Data retention

Retention follows purpose

Data retention starts with why personal information is held. The storage-limitation principle means keeping identifiable data no longer than necessary for that purpose. It does not create one universal period for an employment file.

Tax, health and safety, employment or regulatory law may set or influence how long particular records are needed. Other periods rely on a documented assessment. The ICO's storage-limitation guidance asks organisations to justify their periods and review information when it is no longer required.

Set periods by record category

Separate recruitment, payroll, contracts, absence, performance, disciplinary, grievance, pension, right-to-work and leaver information. Each category can have a different purpose, legal context and useful starting event.

A retention schedule should name the category, purpose, trigger, period, disposal method, owner and any controlled hold. Useful triggers include an application closing, employment ending, a case being resolved or a document being superseded.

Turn the schedule into action

At the end of a period, review, securely delete or truly anonymise the information unless a current reason justifies keeping it. Pseudonymisation is not deletion where the person can still be reconnected. A live dispute, legal hold or rights request may justify a documented exception; keeping everything “just in case” does not.

Apply the rule to email, local folders, exports, backups where deletion is feasible, integrations and processor systems, not just the HR platform. Tell people the period or the criteria used to set it. Assign owners for review, automate disposal where it is safe, preserve evidence of deletion and make holds visible so an exception does not quietly become permanent storage.