justified, for example to defend a potential claim. You must be able to explain why and review the decision rather than retain everything indefinitely.
You may retain the underlying record for a justified purpose, but do not automatically treat an expired warning as live. Restrict access and review whether the record is still needed.
Neathouse Partners' HR and data protection teams can help you create a practical retention schedule, update your privacy notices and review records due for deletion.
Explore our data protection and UK GDPR compliance support or our HR policies and procedures service.
Speak to one of our experts using the enquiry form, or call 0333 041 1094.
Reviewed 8 October 2026. This article is general guidance and not legal advice.