Employee records: keep them complete, lawful and current

Key takeaways

Employee records management means keeping the right information about each employee, accurate and secure, for as long as you need it and no longer. Records upkeep is routine and outsources well. Retention rules vary: PAYE records must be kept for at least three years after the end of the tax year, and right to work copies for the employment plus two years.

• Keep only what you need, accurately.
• Payroll records: at least three years after the tax year.
• Right to work copies: during employment plus two years.
• Limit access, especially to health data.

What should an employee record contain?

Contact and emergency details, the contract and any changes, right to work evidence, pay and tax information, holiday and absence records, training and qualifications, and records of formal meetings. Keep health and other sensitive details separately, with tighter access.

• Which business processes should you outsource?
• New starter admin: get employees productive from day one

How long should employee records be kept?

Keep each type only as long as there is a reason. HMRC requires PAYE records for at least three years after the end of the tax year they relate to. The Home Office expects copies of right to work documents during employment and for two years after. Many employers keep core personnel files for six years after employment ends, matching the time limit for most contract claims.

• Payroll: at least three years after the tax year.
• Right to work: employment plus two years.
• Core personnel file: often six years after leaving.
• Unsuccessful applicants: a short, set period.

• Leaver admin: final pay, P45s and access done right
• Who is responsible for data protection in a small firm?

Which records work can be outsourced?

Setting up files for starters, updating changes such as address, pay or hours, filing documents, running retention reviews and deleting expired records, and answering subject access requests from the file. The employer decides the retention schedule and approves anything unusual.

• Subject access requests: a routine for small firms
• Document control: one current version of everything

What data protection rules apply?

UK GDPR requires employee data to be accurate, kept no longer than necessary and secure. Health and similar details are special category data. The ICO's employment guidance covers these duties. Any provider handling records needs a processor contract and access limited to what its role needs.

• Processes with sensitive data: can they be outsourced?
• Data processing agreements for outsourcing

What does this look like in practice?

A pattern we see: small firms keep everything forever, in several places. A single file per employee and an annual retention review cut both the risk and the clutter.

• See client work
• BPO Solutions for UK businesses

Employee records checklist

Review these once a year.

• One file per employee, in one system.
• A written retention schedule.
• Sensitive data stored separately.
• Access limited by role.
• Expired records deleted on schedule.
• Changes logged within a week.

• The process selection score: outsource, split or keep?
• HR helpdesk: answer staff questions without an HR team

Next step

Tell us where your employee records live today. We will suggest a structure and a retention schedule, and say what upkeep we could run.