Retention of HR records
Revised July 2015
What are HR records?
HR records include a wide range of data relating to individuals working in an organisation, for example, pay or absence levels, hours worked and trade union agreements. This information may be stored in a variety of media such as paper files and, increasingly, on computer databases.
It is important for all organisations to maintain effective systems for storing HR data, both to ensure compliance with all relevant legislation (for example in respect of the minimum wage or working time regulations) as well to support sound personnel administration and broader HR strategy. Our factsheet on human capital has more details of how employee information can help identify the sort of HR or management interventions which will drive business performance.
However, as detailed below, in the UK a complex regulatory regime governs the length of time for which HR records should be stored.
The legal position
Legislation
There is a substantial and complex amount of legislation in the EU and UK that has an impact upon the retention of personnel and other related records in those regions. Examples of legislation dealing with particular categories of records are provided in the boxes below.
Access, storage, format and destruction
The Data Protection Act 1998 (DPA) applies to most personnel records, whether held in paper, microform, or computerised format. Under the DPA data must not be kept any longer than is necessary for a particular purpose.
Both computerised and manual systems can be covered by the law: to be covered, manual systems must be organised into a 'relevant filing system'.
Subject to certain exceptions (as detailed in the DPA), employees have the right to access their records and the employer is under an obligation to ensure that the data is accurate. Before releasing such data to a third party, the employer must seek the permission of the individual concerned.
The Information Commissioner has issued The employment practices code which employers should follow carefully. It is in four parts: * Part 1: Recruitment and selection * Part 2: Employment records * Part 3: Monitoring at work * Part 4: Information about workers health.
The code, together with additional guidance notes, is available on the Information Commissioner’s website (see Useful contacts). * See more on data protection generally in our factsheet
In addition to the DPA rules, under court or tribunal procedure rules, certain documents such as employment contracts, accident record books and other personnel records may be needed in a legal action. If so the originals must be made available if possible, or the employer must explain what happened to the original documents backed up by what is known as a 'statement of truth'.
When employers really no longer need to keep certain data, destruction must take place securely and effectively, for example by shredding.
CIPD members can find out more on the legal aspects of data protection, including the difference between keeping records and being able to act on them, in our Data protection, surveillance and privacy at work law FAQs.
Other special provisions
Further special provisions may arise affecting the retention of or access to data, for example: * In the context of criminal law, the Anti Terrorism, Crime and Security Act 2001 Part 11 provides a lengthy Code of Practice for voluntary retention of communications data. * To provide security services with a reliable log of mobile and fixed phone calls, telecommunication companies must keep telephone call logs for one year. Internet service providers must retain communications data (including internet access, email and telephone calls - mobile and landline) for one year. * The UK Borders Act 2007 and the Immigration, Asylum and Nationality Act 2006 may enable access to personnel records in certain circumstances relating to immigration checks.
How this checklist of retention periods is organised
The checklist below is divided into two parts: * Records where there are statutory retention periods, with the statutory authorities. * Records where there are no statutory retention periods, with recommended retention periods.
Statutory retention periods
The table below summarises the main UK legislation regulating statutory retention periods. If employers are in doubt, it's a good idea to keep records for at least 6 years (5 in Scotland), to cover the time limit for bringing any civil legal action. Record | Statutory retention period | Statutory authority | accident books, accident records/reports | 3 years from the date of the last entry (or, if the accident involves a child/ young adult, then until that person reaches the age of 21). (See below for accidents involving chemicals or asbestos) | The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 (RIDDOR)
(SI 1995/3163) as amended, and Limitation Act 1980. Special rules apply concerning incidents involving hazardous substances (see below). | accounting records | 3 years for private companies, 6 years for public limited companies | Section 221 of the Companies Act 1985 as modified by the Companies Acts 1989 and 2006 | income tax and NI returns, income tax records and correspondence with HMRC | not less than 3 years after the end of the financial year to which they relate | The Income Tax (Employments) Regulations 1993
(SI 1993/744) as amended, for example by The Income Tax (Employments) (Amendment No. 6) Regulations 1996 (SI 1996/2631) | medical records and details of biological tests under the Control of Lead at Work Regulations | 40 years from the date of the last entry | The Control of Lead at Work Regulations 1998
(SI 1998/543) as amended by the Control of Lead at Work Regulations 2002 (SI 2002/2676) | medical records as specified by the Control of Substances Hazardous to Health Regulations (COSHH) | 40 years from the date of the last entry | The Control of Substances Hazardous to Health Regulations 1999 and 2002 (COSHH) (SIs 1999/437 and 2002/2677) | medical records under the Control of Asbestos at Work Regulations * medical records containing details of employees exposed to asbestos * medical examination certificates | * 40 years from the date of the last entry * 4 years from the date of issue | The Control of Asbestos at Work Regulations 2002 (SI 2002/ 2675). Also see the Control of Asbestos Regulations 2006 (SI 2006/2739) and the Control of Asbestos Regulations 2012 (SI 2012/632) | medical records under the Ionising Radiations Regulations 1999 | until the person reaches 75 years of age, but in any event for at least 50 years | The Ionising Radiations Regulations 1999
(SI 1999/3232) | records of tests and examinations of control systems and protective equipment under the Control of Substances Hazardous to Health Regulations (COSHH) | 5 years from the date on which the tests were carried out | The Control of Substances Hazardous to Health Regulations 1999 and 2002 (COSHH) (SIs 1999/437 and 2002/2677) | records relating to children and young adults | until the child/young adult reaches the age of 21 | Limitation Act 1980 | Retirement Benefits Schemes – records of notifiable events, for example, relating to incapacity | 6 years from the end of the scheme year in which the event took place | The Retirement Benefits Schemes (Information Powers) Regulations 1995
(SI 1995/3103) | Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence | 3 years after the end of the tax year in which the maternity period ends | The Statutory Maternity Pay (General) Regulations 1986
(SI 1986/1960) as amended | wage/salary records (also overtime, bonuses, expenses) | 6 years | Taxes Management Act 1970 | national minimum wage records | 3 years after the end of the pay reference period following the one that the records cover | National Minimum Wage Act 1998 | records relating to working time | 2 years from date on which they were made | The Working Time Regulations 1998 (SI 1998/1833) |
Recommended (non-statutory) retention periods
For many types of HR records, there is no definitive retention period: it is up to the employer to decide how long to keep them. Different organisations make widely differing decisions about the retention periods to adopt. An employer must consider what would be a necessary retention period for them, depending on the type of record. The advice in this factsheet is based on the time limits for potential tribunal or civil claims, which is often a question of judgement rather than there being any definitive right and wrong. For example, some records managers in public sector organisations recommend keeping an employee’s records until they reach the age of 100, especially for pension purposes.

Where the recommended retention period is 6 years, this is based on the 6-year time limit within which legal proceedings must be commenced under the Limitation Act 1980. So where documents may be relevant to a contractual claim, it’s recommended that these are kept for at least the corresponding 6-year limitation period. Record | Recommended retention period | actuarial valuation reports | permanently | application forms and interview notes (for unsuccessful candidates) | 6 months to a year. (Because of the time limits in the various discrimination Acts, minimum retention periods for records relating to advertising of vacancies and job applications should be at least 6 months. A year may be more advisable as the time limits for bringing claims can be extended. Successful job applicants documents will be transferred to the personnel file in any event. | assessments under health and safety regulations and records of consultations with safety representatives and committees | permanently | Inland Revenue/HMRC approvals | permanently | money purchase details | 6 years after transfer or value taken | parental leave | 5 years from birth/adoption of the child or 18 years if the child receives a disability allowance | pension scheme investment policies | 12 years from the ending of any benefit payable under the policy | pensioners' records | 12 years after benefit ceases | personnel files and training records (including disciplinary records and working time records) | 6 years after employment ceases | redundancy details, calculations of payments, refunds, notification to the Secretary of State | 6 years from the date of redundancy | senior executives' records (that is, those on a senior management team or their equivalents) | permanently for historical purposes | Statutory Sick Pay records, calculations, certificates, self-certificates | The Statutory Sick Pay (Maintenance of Records) (Revocation) Regulations 2014 (SI 2014/55) abolished the former obligation on employers to keep these records. Although there is no longer a specific statutory retention period, employers still have to keep sickness records to best suit their business needs. It is advisable to keep records for at least 3 months after the end of the period of sick leave in case of a disability discrimination claim. However if there were to be a contractual claim for breach of an employment contract it may be safer to keep records for 6 years after the employment ceases. | time cards | 2 years after audit | trade union agreements | 10 years after ceasing to be effective | trust deeds and rules | permanently | trustees' minute books | permanently | works council minutes | permanently |
CIPD viewpoint
Retention of people records is an extremely complex and constantly changing area. Organisations following good practice should have a document retention policy and monitoring programme that’s communicated to all staff and they should adopt both physical and electronic data security methods. The policy should ensure that records are kept as long as needed but no longer, and that records are destroyed securely. Such programmes may involve training not only about the legal issues involved, but also why having organised records benefits the business.
Useful contacts * GOV.UK - Data protection and your business * Information Commissioner: Employment * HM Revenue and Customs: Starting the tax year
Further reading
Books and reports

ACAS. (2009) Personnel data and record keeping. Advisory Booklet. London: Acas. Available at http://www.acas.org.uk/index.aspx?articleid=717
INCOMES DATA SERVICES. (2011) HR technology. HR studies. London: IDS.

Journal articles
ALMOND, J. (2015) Data subject access: fishing for a settlement. Tolley's Employment Law Newsletter. Vol 20, No 7, May. pp51-53.
HARKER, S. and TOSTIVIN, M. (2011) Handle with care. Tolley's Employment Law Newsletter. Vol 17, No 3, September. pp19-21.
HARTLEY, A. (2013) Protecting confidential information in the digital workplace. Employers' Law. February. pp14-15

This factsheet was last updated by Lisa Ayling, solicitor and employment law specialist. However, while every care has been taken in compiling the information, the CIPD cannot be held responsible for any errors or omissions and the information is not intended as a substitute for specific legal advice