How to Keep UK Employee Records Legally
Affiliate disclosure: This article contains links to third-party software providers. We may earn a commission if you purchase through our links, at no extra cost to you.
Where the Rules Actually Come From
If you have just taken on your first member of staff, or you are reviewing processes that grew up by accident, keeping UK employee records legally can feel like a compliance maze. HMRC, UK GDPR, right to work, statutory leave, working time: the obligations sit in different places and none of them cross-reference each other.
There is no single piece of legislation covering employee record-keeping. The duties come from HMRC’s PAYE rules, the Working Time Regulations, immigration law, pensions law and UK GDPR, and each sets its own retention period. Once you know which rule governs which record, the whole thing becomes a table rather than a maze.
One duty is new. Since 6 April 2026 employers have had to keep records showing compliance with annual leave and holiday pay rules, and keep them for six years, which is longer than almost anything else on this list.
Payroll and PAYE Records
HMRC requires payroll records to be kept for at least three years from the end of the tax year they relate to. Records for 2025/26, the year that ended 5 April 2026, therefore need to survive until at least 5 April 2029.
What that covers: what you paid each employee and the deductions you made, the reports and payments you sent to HMRC, leave and sickness records used to work out statutory pay, tax code notices such as P6 and P9, Payroll Giving documents, starter checklists, and records of expenses and benefits.
HMRC can charge a penalty of up to £3,000 for failing to keep adequate records, and it is one of the easier failures to stumble into if you change payroll software and leave the old data behind. Payroll software that retains payslips, P60s and submissions automatically is the safest route for most small employers, provided you can still get at the data after you switch providers.
Right to Work Records
Every employer must check that an employee has the right to work in the UK before they start. The duty sits in the Immigration, Asylum and Nationality Act 2006, and a correctly conducted check gives you a statutory excuse against a civil penalty if it later turns out the person was not entitled to work.
The stakes rose in February 2024. Civil penalties are now up to £45,000 per illegal worker for a first breach and up to £60,000 for repeat breaches.
There are three routes to a compliant check, and which one applies depends on the person:
- A manual check of original documents, carried out in the presence of the holder, with a clear dated copy retained
- An online check using the Home Office service, which is the required route for anyone whose status is held digitally, and where you keep the check profile rather than copies of documents
- A digital identity check through a certified identity service provider, available for British and Irish citizens with valid passports
Retention: keep the evidence for the duration of employment plus two years after it ends. After that, destroy it securely. Holding passport scans indefinitely because they might be useful is exactly the habit that turns a compliance measure into a data protection problem.
The Home Office updates its acceptable document lists and check procedures periodically, so treat the GOV.UK guidance as the live version rather than relying on a process you documented three years ago.
Working Time Records, and the New Holiday Duty
Under the Working Time Regulations 1998 you must keep adequate records showing compliance with the 48-hour average weekly limit, including signed opt-out agreements, and with night worker health assessments. Those records must be kept for two years. Opt-out agreements should be retained for as long as they are in force.
Since 6 April 2026 there is a second, more demanding duty. Employers must keep adequate records of annual leave and holiday pay, retained for six years, showing that:
- Workers were told about and given the opportunity to take their 5.6 weeks of statutory leave
- They were paid correctly for it, including irregular hours and part-year workers
- They were paid correctly for accrued but untaken leave on termination, including anything carried over
For anyone employing casual, seasonal or term-time staff, this is the change to act on. Holiday accrual for irregular hours and part-year workers runs at 12.07% of hours worked per pay period for leave years beginning on or after 1 April 2024, and the new duty means you now need to be able to evidence that you got it right, six years after the fact.
Statutory Leave and Pay Records
For statutory leave you need the dates, the payments made, and the notices and evidence the employee gave you, such as a MATB1 for maternity leave.
The list of statutory leave types is longer than it was. Alongside maternity, paternity, adoption, shared parental and parental bereavement leave, there is carer’s leave, introduced in April 2024, and neonatal care leave and pay, introduced in April 2025. Paternity leave and unpaid parental leave became day-one rights in April 2026, and statutory sick pay became payable from the first day of absence in the same month, with the waiting days and the lower earnings limit test both removed.
Because statutory payments are recovered from HMRC, most of these records sit inside your PAYE obligation and its three-year minimum. Many employment advisers suggest keeping maternity and parental leave records for six years instead, matching the limitation period for contract claims. Sickness absence records have no fixed statutory period, and three years is the usual practical answer.
Pension Auto-Enrolment Records
This is the duty most often missing from record-keeping guides, and it has the longest reach after holiday records.
The Pensions Regulator requires most auto-enrolment records to be kept for six years: who you enrolled and when, gross qualifying earnings and contributions for each pay reference period, when contributions were paid to the scheme, scheme details, and the information you sent to staff. Opt-out notices are the exception at four years.
Opt-in, joining and opt-out notices must be retained in their original format, because they are the proof that someone exercised a right. Electronic copies are acceptable, but they must be legible and producible if the Regulator asks.
Accident Records
Records of reportable incidents under RIDDOR must be kept for three years from the date of the accident. Where the injured person was under 18, the usual advice is to keep the record until they turn 21, because their time limit for bringing a claim does not start running until they reach adulthood.
UK GDPR: Holding Too Much Is Also a Breach
Most employers think about retention as a floor. UK GDPR makes it a ceiling as well. Keeping personal data longer than you need it is a compliance failure in its own right.
Lawful basis. For employee records the relevant bases are legal obligation, for PAYE, right to work and statutory leave records; contract, for processing needed to run the employment relationship; and legitimate interests, for things like performance records and training logs. You do not need consent for any of this, and relying on consent is poor practice, because consent has to be freely given and the employment relationship contains an obvious power imbalance.
Special category data. Health information, disability details and anything revealing racial or ethnic origin, religion or trade union membership need an additional condition under Article 9, usually the employment, social security and social protection condition. Most of those conditions also require you to have an appropriate policy document in place explaining how you comply. Keep this data separate from general personnel files and restrict access to people who need it.
Data minimisation. Do not keep passport scans past the right to work window. Do not keep medical detail you have no live use for. Archive or delete performance notes once no process depends on them.
A written retention policy. It does not have to be elaborate. A table listing each record type, the reason you hold it, how long you keep it and how you destroy it is enough for most small employers, and it is the document that shows you have thought about it. The ICO’s employment practices guidance is the sensible starting point.
One Reason to Keep Records Slightly Longer
From 1 October 2026, the time limit for bringing most employment tribunal claims doubles from three months to six, where the act complained of happens on or after that date. Claims based on earlier events keep the three-month limit.
That does not change any retention minimum, but it does change the risk calculation. Evidence around dismissals, grievances and pay disputes stays potentially relevant for longer, and your own recollection of a decision made eight months ago is worth much less than the file note you wrote at the time.
The Retention Periods in One Table
| Record | Minimum retention | Where the duty comes from |
|---|---|---|
| Payroll and PAYE | 3 years from the end of the tax year | HMRC |
| Right to work checks | Duration of employment plus 2 years | Home Office |
| Working time and opt-outs | 2 years | Working Time Regulations 1998 |
| Annual leave and holiday pay | 6 years | New duty from 6 April 2026 |
| Auto-enrolment records | 6 years, opt-out notices 4 years | The Pensions Regulator |
| Statutory leave and pay | 3 years, often kept 6 | HMRC, plus claims exposure |
| RIDDOR accident records | 3 years | RIDDOR |
Organising It in Practice
Digital beats paper for almost everyone. Filing cabinets get lost, damaged and read by the wrong people, and they make a subject access request genuinely painful. A secure system with access controls is easier to manage, audit and delete from.
Keep special category data separate, as above, and make sure someone can actually delete records when the retention period ends. Retention policies fail in practice because nobody ever runs the deletion.
On software: if you employ one or two people, a well-organised encrypted cloud folder alongside your payroll software is genuinely enough. UK GDPR does not require you to buy anything. From around five employees, dedicated HR software starts to pay for itself in document storage, leave records, right to work expiry reminders and reporting.
Pricing models vary more than you might expect. Sage HR publishes UK pricing at £5 per employee per month excluding VAT for its core plan, Breathe publishes its plans too, and others including BrightHR quote on request, so compare like for like before assuming one is cheaper. Whatever you choose, check where data is stored, and if it sits outside the UK or EEA, ask which transfer mechanism the provider relies on. Check too that you can set retention periods and delete records rather than only archiving them.
FAQ
Do I need to keep records for employees who left years ago?
Up to a point. Payroll records run three years from the end of the relevant tax year regardless of whether the person is still with you, right to work evidence runs two years past the end of employment, and holiday and auto-enrolment records run six. Beyond the applicable period, delete or securely destroy unless there is a specific reason to keep them.
Can I store employee records in a personal inbox or on a USB stick?
You can, but it is a poor idea. Personal email accounts and removable drives do not meet the security expectations under UK GDPR, and both are easy to lose. An encrypted service with access controls is the baseline.
What if HMRC asks for payroll records I no longer have?
HMRC can charge up to £3,000 for failing to keep adequate records, depending on the circumstances and whether the failure was deliberate. It is one of the clearest risks for employers who delete payroll data early or lose it in a software migration.
Do I need consent to keep employee records?
No, for standard records. PAYE data, right to work evidence and statutory leave records are processed under a legal obligation. Tell employees what you hold and why in a privacy notice, but do not build your record-keeping on consent.
Does the new holiday records duty apply to us if we only employ salaried staff?
Yes. The duty covers annual leave and holiday pay generally. It bites hardest where hours are irregular, because that is where the calculation is easiest to get wrong, but the obligation to show compliance is not limited to those workers.
Keeping UK Employee Records Legally: The Bottom Line
The core periods are three years for payroll, employment plus two for right to work, two years for working time, six for holiday records and auto-enrolment, and three for RIDDOR. Statutory leave records sit at three as a minimum and six as a sensible maximum.
Then work the other direction. Holding data past its period is not caution, it is exposure. Use payroll software that retains PAYE records properly, keep right to work evidence in a controlled folder with a deletion date attached, write down your retention periods, and actually review them once a year.
This article is general information about UK employment, tax and data protection rules, not advice, and it does not take account of your circumstances. Retention periods, penalties and statutory duties change. Software prices were correct at the time of writing. Speak to a qualified employment solicitor, accountant or data protection adviser about your own obligations before acting on anything here.