How long should I keep staff records under GDPR?

In 2024, the UK is looking to introduce new data protection legislation. The goal is to make sure it follows General Data Protection Regulation (GDPR) standards since the UK's compliance status will be reviewed in 2025.

So, there is no time like the present to review data protection regulations for your business, to make sure you are in line with the law.

The data protection rules

Under current law, you must make sure that all personal data is kept secure, correct and up to date.

When you gather personal data, you must tell the individual who you are and how you plan to use their information, including if it’ll be shared with other companies.

You must also tell them of their right to access their information and request a change if it's wrong, be removed or not used for certain purposes.

One of the most common questions about personal data in the workplace is how long you need to keep staff records. The answer to this will depend on whose data you’re keeping and how long you’ve stored it for already.

So, let’s find out how long you should keep records for current staff, former staff, and job applicants.

How long should you keep current staff data?

GDPR doesn’t set out any minimum or maximum time limits for keeping staff data. But it does say that you shouldn’t keep personal data for longer than you need to.

The length of time you’ll keep data will depend on the reason why you collected it. For example, if you collect an employee’s contact number to use in case of an emergency, it’s not necessary to keep this once the employee leaves.

You must decide how long it’s necessary to hold data. That said, there are legal requirements for you to follow.

Here are a few:

• Working time records: Keep for 2 years from the date the records refer to.
• Payroll records: Keep for 3 years from the end of the tax year that they relate to.
• Maternity, Paternity or Shared Parental Pay records: Keep for 3 years after the end of the tax year that the payment stopped.

How long should you keep former staff data?

After an employee leaves, you shouldn’t bin their records right away. You might need them to defend yourself against a tribunal or court claim.

Generally, an employee can make a claim, to an employment tribunal within three months of their employment ending. But depending on the claim, the limit can be six months or longer.

If an employee claims that you’ve breached their contract, they might take you to the civil courts. They can do this within six years of the alleged breach.

As a result, you should keep personal data, performance appraisals and employment contracts for six years after an employee leaves.

Don’t forget, a former employee—or anyone you hold data on—might issue you with a Subject Access Request (SAR) to see what data you have on them.

How long should you keep job applicant data?

You collect a lot of information from job applicants including CVs, cover letters and interview notes.

You should hold onto this data for 6 months even if the applicant is unsuccessful, as they could log a discrimination claim against you within this time.

Want to keep CVs on file for the future? To be GDPR compliant, you’ll need to get consent from applicants and make sure their information is up to date. To follow our 12 steps for GDPR compliance, head to our GDPR info centre.

Manage staff records easily with BrightHR

You probably don’t want dusty filing cabinets cluttering your workplace. And you won’t need any with BrightHR.

BrightHR has unlimited HR document storage space, so you can keep all your staff files in one place—for as long as you like.

That’s not all. Your staff can access their personal information and update it. And if they ask you to remove some of their data, you can reassure them that it’ll be permanent. This is because BrightHR will ‘hard delete’ it.

Request a free demo today to see just how easy BrightHR makes managing your staff records.