For how long should an employer keep an employee or ex-employee's personnel files?
The General Data Protection Regulation (2016/679 EU) (GDPR) sets no specific periods for retention of employees' personal data, but one of the key principles of the GDPR is that personal data should not be kept longer than is necessary for the purpose or purposes for which it is being processed. Employers must therefore set their own retention periods, based on business needs, professional guidelines and statutory requirements. For example, there is a statutory requirement to keep national minimum wage records for three years after the pay reference period following the pay period that they cover. For a detailed (though not exhaustive) list of specific record-keeping requirements in the employment field, see Quick Reference > Record-keeping - statutory requirements.
Where the data is kept after the termination of employment for the purposes of defending possible tribunal and court claims, the time limits for bringing claims will inform the retention period. Most employment tribunal claims must be brought within three months of the date of the act complained of, although some (such as equal pay and redundancy pay claims) have a time limit of six months, and the time limit can be extended to allow the employee to contact Acas about early conciliation. Claims for breach of contract can be brought in the civil courts at any time within six years of the alleged breach.
The GDPR is in force from 25 May 2018.