"Audit-proof" archiving is not a single statutory term under UK law. Rather, it denotes compliance with statutory record-keeping obligations across corporate, tax, and employment legislation — including the Companies Act 2006, HMRC electronic record-keeping requirements, the National Minimum Wage Act 1998, and the Working Time Regulations 1998. In practical terms, it boils down to a single principle: what has once been recorded must remain reconstructible, verifiable, and tamper-proof.
The Statutory Basis
Statutory Record-Keeping & Evidence Principles (Companies Act 2006 & HMRC Standards)
Where records are kept electronically, duty holders must ensure that the records are capable of being reproduced in legible form and that adequate precautions are taken to guard against falsification and facilitate the discovery of any falsification. Once recorded, primary data and underlying audit trails must be preserved such that the original entry and any subsequent modifications remain fully demonstrable.
UK statutory bodies — including HM Revenue & Customs (HMRC), the Health and Safety Executive (HSE), and Employment Tribunals — impose strict evidential burdens on employers. These principles apply not only to core accounting ledgers, but explicitly extend to upstream source systems. This includes digital time tracking and attendance systems whenever statutory holiday pay, National Minimum Wage (NMW) compliance, overtime, or billing entries are derived from them.
Not a Total Ban on Changes, but Full Traceability
Statutory record-keeping rules do not prohibit corrections or retroactive adjustments. Rather, they mandate that every alteration:
- preserves the original value,
- records the precise timestamp and identity of the author / user,
- and documents the business justification for the change.
A system that processes edits by recording an append-only audit trail and preserving historical values satisfies statutory requirements — even if the user interface displays only the latest active balance to the employee or line manager.
The Six Key Requirements
| Requirement | Meaning under UK Compliance Standards |
|---|---|
| Immutability (Integrity) | The original entry remains reconstructible and tamper-proof at all times |
| Completeness | No unaccounted gaps, missing time logs, or omitted supporting records |
| Traceability | The workflow from clock-in/out to payroll extraction can be audited end-to-end |
| Legibility | Data remains legible and interpretable across the full statutory retention period |
| Machine Readability | Available in structured formats (e.g. CSV, JSON, API) for HMRC or internal audits |
| Timeliness | Working hours and adjustments are recorded contemporaneously with the event |
Technical Implementation Methods
Database-based with an audit log. The standard approach for enterprise cloud applications: every modification generates an immutable, append-only audit log that cannot be altered or purged. Crucially, this logging mechanism must also capture administrative interventions.
Period Locking (Write-Protection). At the conclusion of a payroll run or billing cycle (period close), time records are locked against direct edits. Subsequent adjustments must be entered as explicit balancing entries (adjustments) in the open, current period.
WORM / Immutable Storage. Write-Once-Read-Many storage media or cloud object locks that technically prevent retrospective alteration or premature deletion.
Cryptographic Protection. Digital signatures, cryptographic hashes (e.g. SHA-256), or checksum chains that ensure any subsequent data tampering is immediately detectable.
In practice, professional systems combine these techniques: an active audit trail during day-to-day operations, automated period locking post-payroll sign-off, and cryptographic integrity protection for long-term archiving.
Why Simple File Storage Systems Fall Short
The same vulnerability applies to working time recorded via standalone spreadsheets: while spreadsheets can capture basic start and finish times, they fail the legal test for tamper-proof immutability and continuous audit logging.
Concrete Requirements for Time Tracking Data
To meet UK employment and tax compliance standards, an electronic time recording system must guarantee:
- Identity & Authentication — every logged hour or leave request is uniquely attributed to an identified worker.
- System Timestamps — the system records when the entry was created in the database, distinct from the working interval it represents.
- Indelible Audit Trail — every edit, approval, or deletion is logged with original values, new values, timestamps, author IDs, and reasons.
- Administrative Protection — direct database edits and administrative overrides are strictly restricted and captured in system logs.
- Period Locking — formal locking of timesheets once approved for payroll, NMW calculations, or invoicing.
- Statutory Retention Controls — automated retention policies that safeguard records from premature erasure for the required statutory period (e.g. 3 to 6 years).
Data Migration and System Replacements
When migrating between HR or time tracking platforms, statutory record retention duties remain entirely with the employer. Three primary strategies are available:
- Full Historical Migration into the new platform, supported by field mapping documentation, hash reconciliations, and historical audit log preservation,
- Read-Only Legacy Archiving in a secure, minimal cloud or on-premise environment for the duration of the outstanding statutory retention period,
- Standardised Data Export into structured, machine-readable formats (accompanied by complete data schemas, data dictionaries, and cryptographic checksums).
In all scenarios, the migration process must be comprehensively documented: what data sets were extracted, validation methods used to ensure completeness, reconciliation reports, and where legacy archives reside.
A frequent compliance failure is migrating only aggregated balances (such as remaining annual leave balances or year-to-date hours) without exporting the underlying transactional logs. This forfeits the detailed historical evidence needed during an HMRC compliance check or wage dispute.
Interplay with Data Protection (UK GDPR & DPA 2018)
Immutability requirements exist in structured balance with data protection rules, notably the "right to erasure" (Article 17 UK GDPR). Under Article 17(3)(b) UK GDPR, the right to erasure does not apply where processing is necessary for compliance with a legal obligation (such as tax, company law, or statutory wage record retention).
Once statutory retention periods lapse, the employer's legal obligation shifts: personal data must be securely erased or anonymised in accordance with the storage limitation principle (Article 5(1)(e) UK GDPR).
For system audit logs, this means that audit trail entries share the exact retention lifecycle of the primary records they monitor — and should be systematically deleted or anonymised alongside the underlying data once statutory retention limits expire.
Sources and Statutory References
UK Acts and Statutory Instruments
- Companies Act 2006 (Sections 386–388 & 1134–1138) — Duty to keep accounting records (Section 388(4): 3 years private / 6 years public), form of company records, and precautions against falsification
- National Minimum Wage Regulations 2015 (SI 2015/621), Regulation 59 — Statutory duty on employers to keep sufficient records to establish NMW compliance for 6 years
- Working Time Regulations 1998 (Regulation 9) — Requirement to maintain adequate records showing compliance with maximum weekly working hours and night work limits
- Taxes Management Act 1970 & VAT Act 1994 — Statutory rules governing the retention of business and payroll records for tax and VAT purposes
- Data Protection Act 2018 & UK GDPR — Principles of data integrity, confidentiality, lawful basis for processing, and storage limitation
HMRC & Regulatory Guidance
- HMRC Internal Manual: Compliance Handbook (CH10000 - General Record Keeping) — Standards for keeping electronic records, audit trails, and accessibility during compliance checks
- Information Commissioner's Office (ICO) Employment Practices Guidance — Data protection standards for keeping employee records, workplace monitoring, and retention schedules
Status of evaluation: August 2026. This article provides general operational and legal context and does not constitute formal legal or tax advice.
Frequently asked questions
- Author
- PlainStaff Editorial Team
- HR Editorial Team
- Updated on