How long to keep employee records — and what UK GDPR requires

The statutory retention periods

Different records answer to different regulators, so they carry different periods. These are the ones that are actually fixed by law rather than by convention.

The gap between the first two rows is the one worth internalising. Deleting payroll data on a three-year cycle looks tidy and quietly destroys the evidence you would need for a minimum wage enquiry three years later.

Why NMW records run to six years

National Minimum Wage records exist to prove one thing: that a worker was paid at least the minimum for the time they actually worked. The retention period was extended from three years to six for pay reference periods beginning on or after 1 April 2021, which means the records you are keeping today have to outlive two full cycles of most payroll retention policies.

There is no prescribed format — you can keep them however you like, provided they demonstrate the point. What they have to capture is hours as well as pay, because minimum wage compliance is a rate, and a rate needs both halves. That is why unpaid working time is the usual cause of an unintentional breach: time spent on security checks, handovers or opening up counts as working time even when nobody recorded it. Our National Minimum Wage guide covers where those hours hide, and the free minimum wage checker works out the effective rate once they are counted.

Working time and holiday records

The Working Time Regulations expect adequate records showing the limits are being complied with — the 48-hour weekly average, any signed opt-outs, and the position on night work. There is no prescribed form, but "adequate" means something a third party could actually read and follow. See UK rota laws for what the limits are.

Holiday records now carry an explicit duty of their own. Since 6 April 2026, the Working Time Regulations as amended by the Employment Rights Act 2025 require records adequate to show holiday entitlement and holiday pay have been complied with, retained for six years from the date each record was made. The format is left to you, which is the same latitude the minimum wage rules give — and the same trap, because "any format" still has to be a format someone can produce on request.

There is a second reason to take them seriously: the balance you owe on the day someone leaves is built from them. Where entitlement accrues at 12.07% of hours worked, the leaving figure is only as good as the hours record behind it — which is the substance of most disputes about final pay.

UK GDPR: storage limitation in practice

Outside the statutory minimums, UK GDPR sets the rule: personal data must not be kept for longer than is necessary for the purpose it was collected for. That is a judgement, not a number, which is exactly why the ICO expects you to have made it in advance and written it down.

• Write a retention schedule — record type, period, and the reason for it. A schedule nobody has read is still better than no schedule; one that is actually applied is the goal.
• Separate the statutory from the discretionary — the six-year NMW record and last year's interview notes do not belong on the same clock.
• Treat health data as special category — sickness records, occupational health reports and absence scores need an additional condition and tighter access.
• Restrict access by role — a line manager needs the rota and the absence record, not the bank details or the grievance file.
• Delete on schedule — including the copies in shared drives and inboxes, which is where the forgotten data usually is.

Access requests and where records actually live

A data subject access request gives you roughly a month to produce the personal data you hold about someone. The deadline is rarely the hard part. The hard part is that employment records fragment: contracts in one folder, timesheets in a spreadsheet, sickness notes in an inbox, rota changes in a messaging app, appraisal notes on a manager's laptop.

A DSAR from a departing employee is often the first time anyone discovers how scattered it all is — and it usually arrives alongside a dispute about something else, when the last thing you want is a fortnight of searching. The same fragmentation makes retention impossible to enforce, because you cannot delete on schedule what you cannot find.

Keeping the record in one system fixes both problems at once. Digital HR records hold documents against the employee they belong to with role-based access, clocked and approved hours give you the working time and minimum wage evidence without a separate exercise, and certification tracking holds the right to work evidence with its expiry date attached rather than in a drawer.