Why a clear HR document retention policy matters
A written retention policy is important because it turns processes of varying complexity into simple, everyday rules for HR teams. It reduces the chance of keeping personal data longer than necessary, helps you respond faster to audits and subject access requests, and gives you a defensible position if a dispute arises years after someone has left.
For most employers, the baseline is to keep employment‑related records long enough to meet specific legal duties and to defend potential claims. That’s why you’ll often see a six‑year retention period used for ex‑employee records – it mirrors the limitation period for most contractual claims in England and Wales (five years in Scotland). But many HR documents have their statutory timeframes, which is where a clear schedule becomes important.
Step‑by‑step: set up retention that works in real life
The first thing to consider is whether storing records off-site would be safer and more secure. The reality is that outsourcing to a specialist, such as an information management partner, is almost always safer and more compliant.
1) Audit what you hold and where it lives. Map personnel files across shared drives, HRIS/ATS, email and offsite boxes. Note who can access which records and the legal basis for keeping them.
2) Group documents into sensible categories. For example: core employment, pay and benefits, working time, family leave and sickness, recruitment, health & safety, employee relations and leavers. This reduces ambiguity when teams file or retrieve information.
3) Assign retention and disposal rules. For each category, define the trigger (end of tax year, termination date), the period (statutory or policy‑based), and the disposal action (confidential destruction, verified deletion or anonymisation). Record exceptions such as legal holds.
4) Build the controls. Configure retention in your HR systems, set access controls, and create simple job aids so managers know where to save and how to request retrieval or destruction.
5) Review and monitor. Revisit annually or after legal changes, mergers, or system upgrades. Track metrics like overdue disposals and DSAR turnaround, and tighten the process where needed.
Document management for HR & personnel records
Document management can help you keep track of and manage all of your HR records. You must retain HR & Personnel files in line with the outlined statutory retention periods. If you are unsure about how long to keep HR documents, this guide provides clarity, but having the right systems in place is equally important.
At Restore Information Management, we provide an end-to-end document management service designed to take the stress out of HR record-keeping. From secure off-site storage in our purpose-built facilities to document scanning for easy online access, your records will remain both accessible and compliant. Our document management systems allow you to apply retention schedules automatically, track document lifecycles, and ensure safe disposal once records reach the end of their statutory period.
Learn more about document scanningBy combining security, compliance, and efficiency, we help HR teams reduce risk while freeing up time and space to focus on people, not paperwork.
How long do employers keep records of past employees?
Statutory retention periods
The table below summarises the main legislation regulating statutory retention periods. If employers are in doubt, it is a good idea to keep records for at least 6 years (5 in Scotland), to cover the time limit for bringing any civil legal action.
| Record | Statutory Retention Period | Statutory Authority |
|---|---|---|
| Accident books, accident records/reports | 3 years from the date of the last entry (or, if the accident involves a child/young adult, then until that person reaches the age of 21) | The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 (RIDDOR)(SI 1995/3163) as amended, and the Limitation Act 1980. Special rules apply concerning incidents involving hazardous substances. |
| Accounting records | 3 years for private companies, 6 years for public limited companies | Section 221 of the Companies Act 1985, as modified by the Companies Acts 1989 and 2006 |
| Income tax and NI returns, income tax records and correspondence with HMRC | Not less than 3 years after the end of the financial year to which they relate | The Income Tax (Employments) Regulations 1993 (SI 1993/744) as amended, for example, by The Income Tax (Employments (Amendment No. 6) Regulations 1996 (SI 1996/2631) |
| Medical records and details of biological tests under the Control of Lead at Work Regulations | 40 years from the date of the last entry | The Control of Lead at Work Regulations 1998 (SI 1998/543) as amended by the Control of Lead at Work Regulations 2002 (SI 2002/2676) |
| Medical records as specified by the Control of Substances Hazardous to Health Regulations (COSHH) | 40 years from the date of the last entry | The Control of Substances Hazardous to Health Regulations 1999 and 2002 (COSHH) (SIS 1999/437 and 2002/2677) |
| Medical records under the Control of Asbestos at Work Regulations. Medical records containing details of employees exposed to asbestos. Medical examination certificates | 40 years from the date of the last entry, 4 years from the date of issue | The Control of Asbestos at Work Regulations 2002 (SI 2002/2675). Also see the Control of Asbestos Regulations 2012 (SI 2012/632) |
| Medical records under the Ionising Radiations Regulations 1999 | Until the person reaches 75 years of age, but in any event for at least 50 years | The Ionising Radiations Regulations 1999 (SI 1999/3232) |
| Records of tests and examinations of control systems and protective equipment under the Control of Substances Hazardous to Health Regulations (COSHH) | 5 years from the date on which the tests were carried out | The Control of Substances Hazardous to Health Regulations 1999 and 2002 (COSHH) (SIS 1999/437 and 2002/2677) |
| Records relating to children and young adults | Until the child/young adult reaches the age of 21 | Limitation Act 1980 |
| Retirement Benefits Schemes – records of notifiable events, for example, relating to incapacity | 6 years from the end of the scheme year in which the event took place | The Retirement Benefits Schemes (Information Powers) Regulations 1995 (SI 1995/3103) |
| Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence | 3 years after the end of the tax year in which the maternity period ends | The Statutory Maternity Pay (General) Regulations 1986 (SI 1986/1960) as amended |
| Wage/salary records (also overtime, bonuses, expenses) | 6 years | Taxes Management Act 1970 |
| National minimum wage records | 3 years after the end of the pay reference period following the one that the records cover | National Minimum Wage Act 1998 |
| Records relating to working time | 2 years from date on which they were made | The Working Time Regulations 1998 (SI 1998/1833) |
Recommended (non-statutory) Retention Periods
For many types of personnel records, there is no definitive retention period: it is up to the employer to decide how long to keep these records. Organisations make widely differing decisions regarding the retention periods to adopt. An employer needs to consider what would be a necessary retention period for them, depending on the type of record. The advice in this factsheet is based on the time limits for potential tribunal or civil claims; it is often a question of judgement rather than there being any definitive right and wrong.
Where the recommended retention period given is six years, this is based on the six‑year time limit within which legal proceedings must be commenced as laid down under the Limitation Act of 1980. Thus, where documents may be relevant to a contractual claim, it is recommended that these be retained for at least the corresponding six‑year limitation period.
| Record | Recommended Retention Period |
|---|---|
| Actuarial valuation reports | Permanently – Gov.uk |
| Application forms and interview notes (for unsuccessful candidates) | 6 months to a year. (Because of the time limits in the various discrimination Acts, minimum retention periods for records relating to advertising of vacancies and job applications should be at least 6 months. A year may be more advisable as the time limits for bringing claims can be extended. Successful job applicants’ documents will be transferred to the personnel file in any event.) |
| Assessments under health and safety regulations and records of consultations with safety representatives and committess | Permanently – Gov.uk |
| Inland Revenue/HMRC approvals | Permanently – Gov.uk |
| Money purchase details | 6 years after the transfer or value taken |
| Parental leave | 5 years from birth/adoption of the child or 18 years if the child receives a disability allowance |
| Pension scheme investment policies | 12 years from the ending of any benefit payable under the policy |
| Pensioners’ records | 12 years after the benefit ceases |
| Personnel files and training records (including disciplinary records and working time records) | 6 years after employment ceases |
| Redundancy details, calculations of payments, refunds, notification to the Secretary of State | 6 years from the date of redundancy |
| Senior executives’ records (that is, those on a senior management team or their equivalents) | Permanently for historical purposes |
| Statutory Sick Pay records, calculations, certificates, self-certificates | The Statutory Sick Pay (Maintenance of Records) (Revocation) Regulations 2014 (SI 2014/55) abolished the former obligation on employers to keep these records. Although there is no longer a specific statutory retention period, employers still have to keep sickness records to best suit their business needs. It is advisable to keep records for at least 3 months after the end of the period of sick leave in case of a disability discrimination claim. However, if there were to be a contractual claim for breach of an employment contract, it may be safer to keep records for 6 years after the employment ceases. |
| Time cards | 2 years after the audit |
| Trade union agreements | 10 years after ceasing to be effective |
| Trust deeds and rules | Permanently |
| Trustees’ minute books | Permanently |
| Works council minutes | Permanently |
Secure storage and disposal: paper and digital
Good housekeeping covers how you store records and how you get rid of them. Keep paper HR files in a locked, access‑controlled space and note who’s taken what and when. Many teams, like Restore Information Management, use an off-site storage service that barcodes boxes and files, so desks and cupboards stay clear and everything is easy to find.
For digital records, set simple retention rules in your HR systems and switch on protections like access controls, encryption and multi‑factor authentication (MFA). When the time is up, arrange confidential shredding for paper and verified deletion for digital copies and, where possible, backups. If you still need information for trends or reporting, anonymise it so no one can be identified.
If you expect a dispute, grievance or investigation, pause any deletion with a clear legal hold. Write down what’s covered and for how long, share it with HR, IT and any suppliers, then restart normal deletion once the hold ends.
Learn more about off site storageGDPR Rights & Pitfalls
Data subject access (SARs)
If a current or former employee asks to see their data, search the places you’d reasonably expect it to be – the personnel file, email, collaboration tools and archives – and reply within the legal time limit. Check their ID if needed, narrow the scope if the request is very broad, and keep a simple note of what you searched and shared, any exemptions you used and how you sent the information securely.
The “right to be forgotten” (erasure)
The right to erasure isn’t absolute. Your retention schedule should make clear when you must keep data (to meet legal duties or to defend a claim) and when you can delete it. Use the schedule to explain decisions and to avoid deleting something you still need.
Handling requests and exceptions (legal holds)
Have a short playbook: acknowledge the request and assign an owner (usually HR with the DPO/Information Governance), pause routine deletion if a dispute or investigation is likely, and send a plain‑English legal hold notice to HR, IT and any processors. Mention which systems and dates are in scope, keep an audit trail of actions, and lift the hold when the matter ends so normal retention and disposal can resume. Two common pitfalls to avoid: deleting data after receiving a SAR, and letting unofficial copies linger in personal drives or inboxes.
How Restore Information Management can help
If you’re ready to simplify HR document retention across paper and digital, our specialists can help you put best practices into action:
- Secure document storage with barcode tracking, controlled retrieval and certified destruction when the retention period ends.
- Document scanning and digitisation to convert legacy paper files into indexed, searchable records.
- Document management solutions that apply retention automatically and provide a complete audit trail.
Prefer a quick sense‑check of your current schedule? Share the types of HR records you hold and we’ll map them to the statutory retention periods of HR documents in the UK and recommended timelines, then help you implement the controls to keep everything compliant.
Get a quote with Restore Information Management for any of your document requirements, secure storage or document scanning – we’re here to help!
This article provides general guidance. Always consider the specifics of your organisation, industry regulation and legal advice when setting retention periods.