Key Retention Periods
Under UK statutory law and regulatory guidance (including HMRC, the Working Time Regulations 1998, and the National Minimum Wage Act 1998), employers must observe specific minimum retention periods for HR, payroll, and business documentation:
| Document / Record Type | Statutory Retention Period | UK Legal Authority |
|---|---|---|
| Working time records (daily/weekly hours, night work, health assessments, opt-out agreements) | 2 years | Regulation 9, Working Time Regulations 1998 (WTR 1998) |
| National Minimum Wage (NMW) records proving payment of at least statutory minimum rates | 6 years (extended from 3 years in April 2021) | National Minimum Wage Act 1998 / National Minimum Wage Regulations 2015 |
| PAYE and payroll records (gross pay, tax deducted, National Insurance contributions, statutory payments) | 3 years from the end of the tax year to which they relate | Income Tax (PAYE) Regulations 2003 / HMRC |
| Statutory Maternity, Paternity, Adoption, and Shared Parental Pay records | 3 years after the end of the tax year to which they relate | Statutory Maternity Pay (General) Regulations 1986, reg 26, and equivalents |
| Statutory Sick Pay (SSP) records | 3 years after the end of the tax year (HMRC guidance — the statutory duty was revoked in 2014) | HMRC employer guidance |
| Personnel files, contracts of employment, and disciplinary records | 6 years following the termination of employment (recommended limitation period) | Limitation Act 1980 (Breach of contract claims) |
| Company accounting records, VAT records, invoices, and annual financial statements | 6 years from the end of the last financial year / accounting period | Companies Act 2006 (s. 386–388) / Value Added Tax Act 1994 |
| Workplace pension contributions and auto-enrolment records | 6 years | The Pensions Regulator (TPR) / Pensions Act 2008 |
| Health and safety records (statutory accident book / RIDDOR reports) | 3 years from the date of the entry/incident (40 years for records of exposure to hazardous substances or asbestos) | Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) / COSHH |
If multiple retention periods apply to a single document or data record, the longest statutory or regulatory period governs.
Calculation of the Retention Period
The calculation of a statutory retention period depends on the specific legal requirement:
- HMRC and Tax Records: Commences at the end of the relevant UK tax year (5 April) to which the records relate. For example, PAYE records for the 2025/2026 tax year must be retained until at least 5 April 2029.
- Company Accounting & VAT Records: Commences at the end of the relevant accounting period or financial year end.
- Employment Contracts and Personnel Records: Calculated from the effective date of termination of employment, aligned with the 6-year statutory limitation period for breach of contract claims under the Limitation Act 1980.
- Working Time Records: Maintained for 2 years from the date on which they were generated or from the end of the relevant reference period under the Working Time Regulations 1998.
Format and Storage Requirements
Records may be retained in electronic format, provided that their readability, completeness, data integrity, and authenticity are guaranteed throughout the entire statutory retention period in accordance with HMRC digital record-keeping principles and Making Tax Digital (MTD) standards.
Where records are created or received digitally, electronic originals must be securely stored in an accessible format with full audit trails. Digital time tracking and automated HR systems satisfy UK statutory compliance provided they prevent retrospective tampering and produce complete, legible audit reports for HMRC, the Health and Safety Executive (HSE), or an Employment Tribunal upon request.
Obligation to Delete Under UK GDPR
Once statutory and contractual retention periods expire, the statutory obligation to preserve records transitions into a mandatory duty to delete under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Under the storage limitation principle (Article 5(1)(e) UK GDPR), personal data must not be kept for longer than is necessary for the purposes for which it is processed.
Organisations must maintain a comprehensive data retention and deletion schedule (data retention policy). Automated time tracking and HR platforms should systematically monitor retention deadlines, flag expired employee data, and trigger compliant, irreversible erasure or anonymisation to prevent unlawful data retention and mitigate the risk of Information Commissioner's Office (ICO) sanctions.
- Updated on