HR Statutory Retention Periods – 2, 3, and 6 Years in the UK

In human resources and payroll administration across the United Kingdom, statutory retention periods intersect from several distinct legal frameworks: employment law, tax and National Insurance law, commercial and company law, and data protection legislation. These rules impose different durations and run from different trigger points.

Overview of Statutory Retention Periods

Start of the Retention Period

In the UK, statutory retention periods generally commence from one of three specific milestones:

• The end of the tax year (5 April) in which the pay, deduction, or statutory payment occurred (for HMRC, PAYE, NICs, and SSP records),
• The end of the relevant accounting / financial year (for Companies Act and VAT accounting vouchers), or
• The date of termination of employment or accrual of a cause of action (for employment contracts, settlement agreements, and breach of contract defences under the Limitation Act 1980).

For example, a payroll record generated in October 2025 (tax year 2025/26) subject to a 6-year retention rule must be retained until at least 5 April 2032.

Where HMRC initiates a compliance check, PAYE audit, or where an Employment Tribunal claim or civil litigation is ongoing or anticipated, statutory retention periods are automatically extended. Documents must not be destroyed while active proceedings or statutory compliance audits remain unresolved.

Records Without Explicit Statutory Retention Periods

For a significant portion of the digital personnel file, UK law specifies no rigid statutory retention schedule. In these cases, retention periods are governed by purpose limitation under data protection law and standard civil limitation periods:

Electronic Storage and Digital Compliance

Electronic retention of HR, time tracking, and payroll records is fully recognised under UK law, provided the storage environment satisfies core legal and evidentiary standards:

• Legibility and Accessibility — records must be promptly accessible and readable throughout their statutory retention lifecycle, even after software migrations or vendor changes.
• Completeness and Integrity — time records, payroll calculations, and audit logs must contain no unverified omissions or unexplained alterations.
• Audit-Proofing (Immutability) — all changes, retro-adjustments, or corrections must be logged via an immutable audit trail capturing the user, timestamp, previous value, and new value.
• Machine Readability and Exportability — records must be exportable in structured electronic formats (such as CSV, XML, or PDF) for inspection during HMRC PAYE audits, National Minimum Wage enforcement inspections, or Employment Tribunal disclosures.

Converting paper records into digital files is permissible provided employers maintain a clear electronic document management policy and ensure scans are accurate, complete representations of the originals.

From Retention to Erasure under UK GDPR

Once the applicable statutory retention period or limitation deadline expires, the legal position shifts. Under the UK GDPR (retained EU Regulation 2016/679) and the Data Protection Act 2018 (DPA 2018), employers are bound by the storage limitation principle (Article 5(1)(e)). Personal data must not be kept in an identifiable form for longer than is necessary for the purposes for which it was collected.

While a statutory retention duty applies, an employee's request for erasure ("right to be forgotten") under Article 17 UK GDPR is precluded pursuant to Article 17(3)(b) (compliance with a legal obligation). However, once that retention period lapses, the employer must either:

1. Permanently and securely delete the data, or
2. Anonymise the data so that individual employees can no longer be identified directly or indirectly.

Where records are retained solely for statutory compliance or litigation defence, employers must apply a restriction of processing (Article 18 UK GDPR)—restricting access strictly to authorised compliance or legal personnel and segregating the data from active daily HR operations.

Practical Implementation: Retention Schedules and Automated Erasure

A compliant UK HR data retention policy requires a structured data retention schedule (Record Retention and Disposal Policy) that defines:

1. The category of employee data collected,
2. The lawful basis for processing under Article 6 UK GDPR (e.g. legal obligation, performance of contract, legitimate interests),
3. The specific statutory trigger event (e.g. tax year-end, employment termination date),
4. The applicable retention duration (e.g. 2, 3, or 6 years), and
5. The automated disposal or archiving procedure.

Modern HR and time tracking software such as PlainStaff ensures compliance by implementing automated retention timers, immutable audit logs for time modifications, and granular role-based access controls to safeguard data integrity and support lawful erasure.

Sources and Legal Bases

Statutory Provisions and UK Acts of Parliament

• Working Time Regulations 1998 (SI 1998/1833), Regulation 9 — Statutory duty to keep adequate records proving compliance with the 48-hour average working week limit and night work limits (cf. ECJ Case C-55/18 CCOO)
• National Minimum Wage Act 1998, Section 9 & National Minimum Wage Regulations 2015 — Mandatory 6-year employer duty to maintain records establishing minimum wage compliance
• Income Tax (Pay As You Earn) Regulations 2003 (SI 2003/2682), Regulation 97 — Employer duties to maintain and produce PAYE wage records for HMRC inspection (minimum 3 years following the end of the tax year)
• Companies Act 2006, Sections 386 & 388 — Duty to keep accounting records for 6 years (3 years for private companies / 6 years for public companies; 6 years standard under HMRC rules)
• Limitation Act 1980, Section 5 — 6-year limitation period for actions founded on simple contract (applicable to employment contracts and post-termination wage claims)
• Equality Act 2010, Section 123 — Time limits for bringing claims before the Employment Tribunal
• Employment Rights Act 1996 (ERA 1996) — Statutory employment particulars, wage deductions, and redundancy provisions
• UK GDPR (retained Regulation (EU) 2016/679) & Data Protection Act 2018 (DPA 2018) — Principles relating to processing of personal data, storage limitation (Art. 5(1)(e)), and right to erasure (Art. 17)

UK Regulatory Guidance & Codes of Practice

• Information Commissioner's Office (ICO) Employment Practices and Data Retention Guidance — Rules on monitoring at work, retention schedules, and worker data rights
• HMRC Record-Keeping Guidelines for Employers — Official HMRC guidance on maintaining PAYE, National Insurance, and statutory pay records
• ACAS Code of Practice on Disciplinary and Grievance Procedures — Best practice guidance on fair procedures, records, and retention of warnings

Status as of evaluation: August 2026. This article provides general regulatory information for UK businesses and does not constitute formal legal or tax advice.