Which records a UK employer has to keep, and for how long — with the retention periods that differ between them, so you neither delete too early nor hoard forever.
Employment compliance is not only about doing the right thing — it is about being able to show it. Many obligations come with an explicit duty to keep records, and the ability to produce them is what protects you in a dispute, an audit, a tribunal or a Fair Work Agency enquiry. Because the records are also personal data, they must be kept securely, limited to what is needed, and disposed of when their retention period ends — keeping everything forever is itself a problem.
The essentials most employers must hold include: employment contracts and written statements of particulars; pay records and the information behind PAYE/tax and National Minimum Wage compliance; working-time and holiday records; statutory pay records (such as sick, maternity and paternity pay); right to work evidence; and records relating to discipline, grievance and dismissal. Each answers a different “can you prove it?” question.
Retention is not one number. Under the Employment Rights Act, employers must keep annual-leave (holiday) records for at least six years. Right to work evidence is kept for the duration of employment plus two years. Pay, tax and National Minimum Wage records have their own multi-year periods. Discipline and dismissal records are generally kept for a period after employment ends in case of a claim — a period that matters more now that tribunal time limits have extended to six months and the unfair-dismissal qualifying period falls in 2027. Applying one blanket retention rule to all of these gets some wrong in both directions.
Keep each employee’s contract and written statement of particulars (a day-one right), together with any variations as terms change. There is no single fixed period, but these are typically retained for the duration of employment and for several years afterwards, because they are the reference point if a dispute about terms, pay or dismissal arises — a window that matters more now tribunal time limits have extended to six months.
Payroll records supporting PAYE must be kept for at least three years from the end of the tax year they relate to (HMRC), and many employers keep them for six. Records demonstrating National Minimum / Living Wage compliance must be kept for six years. These prove that people were paid correctly and on time — a core area of enforcement.
Under the Employment Rights Act, annual-leave (holiday) records must be kept for at least six years. You should also be able to evidence working-time compliance (hours, rest, opt-outs where relevant). This is now an explicit, dated duty rather than something to run informally.
Records for statutory sick, maternity, paternity and related pay are generally kept for three years after the end of the relevant tax year (HMRC). With SSP now payable from day one and the lower earnings limit removed, accurate sickness records from the first day matter more than they used to.
Keep records of disciplinary and grievance processes and dismissals for a period after employment ends, in case of a claim. This period matters more from 1 January 2027, when the unfair-dismissal qualifying period falls to six months and far more employees can bring a claim — making a documented, fair process the key protection.
Automatic-enrolment records (who was enrolled, opt-ins and opt-outs, contributions) must generally be kept for six years (opt-out notices for a shorter period). These evidence that you met your pension duties for each worker.
Two workforce records deserve a special mention because they follow their own rules. Right to work evidence must be dated, unalterable and kept for employment plus two years. DBS records are usually noted (certificate number, date, outcome) rather than copied and kept indefinitely, and re-checked by policy. Both sit naturally in the worker record alongside the employment records above.
Employment records are personal data — and some (health, right to work, criminal-record information) are sensitive. UK data-protection law therefore applies on top of the record-keeping duties: keep records securely, restrict access to those who need it, collect no more than necessary, keep them accurate, and delete them when their retention period ends. A read-only, access-controlled store beats a shared drive of loose files, both for finding records and for keeping them lawfully.
Record-keeping usually spans HR, payroll, line managers and compliance, which is how gaps appear — everyone assumes someone else holds the evidence. The reliable pattern is a single owner per record type and one place the records live, so there is no ambiguity about who captures a contract, who records absence, or who holds the right to work evidence. Clear ownership is as important as the retention rule itself.
As a rough map (always confirm against current HMRC/government guidance): holiday records at least six years; right to work employment plus two years; PAYE/payroll at least three years (HMRC), often kept for six; National Minimum Wage six years; statutory pay around three years; auto-enrolment six years; and discipline/dismissal records for a period after employment against the risk of a claim. The point is not a single number but a different clock per record.
The step most organisations miss is disposal. When someone leaves, each record’s retention clock starts, and something has to trigger secure destruction when it ends — otherwise records pile up indefinitely, which is itself a data-protection failing. Tying disposal to the leaver process, per record type, is what keeps retention lawful without anyone having to remember years later.
Much of this comes together in the personnel file — the worker’s contract, pay and leave records, training, checks, and any conduct or performance history. Two things make an organised file valuable. First, an employee can make a subject access request for the personal data you hold about them, and you generally have to respond within a month; a scattered set of files makes that hard and risky, while a single organised record makes it straightforward. Second, records must be accurate and up to date — out-of-date or incorrect personal data is a data-protection problem in its own right. Keeping one current record per worker serves the employment duty, the data-protection duty and the practical need to find things at once.
Record-keeping is not limited to employees on a payroll. You will hold records for workers and, increasingly, for individual subcontractors and agency-supplied people — particularly right to work evidence, which from 1 October 2026 must be checked for a wider range of engagements. The kinds of record differ (a contractor has no SSP record, for instance), but the discipline is the same: know which records each engagement type requires, hold them in one place, and retain and dispose of them on the right schedule. A record system organised around the person rather than their employment status handles this naturally.
If this feels like a lot, start with the records that are both legally required and most often asked for: contracts and written statements, right to work evidence, pay and holiday records, and the training and policies behind your key obligations. Get those captured, dated and retained correctly for every worker, and you have covered the ground that the majority of disputes, audits and enquiries turn on — then extend from there.
The reliable approach is one record per worker, holding each document with its own retention rule and review date, access limited to those who need it, and disposal tied to the point the relevant clock runs out — not to a person remembering years later. That per-record lifecycle across a whole workforce is exactly what a compliance system should carry, which is where Complys helps: it holds the records, tracks the different retention periods, and reminds you. It does not give legal advice. See employment compliance software and the Employment Rights Act guide.
1 General information, not legal advice; retention periods can depend on the record and circumstances — confirm against current government/HMRC guidance. Sources: Acas; GOV.UK — records. Reviewed 26 September 2026.
